Showing posts with label privacy. Show all posts
Showing posts with label privacy. Show all posts

Sunday, May 29, 2011

New Internet Rules: contours of the debate

By Arushi Garg

Various concerns have been raised after rules relating to the internet were notified on 11th April 2011. Objections have been raised on mainly three fronts: one, that an unreasonable standard has been imposed on the intermediaries and cybercafé owners who will face liability for acts that are not strictly within their control; two, that the said rules abridge the fundamental right to freedom of speech and expression that has been enshrined in Article 19 of the Indian Constitution and three, that the right to privacy has been contravened through the power conferred on government agencies to access sensitive personal information of internet users.

To start with, it must be noted that the liability imposed on intermediaries is not absolute. They are not in fact responsible for all the activities of their users. They are only required to publish relevant rules and policies and inform the users that specific kinds of materials have been disallowed through the rules (Rule 3, the Information Technology (Intermediaries guidelines) Rules, 2011). In addition to this, hosting or transmitting illegal information is only problematic if it is done “knowingly.” The intermediary is required to remove the offensive information within thirty six hours of it being stored or hosted or published, but only if it is brought to his notice, or he otherwise obtains knowledge. This does not seem to be as tyrannical as it is being made out to be, and the idea that intermediaries bear the “extremely onerous responsibility to be able to police every bit of content before it goes out” seems to be a misconception.

Another report claims that the effect of the new rules is that cybercafé owners must now make sure their equipment is not used for illegal purposes. On the contrary, the whole thrust of the new rules is towards ensuring that if cybercafé equipment is in fact used for illegal purposes, the user is easy to trace. No unrealistic expectations have been put on café owners. Duties include maintaining log record of the uses to which their equipment is put, collecting copies of identification from all users and complying with the physical layout mandated by the rules.

Secondly, concerns regarding freedom of speech and expression have disturbed the online community. The prohibition on materials that have been described in vague terms such as “disparaging”, “grossly harmful” and “objectionable” have caused great alarm. In the words of Nikhil Kumar Verma, one of India’s top ten most influential tweeters, "No-one has a say of what is right, and what is wrong... if someone objects you can't talk about it." According to the head of a digital marketing agency in Mumbai, “Any individual can write to us and say that piece of content offends us and without any recourse we have to take it down." This does not seem to be a tenable objection. It is absurd to assume that the standard laid down in the rules is a subjective standard. Terms such as “objectionable” are surely to be adjudged based not on what overly sensitive people might regard as objectionable but what a reasonable man might perceive as such.

Still, it is well worth noting that these terms have not been defined and are open to misuse. Already, Google has received reports from the State asking them to take down content that is critical of leading politicians, prompting them to publicly reject the rules as anti-democratic. This obviously raises concerns that these terms might be open to a broad, arbitrary interpretation.

While examining this objection in the light of the Constitution, one way of looking at these provisions is through the lens of the basic norm of statutory interpretation which requires that if it is possible to interpret a statute in two ways, only one of which is constitutional, then “a narrow pedantic interpretation running counter to the constitutional mandate ought always to be avoided.” This means that these terms are to be read in such a manner so as to be consistent with the reasonable restrictions on the freedom of speech and expression that have already been laid down in Article 19(2) of the Constitution of India. Given this interpretation, these rules merely impose additional duty on intermediaries in the light of existing restrictions, rather than imposing any new ones.

However, the lack of definition also leads us to a discussion surrounding the “void for vagueness” doctrine. According to a 5 judge bench of the SC,
“It is the basic principle of legal jurisprudence that an enactment is void for vagueness if its prohibitions are not clearly defined. Vague laws offend several important values. It is insisted or emphasised that laws should give the person of ordinary intelligence a reasonable opportunity to know what is prohibited, so that he may act accordingly. Vague laws may trap the innocent by not providing fair warning. Such a law impermissibly delegates basic policy matters to policemen and also judges for resolution on an ad hoc and subjective basis, with the attendant dangers of arbitrary and discriminatory application. More so uncertain and undefined words deployed inevitably lead citizens to "steer far wider of the unlawful zone ... than if the boundaries of the forbidden areas were clearly marked".”


A provision is therefore vitiated by vagueness if it creates scope for “guiltless and innocuous innocent people” to be “arrested and prosecuted by abusing or misusing or misapplying this definition.” This idea has been recognized on other occasions as well, in the form of the “void for vagueness” doctrine, an idea borrowed from American jurisprudence. According to this doctrine, laws should be sufficiently clear so as to give notice of the conduct that is proscribed.

