Author – SIRI CHANDANA TALASILA , Student at SYMBIOSIS LAW SCHOOL, HYDERABAD.
Introduction
The United Nations General Assembly defines privacy as the right of individuals to have a “private sphere” with or without interactions with others, free from state interventions and excessive unsolicited intervention from uninvited individuals. It is also the ability of the individual to determine who holds information about them and how it is used.[1] The right to privacy is so important as it impedes the right to freedom of expression and opinion. In the Pegasus Spyware scandal, the government of India has allegedly breached the privacy of opposition party members, journalists, and activists using the Israeli cyber arms company NSO Group-Pegasus. The right to privacy can be violated by the state or corporation, especially nowadays with the rise in data analysis and mining of personal information.
Keywords: Right to privacy, surveillance, personal information, state
I. Pegasus Spyware and the Indian Government Scandal
The Indian government, in July of the year 2017, purchased Pegasus from an Israeli organization. The purchase was part of a more significant arms deal in 2017, known to the public by the New York Times report. This report came to light on January 29, 2021. Advocate ML Sharma has moved the Supreme Court seeking a probe into this alleged purchase. The advocate is also the petitioner in the case, seeking to recover public money that was paid for the deal.
The controversy first came to light on July 18th, when The Wire and other publications published a report of three hundred mobile numbers, informing the potential targets of the software as access was given to the governments. In India, political leaders like Rahul Gandhi, ECI member Ashok Lavasa, and election strategist Prashant Kishore’s numbers were mentioned. [2]The centre denied all the over-the-top allegations.
The NSO group also denied the allegations of snooping and surveillance as claimed in the report. They said the unidentified sources have given information without a factual basis and are far from reality.
Around 500 individuals and groups wrote to the Chief Justice of India seeking the intervention of the court in the scandal along with a moratorium on the sale and use of Pegasus spyware in India. The court heard eight petitions seeking a probe into this matter of the hacked phones. [3]The chilling effects of the violation of privacy are said to have affected 45 countries that were clients of the NSO group.
II. The case in the Supreme Court [4]
The Supreme Court in the case of Manohar Lal Sharma vs. Union of India on October 27, 2021, looked into the matter of Pegasus Spyware Software, still pending in the court. The issues in the case included
a) Should the court order an investigation if the government used Pegasus software?
b) If the Pegasus Spyware infringed on a person’s right to privacy,
c) If the Pegasus spyware violated the legal framework related to surveillance? [5]
On October 16th, 2021, a “limited affidavit” was submitted by the Solicitor General of India and the Additional Secretary of the Ministry of Electronics and Information Technology, Union of India.
The Supreme Court communicated to the respondents that the limited affidavit gave insufficient information to reach a conclusion and that additional time could be provided to the respondents to file a detailed affidavit. The respondents said that the revelation of certain facts compromises the security and defence of the country.
The court in this case has accomplished two main issues. Better compliance from the government (respondent) and the establishment of a technical committee
A) The Response of the Court to Respondents refusal to state facts claiming danger to national security
The Supreme Court held that “it is a settled position of law that in matters pertaining to national security, the scope of judicial review is limited.” However, this does not mean that the state gets a free pass every time the spectre of “national security” is raised. National security cannot be the bugbear that the judiciary shies away from by virtue of its mere mentioning. Although this Court should be circumspect in encroaching upon the domain of national security, no omnibus prohibition can be called for against judicial review. ” [6]
The court has also said the Union of India may decline to provide information when the security of state exists, but it must plead and prove why that information is a security concern. They cannot expect the court to be a mute spectator because of the mere invocation of national security.
B) Need for an expert committee
The Supreme Court was of the opinion that after multiple opportunities given to the Union of India to fail an affidavit and failing to place any facts citing “national security”, there was no hope of issuing a direction to the respondent other than delaying proceedings, so an expert committee was appointed to probe the truth or falsity of allegations due to public importance and the alleged large-scale violation of fundamental rights. The court cited reasons such as violation of freedom of speech and privacy, lack of a clear stand by the Union of India, involvement of foreign parties, etc.
