You are on page 1of 32

3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

TN- 314
IN THE HON'BLE HIGH COURT OF CITY OF JOY

PETITION DRAWN AND FILED UNDER THE CONSTITUTION OF NARNIA

IN THE MATTER OF:

Mr. TRUE LIES.…………………………….…………........................................PETITIONER

v.

REPUBLIC OF NARNIA………………………………….…........................RESPONDENT 1

SAYPM………………………………………………………………………...RESPONDENT 2

WRIT PETITION NO. ****/2018

MATTER CONCERNING:

INFRINGEMENT OF FUNDAMENTAL RIGHTS UNDER THE CONSTITUTION OF


NARNIA

AND

VIOLATION OF PROVISIONS OF THE INFORMATION TECHNOLOGY ACT, 2000,


AS AMENDED IN 2008

DRAWN AND FILED BY THE COUNSELS ON BEHALF OF THE PETITIONER

WRITTEN SUBMISSION ON BEHALF OF PETITIONER I


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

TABLE OF CONTENTS

TABLE OF ABBREVIATIONS ............................................................................................... IV

INDEX OF AUTHORITIES ..................................................................................................... VI

STATEMENT OF JURISDICTION ...........................................................................................1

STATEMENT OF FACTS ...................................................................................................……2

ISSUES RAISED............................................................................................................................5

I. WHETHER THE WRIT PETITION FILED UNDER ARTICLE 226 IS MAINTAINABLE


BEFORE THE HON’BLE HIGH COURT IN THE PRESENT CASE?

II. WHETHER THERE HAS BEEN VIOLATION OF PRIVACY AS A FUNDAMENTAL


RIGHT UNDER THE CONSTITUTION OF NARNIA?

III. WHETHER THE STATE IS COMMITTING GROSS VIOLATIONS OF THE


INTERNATIONAL OBLIGATIONS AND EXISTING LEGAL FRAMEWORK RELATING
TO PRIVACY RIGHTS?

IV. WHETHER THE PRESENT LAWS WITH INFORMATION TECHNOLOGY ACT NEED
AMENDMENT AND OTHER STATUES SUFFICIENT?

SUMMARY OF ARGUMENTS ..................................................................................................6

ARGUMENTS ADVANCED .......................................................................................................8

I. THAT THE WRIT PETITION FILED UNDER ARTICLE 226 BEFORE THE
HON’BLE HIGH COURT IS MAINTAINABLE?...................................................8
A. EXISTENCE OF ALTERNATIVE REMEDY: A BAR TO WRIT
PETITION…………………………………………………………………………8
B. ULTRA VIRES EXERCISE OF POWER………………………………………...9
II. THAT THERE HAS BEEN VIOLATION OF PRIVACY AS A

WRITTEN SUBMISSION ON BEHALF OF PETITIONER II


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

FUNDAMENTAL RIGHT UNDER THE CONSTITUTION OF NARNIA……..9


A. RIGHT TO PRIVACY UNDER ART 21………………………………………..10
B. RIGHT BASED APPROACH INSTEAD OF CONSENT BASED
APPROACH……………………………………………………………………..11
III. THE STATE IS COMMITTING GROSS VIOLATIONS OF
INTERNATIONAL OBLIGATIONS AND EXISTING INDIAN LEGAL
FRAMEWORK…………………………………………………………………..…12
A. INTERNATIONAL INSTRUMENTS…………………………………………..12
i. Universal Declaration of Human Rights
ii. International Covenant on Civil and Political Rights
B. THE EXISTING LEGAL FRAMEWORK……………………………………....15
i. Information Technology Act, 2000 and other significant legislations
IV. THAT THE PRESENT LAWS WITH INFORMATION TECHNOLOGY ACT,
2000 AND OTHER STATUTES ARE NOT SUFFICIENT AND NEED
AMENDMENTS……………………………………………………………………17
A. ABSENCE OF QUALITY DATA PROTECTION OBLIGATIONS IN RELATION
TO PERSONAL INFORMATION…………………………………………………17
B. PRINCIPLE OF UPDATING CONSTRUCTION………………………………….18
i. Loop Holes In The Information Technology Act that needs to be looked
upon………………………………………………………………………18
ii. Guidelines For The Regulation of Computerized Personal Data
Files………………….…………………………………………..……….20
a. THE EUROPEAN UNION
b. The Report of Group of Experts on Privacy
c. ASIA PACIFIC ECONOMIC COOPERATION
iii. Srikrishna Committee Report……………………………………………22

PRAYER FOR RELEIF………………………………………………………………………..24

WRITTEN SUBMISSION ON BEHALF OF PETITIONER III


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

TABLE OF ABBREVIATIONS

ABBREVIATIONS DEFINITION
ACHR American Convention of Human Rights
AIR All India Reporter
AP Andhra Pradesh
APEC Asia Pacific Economic Cooperation
Art. Art
Bom Bombay
Cal Calcutta
ECHR European Convention on Human Rights
Ed. Edition
EU European Union
HC HC
Hon’ble Honurable
HP Himachal Pradesh
i.e That Is
ICCPR International Covenant on Civil and Political
Rights
IT Act IT Act
M.P Madhya Pradesh
No. Number
SC Supreme Court
SCC Supreme Court Cases
SCR Supreme Court Reporter
SCWR Supreme Court Weekly Reporter
U/ Under
UDHR Universal Declaration of Human Rights

WRITTEN SUBMISSION ON BEHALF OF PETITIONER IV


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

UK United Kingdom
UN United Nations
UNCITRAL United Nations Commission on International
Trade Law
UOI Union of India
US United States
v. Versus