In the current matrix, there are three implications of this observation. Firstly, these ill-defined restrictions may well be held violative of the principles of natural justice, because the general public has not been given due notice of what sort of conduct is being sought to be controlled by these rules.

Secondly, the direct and inevitable impact of these rules, as bolstered by the SC’s observations, that people would “steer far wider of the unlawful zone”, i.e., people may hesitate before exercising their right to freedom of speech and expression for fear of violating these rules. This would amount to a violation of Article 19(1)(a) read with 19(2).

Thirdly, since it is vagueness that leads to such massive scope for abuse by enforcement agencies, it might be possible to successfully challenge the constitutionality of some of these measures. The only catch here is that high standard that has been articulated by the SC while invoking this doctrine may prove to be a hurdle. In the words of the apex court, this can be done if a Statute is “absolutely vague and its language wholly intractable and absolutely meaningless.”

Last, but most troubling, is the fact that these new rules allow for transfer of personal information, without the consent of the user, to government agencies as they state the reason for soliciting this information and don’t disclose it further on. Such personal information includes, inter alia, “sexual orientation” and “any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise.”

This sweeping provision has to be viewed against the fact that privacy has been recognized as a facet of the right to life in India. It is true that the right to privacy in India is subservient to compelling state interests, but recent case law has aimed at expanding this right. The Selvi judgment has recognized that the right to privacy has both mental and physical aspects. In the celebrated Naz judgment that deals in particular with the right to privacy of people of varying sexual orientations, the Delhi High Court described the right to privacy as “private space in which man may become and remain himself.”

While the relaying of information that strictly relates to a compelling state interest might be lawful, the Centre may perhaps want to review the unregulated powers that have been granted to the Government under Rule 6 of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, in the light of the broadening contours of the right to privacy. But the Government does not seem interested in answering these criticisms.

Friday, December 24, 2010

Consilience 2011

The Law and Technology Committee (elTek) of the National Law School of India University, Bangalore is hosting ‘Consilience’, a conference where contemporary issues of critical relevance in the field of law and technology are addressed. Past editions of the conference have engaged with a vast spectrum of cutting edge issues such as “Legal Aspects of Business Process Outsourcing”, “Biotechnology and the Law” and “Free and Open Source Software" drawing in on the rich experience of luminaries like Mr. Montek Singh Ahluwalia (Deputy Chairman, Planning Commission of India), Mr. R. Ramraj (MD and CEO, Sify Technologies Ltd.), Mr. Richard Stallman (Founder – GNU Project). Last year's conference, the theme for which was "Internet Intermediary Liability in India", has been hailed to have made a rich contribution to the evaluation of status quo and the future trajectory of intermediary liability in India by bringing in diverse perspectives from the academia, the industry and other important stakeholders. Some of the keynote speakers at the Conference were Ms. Wendy Seltzer (Founder, Chilling Effects Clearhouse and Fellow, Berkman Centre for Internet and Society), Mr. Gavin Sutter (Lecturer, University of London ) and Mr. Sunil Abraham (Executive Director, Centre for Internet and Society, Bangalore). Details and conference videos from last year's conference are available at http://www.consilience.in/

The 2011 edition of Consilience will focus on the theme of privacy and how it affects individuals and organisations. Consilience 2011 thus seeks to explore the interface between privacy and technology, the effect technology has on our understanding of privacy, and how technology shapes the contours of privacy and is in return shaped by privacy. Specific dimensions that the conference will engage with include privacy in the context of e-commerce transactions, social networking sites, upcoming gadgets, its equation with the State (with a special focus on the upcoming Unique Identity number project). Updates regarding the schedule of the conference will be posted on http://www.consilience.in/

Sunday, August 8, 2010

The "Spirit" of Privacy

The contours of privacy law in India are, as yet, uncertain. In the wake of attacks against the Unique Identification Data (UID) project, the government is moving ahead with plans to legislate in this area. Tarunabh had listed out some excellent pieces on UID and privacy in his post here, including pieces by Usha Ramathan and Rahul Mathan.

I comment on this latest government initiative and the pressing need for clearer privacy norms in India, deploying the Swami Nithyananda scandal as the backdrop. This editorial was published in the Times of India (Crest) yesterday, as below:

In the Service of Privacy

A leaked videotape involving a Tamil actress thrust Swami Nithyananda into the eye of a controversial storm. While some claimed that the video was doctored, others argued that this was an aspect of tantra not immediately discernible to the uninitiated. Yet others alleged that the swami's encounter with the actress casts serious aspersions on his claim to be celibate and his legitimacy as a guru.