III. Legal provisions on surveillance
A. Indian Telegraph Act, 1885
Section 5(1) establishes the time frame of how long the state government or central government or any officer authorized by the state and central government can take temporary possession of the telegraph that is established, maintained, or worked by any person under this act.[7]
Section 5(2) gives the government the power to intercept or halt the transmission, or detain messages transmitted or received by any telegraph, or be disclosed to the government. [8]
B. Information Technology Act, 2000
In Section 69, the central or state government or any officer authorised by either state or central government, in the interest of the sovereignty, integrity, and security of India, directs any agency of the government to monitor, intercept, or decrypt any information that is transmitted, generated, received, or stored in any computer resource.[9]
In Section 69A, the central or state government or any officer authorised by either state or central government, in the interest of the sovereignty, integrity, and security of India, blocks public access to information generated, received, hosted, or stored in any computer resource.[10]
Section 69B gives power to the central government to enhance cyber security and to identify, analyse and prevent the spread of any computer virus in the country. It entitles any agency of the government to monitor and collect traffic data or information generated, transmitted, received or stored on any computer resource.[11]
C. The Indian Post Office Act, 1898
Section 26, gives the central government and the state government of India the right to intercept postal articles. In the event of a public emergency, tranquillity, or public safety, the central or state government or any officer who was authorized can direct the interception and/or disposal of the postal articles which are in the course of transmission. If the public emergency, safety, or tranquility is in question, then a certificate issued by the central or state government is considered as proof of the condition being satisfied.[12]
D. Information Technology (Procedure and Safeguards for Interception, Monitoring, and Decryption of Information) Rules, 2009
Interception and monitoring rules framed under Sections 69 and 69B stipulate who may issue interception and monitoring orders, how such orders are to be executed, the duration they remain in effect, to whom data may be disclosed, intermediary confidentiality obligations, periodic oversight of interception directions by a Review Committee under the Telegraph Act, the retention of interception records by intermediaries, and the mandatory destruction of information in appropriate cases. [13]
IV. Important Judgment
A. Justice K.S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors
Facts of the case: The Aadhar card project is run by the UIDAI. A twelve-digit Aadhar number was issued to the citizens of India by the UIDAI. This was done to remove any false beneficiaries from the numerous welfare schemes interlinked with the Aadhar project. The Honourable Justice K.S. Puttaswamy challenged the constitutional validity of this scheme. Over time, multiple aspects of this scheme were challenged, including the compilation of demographic biometric data by the government, which was questioned on the grounds of violation of the right to privacy.
Issue:- Is the right to privacy a fundamental right?
A landmark case making the right to privacy a fundamental right in India. Its landmark due to the following reasons:-
(a) The nine-judge bench in the case stated that the right to privacy is a part of the right to life and personal liberty under Article 21 and is also a part of the freedoms guaranteed in the Indian Constitution (Part III).
(b) The case also emphasized the need for implementing a new law for data privacy, discussing privacy as an intrinsic value and expanding the scope of privacy in personal spaces.
(c) held that the right to privacy is not absolute and provided a standard for judicial review in cases of intrusion into privacy by the state.
(d) provided for a four-fold requirement of when the right to privacy can be restricted.
(e) discussed the positive and negative content of privacy where the state was not only supposed to intrude but also obligated to protect the right to privacy of its citizens.
(f) Informational privacy also comes under the right to privacy.[14]
(B) People’s Union for Civil Liberties vs. Union of India & Ors.
Facts:- The petitioner filed a PIL challenging the constitutional validity of Section 5(2) of the Telegraph Act, claiming it is a violation of the right to privacy. This was challenged in the wake of a report published by the CBI on tapping the phones of politicians.
Issue:-Whether Section 5(2) of the Indian Telegraph Act violates the right to privacy and the need for procedural safeguards in this section to prevent indiscriminate phone tapping?
