Published On: December 3rd 2025
Authored By: Shreya Alok Pathak
University of Mumbai - Thane Subcampus
Introduction
The modern digital era has transformed every aspect of human life. Information technology and the internet have made human life much easier by providing access to knowledge, facilitating global communication, and enabling economic development. However, this profound growth of digital ecosystems has led to severe concerns about data protection and privacy, which today stand at the core of human rights discourse. In the 21st century, personal data has become a part of human wealth, giving rise to a “surveillance economy.” Even though technological advancements offer immense benefits, they also pose challenges to autonomy, dignity, and the freedom of individuals.
This article dives into different aspects of data privacy, like the recognition of privacy as a fundamental human right, reviews international and domestic legal frameworks, highlights contemporary issues of surveillance and data misuse, and proposes reforms for a balanced approach that safeguards both innovation and individual rights and studies the inter-relation between data privacy and human rights.
Human Rights
Human Rights are the universal rights that are inherent to all human beings regardless of gender, race, caste, religion, nationality, etc. The main purpose of human rights is to secure the rights of humans without any discrimination.
The UN General Assembly adopted the Universal Declaration of Human Rights (UDHR) in 1948. UDHR proved to be a huge milestone in safeguarding human rights. It provides 30 articles each securing the fundamental rights of individuals, such as the right to life, the right to education, the right to food, the right to dignity, etc.[1]
Digital Privacy
In today’s digital era, traditional human rights are increasingly exercised online. Digital technologies provide numerous ways to advocate for, defend, and exercise human rights, and it has an impact on all types of rights – civil and political, as well as cultural, economic and social rights. Digital technology has deeply transformed the public square by shaping different facets like how people access and share information, form their opinions, debate, and mobilise. But this also gives rise to suppression, limit and violation of rights, for instance, through surveillance, censorship, online harassment, algorithmic bias and automated decision-making systems.
The marginalized individuals and groups face disproportionate effects of the misuse of digital technology, leading to inequality and discrimination – both online and offline. People exercise their freedom of speech on social media platforms, also digital resources favour the right to education. However, it also leads to violations of rights through censorship, surveillance, and data breaches.
In Reno v American Civil Liberties Union, the US Supreme Court recognized the internet as a medium of free speech and struck down provisions of the Communications Decency Act that restricted expression online.[2]
International Recognition of Privacy as a Human Right
Privacy is declared as a fundamental human right by the UN Declaration of Human Rights. Data privacy has also been recognized as a human right in the International Covenant on Civil and Political Rights and in numerous other international and regional treaties. Privacy also supports pivotal values of human dignity, like freedom of association and freedom of speech.
In the contemporary era, privacy has emerged as one of the most critical human rights concerns. It is considered the most essential component of human dignity and freedom because of its increasing significance and multifaceted nature. Several countries have explicitly enshrined the right to privacy in their constitution, encompassing protections such as the inviolability of the home and the confidentiality of communications.
Modern constitutions, including those of South Africa and Hungary, go further by recognizing an individual’s right to access, control, and manage personal information. In countries like the United States, Ireland and India, privacy is not explicitly codified, but the courts have interpreted other constitutional provisions to safeguard the privacy of individuals. There are various international treaties, like the International Covenant on Civil and Political Rights and the European Convention on Human Rights affirm privacy protections in their nation.
Article 12 UDHR and Article 17 ICCPR expressly recognize privacy, which prohibits arbitrary interference with privacy, family, correspondence, and reputation. The European Convention on Human Rights 1950 (ECHR), under Article 8, ensures the respect for individual and family life. A global benchmark has been set up by the European Union for data protection, to promote transparency, accountability, and individual consent under the General Data Protection Regulation 2018 (GDPR)[3]
Evolution of Data Privacy as a Human Right with judicial intervention
The right to privacy has seen a significant development in India. This has been possible due to the remarkable judicial interventions which has recognized data privacy as a fundamental right under Article 21 of the Indian Constitution. Initially, privacy was acknowledged as a right to life and personal liberty. The landmark judgments, including Gobind v. State of MP and PUCL v. Union of India, have strengthened the protection of personal privacy.
