The Right to Privacy after the Puttaswamy Judgment: Judicial Expansion and Emerging Challenges

1. Introduction

Privacy is essential to individual dignity and personal freedom. It allows people to make decisions about their lives without unnecessary interference from the State or private entities. In a democratic society, privacy is closely connected with liberty, equality and freedom of expression, because individuals can meaningfully exercise these rights only when they enjoy a reasonable degree of personal autonomy.[1] Unlike many constitutions, the Constitution of India does not expressly mention a right to privacy. For several decades, Indian courts interpreted fundamental rights narrowly and did not recognise privacy as an independent constitutional right. However, technological developments such as Aadhaar, digital governance, social media and online data collection created new legal challenges that demanded stronger constitutional protection. The legal position changed dramatically with the Supreme Court’s decision in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). A nine-judge Constitution Bench unanimously held that privacy is a fundamental right protected under Articles 14, 19 and 21. The judgment recognised privacy as an inseparable part of dignity, liberty and individual autonomy. Although this decision transformed Indian constitutional law, recognising privacy as a fundamental right was only the first step. The increasing use of artificial intelligence, facial recognition systems, digital surveillance and large-scale data processing has created new threats that require effective legal regulation. This paper argues that while Puttaswamy laid a strong constitutional foundation, India must continue strengthening its legal framework to ensure meaningful privacy protection.

2. Research Problem

This paper examines whether the recognition of privacy as a fundamental right has been sufficient to protect citizens in the digital age, or whether further constitutional and legislative reforms are required.

The study specifically considers: the evolution of privacy jurisprudence before Puttaswamy; the constitutional principles established by the Supreme Court; the effectiveness of the Digital Personal Data Protection Act, 2023; emerging challenges created by technology; and possible reforms to strengthen privacy protection.

3. Evolution of the Right to Privacy in India

The right to privacy was not immediately recognised under the Indian Constitution. Instead, it developed gradually through judicial interpretation.

Early Judicial Approach
In M.P. Sharma v. Satish Chandra,[2] the Supreme Court held that the Constitution did not contain an independent right to privacy. Since the Constitution lacked a provision similar to the Fourth Amendment of the United States Constitution, the Court declined to recognise privacy as a separate fundamental right. A similar view was adopted in Kharak Singh v. State of Uttar Pradesh,[3] which concerned police surveillance of suspected criminals. Although the Court struck down certain surveillance practices, the majority concluded that the Constitution did not expressly protect privacy. Justice Subba Rao’s dissent, however, argued that privacy formed part of personal liberty under Article 21 — an opinion that later proved highly influential.

Expansion of Article 21
A major change occurred in Maneka Gandhi v. Union of India.[4] The Supreme Court interpreted Article 21 broadly, holding that any restriction on personal liberty must follow a procedure that is just, fair and reasonable. The judgment connected Articles 14, 19 and 21, enabling courts to recognise several new rights under Article 21, including privacy. The Court continued this approach in Gobind v. State of Madhya Pradesh,[5] where it accepted that privacy could be regarded as part of personal liberty, though not an absolute one. Later, in People’s Union for Civil Liberties (PUCL) v. Union of India,[6] the Court held that telephone tapping without proper legal safeguards violated Article 21. These decisions demonstrate a gradual judicial acceptance of privacy before its formal recognition. Despite these developments, uncertainty persisted because M.P. Sharma and Kharak Singh had never been expressly overruled. This issue became particularly significant when the Aadhaar scheme required citizens to provide biometric information.[7] Petitioners argued that compulsory collection of such data violated privacy, while the Government relied on the earlier decisions denying the existence of a constitutional right to privacy. To resolve this conflict, the matter was referred to a nine-judge Constitution Bench.

4. The Puttaswamy Judgment

In Justice K.S. Puttaswamy (Retd.) v. Union of India,[1] the Supreme Court unanimously declared that privacy is a fundamental right protected under Articles 14, 19 and 21 of the Constitution. The Court overruled the contrary observations in M.P. Sharma and Kharak Singh and held that privacy is essential to protecting dignity, liberty and individual autonomy.

The judgment recognised that privacy extends beyond secrecy, encompassing an individual’s ability to make personal decisions, control personal information and develop their identity free from unnecessary interference.

The Court identified three important aspects of privacy:

Physical privacy, which protects bodily integrity against unlawful searches, medical procedures or biometric collection.
Informational privacy, which safeguards personal data collected by governments and private organisations.
Decisional privacy, which protects personal choices relating to marriage, family, religion, education and sexuality.

Justice D.Y. Chandrachud observed that privacy enables individuals to preserve their dignity and exercise meaningful freedom. The Court accordingly recognised privacy as a constitutional value necessary for democratic governance.

The Proportionality Test
The Court clarified that privacy is not an absolute right; restrictions may be imposed if they satisfy the doctrine of proportionality. Under this principle, any limitation on privacy must satisfy four conditions: it must have a valid legal basis; it must pursue a legitimate State objective; the restriction must be necessary; and the restriction must be proportionate to the objective being achieved. This test has since become the standard for assessing laws affecting privacy and personal liberty.