The court didn’t strike down section 5(2) but laid out guidelines for exercising surveillance, so the power is not going to be misused. The court, in this case, analysed the conditions required to be satisfied for use of the provision and made an observation on the strict adherence of the conditions to be fulfilled.[15]
(C) Shreya Singhal v. Union of India
facts:- In 2012, Mumbai police detained two females, Shaheen Dhada and Rinu Srinivasan, for protesting a bandh announced in the aftermath of Shiv Sena president Bal Thackery’s death. The women expressed their opinions on Facebook. Despite the fact that the imprisoned ladies were ultimately released and the criminal charges against them were closed, the arrests drew great public outrage. It was thought that the police had abused their position by invoking Section 66A, claiming that it violated freedom of speech and expression, among other things.
Issue: If Section 69A and the Rules are unconstitutional?
While considering the validity of Section 69A, the court observed that Section 69A is narrowly drafted and has several safeguards. The Court further stated that the absence of some additional protections, such as those included in Sections 95 and 96 of the Criminal Procedure Code, did not render the rules unconstitutional. As a result, the Supreme Court confirmed the legality of Section 69A and the rules promulgated under it.[16]
(D) Facebook v. Union of India & Ors.
Facts:- Facebook has petitioned the Supreme Court to transfer a number of cases involving Aadhaar and social media and the grievance is that the intermediaries are not providing information in respect of the originator of the communication/content which has been circulated/transmitted/shared on the platforms provided by the intermediaries. It has specifically requested that the court transfer all four cases pending before three high courts.
Issue:- is how and in what manner the intermediaries should provide information including the names of the originators of any message/content/information shared on the platforms run by these intermediaries.
The Supreme Court held the following with regards to Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009. We must also highlight that de-encryption, if available easily, could defeat the fundamental right of privacy and de-encryption of messages may be done under special circumstances but it must be ensured that the privacy of an individual is not invaded. However, at the same time, the sovereignty of the State and the dignity and reputation of an individual are required to be protected. For purposes of detection, prevention and investigation of certain criminal activities it may be necessary to obtain such information. The Supreme Court stated that the laws are still nascent and various creases need to be ironed out. [17]
V. Forward
The Pegasus case is of great importance as it showcases the duty and role of each organ of a democratic country in the matters of the right to privacy and state surveillance.
A. Judiciary
Article 32 designates the Supreme Court as the custodian and guarantee of basic rights, granting it the authority to enforce them. The external committee order and the response of the SC towards the state claiming national security is going to set a precedent for the future, one where state surveillance can be in the best interest of both citizens and the state.
B. Legislature
The legislature needs to pass the Personal Data Protection, 2019 bill, in which Section 85 is a provision for offenses of the state. The absence of this law is unfortunate as this will be the sole law for the protection of personal data. (It is similar to European privacy laws-GDPR and it is the strongest law for data protection).
C. Executive
Stopping the arbitrary use of power, if any.[18]
CONCLUSION
State surveillance is a necessary evil. It can protect the country from crime and acts of terrorism, but surveillance laws all over the world have grey areas. There is a constant conflict between fundamental rights and state security. It is no new news that it is being misused by states to target the wrong people to protect their own political interests rather than the state’s at the expense of their citizens. People targeted by the Pegasus spyware were opposition leaders and political dissenters, which are forces that oppose the government. With respect to the Pegasus case, the government should prove itself in the Pegasus scandal and pass laws on data privacy protection.
