Page 306 - DMGT308_CUSTOMER_RELATIONSHIP_MANAGEMENT

Unit 12: Customer Privacy

with the authority to legislate on any matter not enumerated in List II of the Seventh Schedule Notes
(the State List) and List III of the Seventh Schedule (the Concurrent List). In the absence of specific
data protection entries in the other lists, it would appear that entry 97 grants the Parliament the
residuary powers needed in order to make laws on any matters it deems fit in national interest,
including the power to enact the data protection legislation.
12.1.6 Is there is Constitutional Right to Privacy?

In certain countries, such as South Africa and Argentina, the right to privacy is incorporated into
the constitution. In India, the right of privacy has been derived through judicial decisions, from
the rights available under Articles 19(1) (a) (the fundamental right to freedom of speech and
expression) and 21 (the right to life and personal liberty) of the Constitution. There was no
specific discussion on the concept of privacy in the Constituent Assembly Debates. However,
over time, the Supreme Court has held that even though the right to privacy is not expressly
enumerated as a fundamental right, it could certainly be inferred from the fundamental rights
guaranteed under the Constitution.
Article 19(1) (a) states that - All citizens shall have the right to freedom of speech and expression.

The Supreme Court has, through a series of decisions held that, even though the right to privacy
was not enumerated as a fundamental right, it could certainly be inferred from the fundamental
rights of the Constitution. However, these fundamental rights are not without restrictions. Just
as Article 19(1) (a) bestows on each citizen the fundamental right of freedom of speech and
expression, Article 19(2) imposes restrictions on this right. It states that:

Nothing in sub-clause (a) of clause (1) shall affect the operation of any existing law, or prevent
the State from making any law, in so far as such law imposes reasonable restrictions on the
exercise of the right conferred by the said sub-clause in the interests of the sovereignty and
integrity of India, the security of the State, friendly relations with foreign States, public order,
decency or morality, or in relation to contempt of court, defamation or incitement to an offence.
The necessary implication of this is that the Government can deprive a citizen of his constitutional
right of freedom of speech and expression for any of the reasons set out in Article 19(2). By
natural extension of this principle, the Supreme Court, in Gobind v. State of Madhya Pradesh, held
that a violation of personal privacy is possible with the sanction of law.
However this position was clarified and extended in People’s Union of Civil Liberties v. the Union of
India where the right of government authorities to intercept, in the interests of national
sovereignty, messages transmitted or received by any telegraph was challenged in the context
of wire tapping. The Supreme Court held that tapping a person’s telephone line violated his
right to privacy, unless it was required in the gravest of grave circumstances such as in the case
of a public emergency. This case was significant in that while the court upheld the restrictions on
the fundamental freedoms that have been guaranteed under the constitution, it insisted that the
government must use restraint in exercising these powers.
All available cases on this point have been decided in the context of government actions that
resulted in the deprivation of personal privacy of individuals. There has been no case decided in
the context of the infringement of personal privacy by private citizens. It is therefore unclear as
to how these precedents will apply in such cases.

12.1.7 Existing Legislations

There is not data protection statute in the country. However, the Information Technology Act,
2000 (the “IT Act”) contains provisions under which certain Government agencies can gain
access to data. The IT Act was recently amended and two new sections, 43-A and 72-A, were
inserted dealing with data protection.

LOVELY PROFESSIONAL UNIVERSITY 301