In the case of Justice K.S. Puttaswamy v. Union of India, 2017, the Supreme Court formally recognized privacy as crucial to life and liberty, stating its interconnection with other freedoms like equality, free speech, and religion. The judgment also mentioned that privacy is not absolute; it can be restricted based on the test of legality, necessity, and proportionality.
In India, data protection has faced many challenges in the last few decades. There are cases of repeated breaches exposing millions of citizens’ personal information from platforms like CoWIN, MobiKwik, and various government and private databases. The IT Act 2000 provided partial safeguards to individuals to secure data privacy.
The digital personal data is now governed by the Digital Personal Data Protection Act, 2023, emphasizing the principles of data minimization and purpose limitation. It imposes obligations on the data fiduciaries by granting rights to individuals, including access, correction and a complaint mechanism. The Data Protection Board of India enforces the act to allow certain exemptions for government and research purposes.
As seen in international examples like Sweden and Portugal, where constitutional amendments explicitly protect personal data, it remains crucial for data privacy to gain recognition as a constitutional right. Amendment of Article 21 can help in integrating modern data protection norms and provide a stronger, comprehensive safeguard in India’s rapidly digitizing society.[4]
GDPR -The New Age Of Data Protection
The General Data Protection Regulation (GDPR) lays down the principles for data protection. These include :
1.Lawfulness, Fairness, and Transparency – Data must be lawfully processed. It should not include any misleading or unfair processes. All the information must be clearly communicated through the notices and then transferred to the data subjects.
2.Purpose Limitation – If there is any document purpose, then only the data should be collected. It must be for a specific purpose. New users are generally not given access to the database, but it can be permitted with legal justification.
3.Data Minimisation- Only the data that is required or necessary for the work at present must be collected and stored in the database. No other data must be stored; this reduces the risk of any digital attacks and also improves accuracy.
4.Accuracy – It is important to update the data from time to time. Also, one must review the data so that the data stored is free from any errors.
5.Storage Limitation – Only the necessary data must be stored in the database. One must avoid storing any personal information in the database.
6.Integrity and Confidentiality (Security) – Make sure your device is free from any risk. A virus or malware can harm the data stored in the device. Hence, the security of the data should be taken care of throughout the processing period.
In Google Spain SL v Agencia Española de Protección de Datos (AEPD), the Court of Justice of the European Union (CJEU) recognised the ‘right to be forgotten’, allowing individuals to request the removal of personal information from search results.[5]
Landmark Judgements on Data Privacy
- In Katz v United States, the US Supreme Court, in its judgment, stated that the Fourth Amendment secures individuals’ privacy in electronic communications.
- In the Aadhaar case (Puttaswamy (Aadhaar) v Union of India), the Supreme Court of India upheld the use of Aadhaar for welfare schemes and invalidated the provisions permitting the use of personal data by private entities, stating the privacy risks and concerns.
- In the Facebook–Cambridge Analytica scandal, the personal data of millions of individuals was harvested and exploited for political manipulation. It exposed the risks of corporate control over the personal data of individuals.
- In State v Loomis, the Supreme Court of Wisconsin emphasized the use of an AI tool in sentencing judgments. While upholding this judgment, the Court recognized transparency and bias risks in the decision-making process.
- In Schrems I (Maximillian Schrems v. Data Protection Commissioner, 2015) and Schrems II (Data Protection Commissioner v. Facebook Ireland Ltd. and Maximillian Schrems, 2020), the CJEU invalidated the agreements of Safe Harbor (2015) and Privacy Shield (2020) made between the EU and the US. This action was taken due to inadequate safeguards against US surveillance laws.
Major Privacy Concerns
- Balancing Security and Privacy is a continuing challenge because strong security is essential to protect sensitive data, but excessive controls can cause disturbance to user privacy and autonomy.
- Data Ownership and Control is still evolving term in today’s era. Individuals generate vast amounts of data online, yet ownership rights remain unclear. Regulations grant some control, but it still lead to the issue.
- Cross-border data flow is the most concerning challenge to digital privacy. Each country has different privacy laws, which makes it difficult to organize and handle the international data.