5. Impact on Indian Constitutional Law

The Puttaswamy judgment significantly expanded the scope of Article 21 by recognising privacy as an essential part of personal liberty. It also strengthened constitutional protection for individual autonomy in matters relating to marriage, reproductive rights, medical decisions, sexual orientation and family life. The judgment influenced several later decisions. In Navtej Singh Johar v. Union of India,[8] the Supreme Court relied on Puttaswamy in decriminalising consensual same-sex relationships, holding that sexual orientation forms part of dignity and privacy. In Joseph Shine v. Union of India,[9] the Court struck down the adultery law, observing that personal relationships fall within the protected sphere of privacy. Similarly, Anuradha Bhasin v. Union of India[10] highlighted the importance of digital communication in exercising constitutional freedoms, reinforcing principles of informational privacy. These decisions demonstrate that Puttaswamy has become one of the most influential constitutional precedents in modern India.

6. The Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 represents India’s first comprehensive law governing personal data. It aims to regulate the collection and processing of digital personal information while balancing individual rights with legitimate governmental and commercial interests. The Act grants individuals important rights, including access to personal data, correction of inaccurate information, erasure of data and grievance redressal. It also places obligations on organisations that collect and process personal information and prescribes financial penalties for non-compliance. The legislation represents an important step toward implementing the constitutional principles recognised in Puttaswamy.[1] However, it has also attracted criticism: the broad exemptions granted to government agencies raise concerns about surveillance and accountability, and questions remain about the independence of the Data Protection Board and whether existing safeguards are sufficient to prevent misuse of personal information.

7. Emerging Challenges to Privacy in the Digital Age

Although the Puttaswamy judgment firmly established privacy as a fundamental right, technological developments continue to test the effectiveness of India’s legal framework. The widespread use of artificial intelligence (AI), facial recognition, social media, digital payments and online government services has increased the collection and processing of personal information. While these technologies offer convenience and improve public services, they also raise serious concerns about data misuse, surveillance and cybersecurity.

Artificial Intelligence and Data Protection
Artificial intelligence has become an important tool in sectors such as healthcare, banking, education, law enforcement and public administration. AI systems rely on large volumes of personal data to make predictions and automate decision-making, yet many individuals remain unaware of how their information is collected, analysed or shared. Another concern is algorithmic bias: if AI systems are trained on incomplete or biased data, they may produce unfair outcomes affecting employment, credit, policing or access to government services. Since India does not yet have a comprehensive legal framework specifically regulating AI, questions remain around transparency, accountability and protection against automated decision-making. While the Digital Personal Data Protection Act, 2023 regulates personal data, it does not fully address these broader AI-related concerns.

Government Surveillance
The growth of digital governance has also expanded the State’s ability to collect personal information. Surveillance tools can help prevent crime and protect national security, but excessive monitoring may threaten civil liberties; continuous surveillance may discourage citizens from freely expressing their opinions, participating in protests or exercising democratic rights. The Supreme Court in Puttaswamy made clear that surveillance measures must satisfy the tests of legality, necessity and proportionality — any interference with privacy should be supported by law, pursue a legitimate objective and remain proportionate to that objective. Strong judicial oversight and transparent procedures are essential to prevent abuse of surveillance powers.

Facial Recognition Technology
Facial recognition technology is increasingly used in airports, railway stations and other public places, enabling authorities to identify individuals by comparing facial images with stored databases. Although this technology can improve security and assist criminal investigations, it also raises serious privacy concerns. The continuous collection of biometric information may result in mass surveillance and misuse of sensitive personal data, and errors in facial recognition systems can lead to wrongful identification, affecting innocent individuals. Since India currently lacks a dedicated legal framework governing facial recognition, there is an urgent need for statutory safeguards regulating its use.

Social Media and Informational Privacy
Social media platforms collect vast amounts of personal information, including browsing history, location data, contacts and user preferences, frequently used for targeted advertising and commercial purposes. Data breaches and unauthorised sharing of personal information have demonstrated the risks associated with digital platforms. Citizens often accept lengthy privacy policies without understanding how their information will be processed. Increasing digital literacy, improving consent mechanisms and strengthening enforcement of data protection laws are necessary to reduce these risks.

8. Comparative Perspective

Studying foreign legal systems helps identify practices that could strengthen India’s privacy framework.

European Union
The European Union has adopted one of the world’s strongest privacy regimes through the General Data Protection Regulation (GDPR). The GDPR grants individuals extensive rights over their personal data, including the rights to access, correct, erase and transfer information. It also imposes strict obligations on organisations processing personal data and provides for substantial penalties for violations. An important feature of the GDPR is the presence of independent supervisory authorities that ensure compliance with privacy laws. Compared with the European model, India’s Digital Personal Data Protection Act grants broader exemptions to the government and provides relatively limited regulatory independence.[11]

United Kingdom
The United Kingdom follows the UK GDPR alongside the Data Protection Act 2018. The Information Commissioner’s Office (ICO) functions as an independent regulator responsible for enforcing privacy laws. The UK’s experience demonstrates the importance of strong regulatory institutions and effective enforcement in protecting personal information.