It is important to separate the 'moral' from the legal here. For the most part, what the good swami does within the privacy of his home is his own business. In fact, advanced legal regimes would treat this as an unlawful encroachment on the swami's right to privacy. For Lenin Karuppan, an erstwhile disciple, had secretly planted a camera in the swami's bedroom and leaked out the tape without his consent.

More recently, K Yogesh, a devotee of the swami, lodged a criminal complaint alleging that Lenin himself had committed a legal wrong. For, his secret entry into the swami's bedroom and the planting of a camera therein without permission had caused severe distress and annoyance to the swami and was therefore punishable under the Indian Penal Code as "criminal trespass".

There is a decent chance that Lenin would be held criminally liable for this intrusion. However, what of civil liability? Can Indian courts apply common law principles of privacy and grant appropriate damages to the swami for this harm?

US courts have been preventing such intrusions through civil law remedies since the publication of an influential Harvard Law Review article in the 1890s which advocated for a right to privacy and noted in pertinent part that :

"The intensity and complexity of life, attendant upon advancing civilisation, have rendered necessary some retreat from the world, and man, under the refining influence of culture, has become more sensitive to publicity, so that solitude and privacy have become more essential to the individual; but modern enterprise and invention have, through invasions upon his privacy, subjected him to mental pain and distress, far greater than could be inflicted by mere bodily injury."

Retreating from the material world is not an alien concept to a civilisation, whose ancient scriptures have prescribed "vanaprastha" as one of the four stages to be traversed in one's life. More to the point however, the massive proliferation and dissemination of personal data in this digital day and age gives great cause for concern and makes a law to protect privacy imperative.

One might argue that Indian law only recognises a right to privacy within the meaning of Article 21 of the Constitution of India, which guarantees to every citizen the "right to life". In other words, unless the state is directly involved in an infraction that implicates the privacy of a citizen, a court cannot interfere. But even here, one might argue that by failing to prevent invasions of privacy by other private citizens, the state breaches its constitutional duty. Such an argument was implicit in the notorious murderer Auto Shankar's case, where the court grappled with the issue of whether or not sordid details of the serial killer's life could be published without his consent.

Justice Jeevan Reddy of the Supreme court held in that:

"The right to privacy is implicit in the right to life and liberty guaranteed to the citizens of this country by Article 21. It is a "right to be let alone". A citizen has a right to safeguard the privacy of his life, family, marriage, procreation, motherhood, child-bearing and education among other matters. None can publish anything concerning the above matters without his consent, whether truthful or otherwise and whether laudatory or critical. If he does so, he would be violating the right to privacy of the person concerned and would be liable in an action for damages."

In other words, the court was suggesting that breaches of privacy by non-governmental actors were also to be prohibited by laws such as the common law of privacy. Unfortunately, the contours of this law are uncertain, as we have not had many privacy cases in India.

All this is set to change, as the government is now seriously considering a comprehensive statute to protect privacy. It has constituted a panel of senior officials headed by Shantanu Consul, secretary (personnel) in the Department of Personnel and Training, to prepare a draft law in this regard. The key challenge of this law will be to determine the extent of "privacy" accorded to citizen's data and the circumstances in which such privacy can be abrogated in the larger interests of the State and the public.

Nithyananda Swami and his esoteric video are not the trigger for this wonderful legal initiative by the government. Rather, it stems from the scathing attacks that have been mounted on the ambitious Nilekani-led UID (Unique Identification Data) project that seeks to provide unique identity cards to all Indians. Pertinent information relating to specific individuals could then be tagged to the ID in question. Civil society groups and many others have berated the project and questioned its legitimacy on account of the capturing of private data and its potential for misuse. Indeed, some fear that without a corresponding privacy legislation, there is a serious threat to the very constitutionality of the UID project.

Were such a legislation to shape up in the near future, the swami's supporters will have much cause to celebrate. Not only because it would bolster the swami's case for preventing future intrusions of this sort, but also because spiritual development and privacy are largely two sides of the same coin. Indeed, one cannot effectively traverse the many layers of human consciousness, unless one's metaphysical odyssey is protected to some extent from harmful outside interference.

Saturday, May 1, 2010

Privacy and UID

This blog has discussed the implications of the UID project before. Readers interested in the issue may want to see the following resources too:
- Expert Committee on Metadata
- Usha Ramanathan's articles in the IE: (i) Personal is Personal See also, the comment on data keeping in Nazi Germany), and (ii) Eyeing IDs
- Rahul Matthan on the need for a law protecting privacy
- Perry4law, a 'techno-legal law firm', on some of the implications of the project