- Sharing data with a third party has become a common issue faced by many companies worldwide. Companies frequently share user information with vendors for marketing or analytics, often without users’ knowledge. To overcome such problems, companies are recommended to strictly adhere to data protection laws.
- Evolving Regulatory Landscape is necessary as it strengthens the privacy laws in the nation. Frameworks like GDPR and CCPA are made to secure the privacy rights but create costly and complex compliance requirements, especially for global businesses.
- Data Visibility is another challenge faced by different organizations. Organizations must know what data exists, where it resides, and who accesses it. Without visibility, effective protection strategies cannot be implemented.
- It is sometimes difficult to identify Sensitive Data. Not all data requires the same level of protection. Classifying financial or health data helps apply stronger safeguards without limiting productivity.
- Devices like laptops, mobiles, wearables, and smart devices create multiple entry points, increasing security challenges across platforms.
- As data volumes expand, maintaining robust security systems becomes more expensive and resource-intensive. This increases the overall maintenance costs.
- Preventing unauthorized use of sensitive data can be a challenge for individuals who don’t know about data privacy. [6]
Ways to Secure Data Privacy
- One should Prioritize Data Visibility by identifying all data collected, stored, and transmitted to understand your data landscape. Then categorize data by sensitivity to prioritize security measures, with high-risk data receiving stricter controls.
- Implementing Robust Security Measures like access controls, data encryption and data loss prevention. Use multi-factor authentication and role-based access control (RBAC) to limit access. Encrypt data at rest and in transit to protect confidentiality.Data Loss Prevention (DLP): Prevent accidental or intentional data leaks through monitoring and controls.
- Create Awareness by employee training and an incident response plan. Educate staff on phishing, password hygiene, and safe data handling. Prepare clear protocols to detect, contain, and remediate breaches efficiently.
- Proper management of Third-Party Data Sharing through vendor risk management and data sharing agreements. Evaluate vendor security practices and include protective clauses in contracts. Define purpose, scope, and security requirements for shared data.
- Strictly adhering to the regulations like GDPR and CCPA and continuously monitoring can be effective in the protection of data.
- Always stay updated with the rules and regulations regarding privacy concerns; this will enhance your technical knowledge and make you aware of online fraud.[7]
Conclusion
In the digital era, human rights cannot be safeguarded without addressing data protection and privacy concerns. The scope of privacy has been expanded by the courts worldwide. It has got its recognition as a fundamental right, and legislatures have responded with robust data protection frameworks. However, surveillance, corporate misuse, and algorithmic risks remain never-ending challenges.
As the future of our country, it is our responsibility to shape the digital future ethically. Technological advancement should lead to empowerment rather than exploitation of the individual. Protecting privacy is not only concerned with legal necessity, but it is also a moral imperative for preserving dignity, autonomy, and democratic values.
References Used
- Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, 2020 (2020) 311 (Court of Justice of the European Union (CJEU)
- Federal Trade Commission (FTC) v Cambridge Analytica LLC (2019) 182-3107 (Federal Trade Commission (FTC))
- Gobind V State of MP (1975) 72 (Supreme Court)
- Justice KS Puttaswamy V Union of India (2018) 494 (Supreme Court)
- Katz v United States (1967) 387 (US Supreme Court)
- Maximillian Schrems v Data Protection Commissioner, 2015 (2016) 362 (Court of Justice of the European Union (CJEU))
- PUCL v Union of India (1996) 568 (Supreme Court)
- Reno V2 American Civil Liberties Union (1996) 96-511 (United States District Court for the Eastern District of Pennsylvania)
- Spain SL v Agencia Española de Protección de Datos (AEPD) (2014) 131 (The Court of Grand Chamber)
- State v Loomis (2016) 2015AP157–CR (Wisconsin Supreme Court)
[1] https://www.ohchr.org/en/what-are-human-rights
[2] https://www.ohchr.org/en/topic/digital-space-and-human-rights
[3] https://gilc.org/privacy/survey/intro.html
[4] https://articles.manupatra.com/article-details/From-Constitutional-Rights-to-Data-Protection-Article-21-and-Comparative-Perspectives-on-Privacy
[5] https://www.itgovernance.eu/blog/en/the-gdpr-understanding-the-6-data-protection-principles