REFERENCES
CASE LAWS
1) Manohar Lal Sharma vs. Union of India 2021 SCC OnLine SC 985
2) Justice K.S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors AIR 2017 SC 4161
3) People’s Union for Civil Liberties vs. Union of India & Ors . (1997) 1 SCC 301
4) Shreya Singhal v. Union of India (2013) 12 SCC 73
5) Facebook v. Union of India & Ors. W.P.(C)NO.679/2019
Online Resources
1) United Nations General Assembly, Promotion and protection of all human rights, civil, political, economic, social and cultural rights, including the right to development, ohchr, https://www.ohchr.org/Documents/HRBodies/HRCouncil/RegularSession/Session23/A.HRC.23.40_EN.pdf
2) Srishita Ojha, Pegasus Spyware: Supreme Court Urged To Take Cognisance Of New York Times Report Alleging Pegasus Purchase By Indian Government, https://www.livelaw.in/top-stories/pegasus-spyware-ml-sharma-moves-supreme-court-new-york-times-report-indian-government-190660.
3) Express Web Desk, A timeline of the Pegasus snooping scandal, The Indian Express (2021), https://indianexpress.com/article/india/a-timeline-of-the-pegasus-snooping-scandal/.
4) Day 6 Oral Hearings: Pegasus, Supreme Court Observer, https://www.scobserver.in/reports/manohar-lal-sharma-prime-minister-pegasus-spyware-probe-day-6-oral-hearings/.
5) state of cyber security and surveillance in India, cis-india.org, https://cis-india.org/internet-governance/blog/state-of-cyber-security-and-surveillance-in-india.pdf.
Pegasus Case, Drishti IAS, https://www.drishtiias.com/daily-updates/daily-news-analysis/pegasus-case.
[1] United Nations General Assembly, Promotion and protection of all human rights, civil, political, economic, social and cultural rights, including the right to development, ohchr, (last visited Feb 28, 2022), https://www.ohchr.org/Documents/HRBodies/HRCouncil/RegularSession/Session23/A.HRC.23.40_EN.pdf
[2]Srishita Ojha,Pegasus Spyware: Supreme Court Urged To Take Cognisance Of New York Times Report Alleging Pegasus Purchase By Indian Government, (last visited Feb 16, 2022), https://www.livelaw.in/top-stories/pegasus-spyware-ml-sharma-moves-supreme-court-new-york-times-report-indian-government-190660.
[3] Express Web Desk, A timeline of the Pegasus snooping scandal, (last visited Feb 16, 2022), The Indian Express (2021), https://indianexpress.com/article/india/a-timeline-of-the-pegasus-snooping-scandal/ .
[4] Manohar Lal Sharma v. Union of India, 2021 SCC OnLine SC 985
[5] Day 6 Oral Hearings: Pegasus, Supreme Court Observer, (last visited Feb 16, 2022), https://www.scobserver.in/reports/manohar-lal-sharma-prime-minister-pegasus-spyware-probe-day-6-oral-hearings/.
[6] Union of India v. Manohar Lal Sharma, 2021 SCC OnLine SC 985
[7] Indian Telegraph Act,1885, §5(1), No.13, Acts of Parliament, 1885
[8] Indian Telegraph Act,1885, §5(2), No.13, Acts of Parliament, 1885
[9] Information Technology Act,2000, §69, No.21, Acts of Parliament, 2000
[10] Information Technology Act,2000, §69A, No.21, Acts of Parliament, 2000
[11] Information Technology Act,2000, §69B, No.21, Acts of Parliament, 2000
[12] The Indian Post Office Act,1898, §26, No.6, Acts of Parliament, 1898
[13] state of cyber security and surveillance in India, cis-india.org, (last visited Feb 28, 2022) https://cis-india.org/internet-governance/blog/state-of-cyber-security-and-surveillance-in-india.pdf.
[14] Justice K.S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors. AIR 2017 SC 4161
[15] People’s Union for Civil Liberties vs. Union of India & Ors. (1997) 1 SCC 301
[16] Shreya Singhal v. Union of India (2013) 12 SCC 73
[17] Facebook v. Union of India & Ors. W.P.(C)NO.679/2019
[18] Pegasus Case, Drishti IAS, (last visited Feb 28, 2022), https://www.drishtiias.com/daily-updates/daily-news-analysis/pegasus-case.