United States
The United States follows a different approach. Rather than one comprehensive privacy law, it regulates privacy through sector-specific legislation governing healthcare, finance, education and consumer protection, alongside separate state-level privacy laws. Although this system offers flexibility, it often results in inconsistent standards across sectors.

India can learn from these jurisdictions by combining comprehensive legislation with strong independent enforcement and clear accountability mechanisms.

9. Critical Evaluation

The Puttaswamy judgment represents a turning point in Indian constitutional law. By recognising privacy as a fundamental right, the Supreme Court strengthened the protection of dignity, liberty and individual autonomy. The judgment has influenced several landmark decisions and provided constitutional support for modern data protection laws. However, constitutional recognition alone cannot guarantee effective privacy protection — the success of privacy rights depends on implementation through legislation, institutions and public awareness. Although the Digital Personal Data Protection Act, 2023 establishes a much-needed legal framework, concerns remain regarding government exemptions, institutional independence and technological regulation. Rapid advances in artificial intelligence, biometric identification and digital surveillance continue to outpace legal reforms. Without clear statutory safeguards, personal information risks being collected or processed in ways that undermine constitutional freedoms. At the same time, governments require certain surveillance powers to maintain national security and public order. The challenge therefore lies in maintaining an appropriate balance between individual rights and legitimate State interests. Public awareness is another important issue: many citizens remain unaware of their privacy rights or the extent to which their personal data is collected online, and legal protection alone cannot succeed unless individuals understand their rights and exercise them effectively.

10. Recommendations

To strengthen privacy protection in India, several reforms should be considered.

First, the independence of the Data Protection Board should be enhanced to ensure impartial enforcement of privacy laws. Second, Parliament should enact legislation specifically regulating artificial intelligence, algorithmic decision-making and automated profiling, requiring transparency, accountability and human oversight. Third, India should introduce a dedicated legal framework governing facial recognition technology and biometric databases to prevent misuse of sensitive personal information. Fourth, exemptions available to government agencies under the Digital Personal Data Protection Act should be narrowly interpreted and subjected to greater judicial oversight. Fifth, government departments and private organisations undertaking large-scale data processing should be required to conduct privacy impact assessments before implementing new technologies. Finally, greater investment should be made in cybersecurity infrastructure and digital literacy programmes so that citizens better understand how to protect their personal information.[12]

11. Conclusion

The recognition of privacy as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India is one of the most significant developments in Indian constitutional jurisprudence. The judgment firmly established that privacy is inseparable from dignity, liberty and personal autonomy and therefore deserves constitutional protection under Articles 14, 19 and 21. The decision has influenced numerous later judgments and laid the foundation for India’s modern data protection framework. The enactment of the Digital Personal Data Protection Act, 2023 is an important legislative response, but significant challenges remain. Artificial intelligence, facial recognition, government surveillance and the rapid growth of digital technologies continue to test the effectiveness of existing legal safeguards. India must therefore continue strengthening its privacy framework through better legislation, independent regulatory institutions and greater public awareness. Protecting privacy is not merely about securing personal information; it is about preserving human dignity, democratic values and individual freedom in an increasingly digital world. The principles established in Puttaswamy provide a strong constitutional foundation, but their long-term success will depend on consistent implementation and continuous legal reform.

Bibliography

Cases
Anuradha Bhasin v. Union of India, (2020) 3 SCC 637.
Gobind v. State of Madhya Pradesh, (1975) 2 SCC 148.
Joseph Shine v. Union of India, (2019) 3 SCC 39.
Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar), (2019) 1 SCC 1.
Kharak Singh v. State of Uttar Pradesh, AIR 1963 SC 1295.
Maneka Gandhi v. Union of India, (1978) 1 SCC 248.
M.P. Sharma v. Satish Chandra, AIR 1954 SC 300.
Navtej Singh Johar v. Union of India, (2018) 10 SCC 1.
People’s Union for Civil Liberties (PUCL) v. Union of India, (1997) 1 SCC 301.

Statutes
Constitution of India.
Digital Personal Data Protection Act, 2023.
Information Technology Act, 2000.

References

[1] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
[2] M.P. Sharma v. Satish Chandra, AIR 1954 SC 300.
[3] Kharak Singh v. State of Uttar Pradesh, AIR 1963 SC 1295.
[4] Maneka Gandhi v. Union of India, (1978) 1 SCC 248.
[5] Gobind v. State of Madhya Pradesh, (1975) 2 SCC 148.
[6] People’s Union for Civil Liberties (PUCL) v. Union of India, (1997) 1 SCC 301.
[7] Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar), (2019) 1 SCC 1.
[8] Navtej Singh Johar v. Union of India, (2018) 10 SCC 1.
[9] Joseph Shine v. Union of India, (2019) 3 SCC 39.
[10] Anuradha Bhasin v. Union of India, (2020) 3 SCC 637.
[11] European Union, General Data Protection Regulation (Regulation (EU) 2016/679).
[12] Justice A.P. Shah Committee Report on Privacy (2012).