WRITTEN SUBMISSION ON BEHALF OF PETITIONER V


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

INDEX OF AUTHORITIES

-CONSTITUTION-

The Constitution Of India, 1950

Constitution of Narnia…………………………………………………………………...passim

-STATUES REFERRED-

1. IT Act, 2000
2. IT (Amendment) Act, 2008
3. Indian Telegraph Act, 1885
4. The Indian Post Office Act, 1888
5. The Indian Wireless Telegraphy Act, 1993

-CASES CITED-

S. No. NAME OF THE CASE CITATION


1. Basheshar Nath v. CIT AIR 1959 SC 149

2. Comptroller and Auditor General of India v K S AIR 1987 SC 537


Jagannathann
3. Francis Coralie v. Union Territory of Delhi AIR 1994 SC 1844
4. Gramophone Co. of India Ltd. v. Birendra Bahadur (1984) 2 SCC 534: AIR 1984 SC
Pandey
667
5. Kuntesh Gupta v Management H. K. Mahavidyalaya AIR 1987 SC 2186

6. Maneka Gandhi v. Union of India 1978 AIR 597, 1978 SCR (2) 621

7. Olmstead v. US 72 L Ed 944 : 277 US 438, 478


(1927)
10. Ram Narain v. State of Bombay 1952 SCR 652

WRITTEN SUBMISSION ON BEHALF OF PETITIONER VI


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

11. Shivram Poddar v. ITO AIR 1964 SC 1095


12. State of Maharastra v. Dr. Praful B. Desai (2003) 4 SCC 601

13. Union of India v. Bajaj Tempo Ltd., (1998) 9 SCC 281


14. Union of India v. Hidalco Industries (2003) 5 SCC 194 (198)
15. Whirlpool Corporation v. Registrar of Trade Marks (1998) 8 SCC 1

-BOOKS REFERRED-

1. Dr. Durga Das Basu, The Indian Constitutional Law (3rd Ed, 2011).

2. M.P. Jain, Indian Constitutional Law (6th Ed, 2010).

3. P M Bakshi, The Constitution Of India (14th Ed, 2017)

4. Volume I, V.G. Ramachandran’s, Law of Writs (6th Ed, 2006)

5. Vakul Sharma, Information Technology (3rd Ed, 2014)

6. Malcolm N. Shaw, International Law (7th Ed, 2016)

-INTERNATIONAL INSTRUMENTS-

1. Art. 7, 8, ECHR, 1953 (Adopted on September 3, 1953)

2. Art. 17, ICCPR (Adopted by United Nations General Assembly on December 16, 1966)

3. Art. 12, UDHR (Adopted by the United Nations General Assembly at its third session on 10
December, 1948)

4. Art. 11, ACHR (Adopted on 22 November 1969 by the Organization of American States
(OAS))

5. APEC (Introduced for the first time in 31 January 1989)

6. ICESCR (Adopted on December 16, 1966 by the UN General Assembly and entered into force

WRITTEN SUBMISSION ON BEHALF OF PETITIONER VII


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

ten years later)

-REPORTS-

1. Sri Krishna Committee Report, “A Free and fair Digital Economy- Protecting Privacy,
Empowering Indians” (Submitted on December 30, 2010)

2. Planning Commission of India, Report of the Group of Experts on Privacy

3. Government of India. Ministry of Personnel, PG & Pensions, Department of Personnel


Training, Approach Paper for Legislation on Privacy

-ARTICLES-

1.Lee Andrew Bygrave, Data Privacy Law An International Perspective (2014)

2. Devarshi Mukhopadhyay and Rahul Bajaj, Locating the ‘Right to be Forgotten’ in


Indian Constitutional Jurisprudence: a Functional-Dialogical Analysis, CALQ, 52 (2017)

3. David J. Kessler, Sue Ross and Elonnai Hickok, A Comparative Analysis of Indian Privacy Law
and the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules, NLSI Rev 31, 26 (2014)

4.Ujwala Uppaluri & Varsha Shivanagowda, Preserving Constitutive Values in the


Modern Panopticon: The Case for Legislating toward a Privacy Right in India, NUJS L
Rev 21 (2012)
5. Michael P. van Alstine, The Role Of Domestic Courts In Treaty Enforcement: Summary
And Conclusions, In The Role of Domestic Courts in Treaty enforcement: A Comparative
Study (2009)

-WEBSITES-

1. www.scconline.com

WRITTEN SUBMISSION ON BEHALF OF PETITIONER VIII


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

STATEMENT OF JURISDICTION

The petitioner herein is Mr. True Lies, humbly submits this memorandum for the petition filed
before this Hon’ble High Court. The Hon’ble Court is vested with jurisdiction, to hear the present
matter under Art 2261 of the Constitution of Narnia.

The present memorandum sets forth the facts, contentions and arguments in the present case.

1 The Constitution of India, 1950

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 1


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

STATEMENT OF FACTS

For the sake of brevity and convenience of the Hon’ble Court the facts of the present case are
summarized as follows:

1. Republic of Narnia is a democratic republic state, having a stable government.

2. SayPM is a Narnian electronic payment system and digital wallet company, founded by Mr.
Money Bag in January 2009. SayPM has international investors, such as Chinese e-commerce
giant, Forty-Thieves, and Japanese multinational holding cluster, HardBank. SayPM offers online
payment services such as mobile recharges, utility bill payments, flight tickets, movie tickets, and
event bookings, as well as in-store payments at various retail stores, restaurants, parking, tolls,
pharmacies and educational institutions.

3. SayPM, a diversified e-commerce company, having more than 10,00,000 registered merchants
and more than 1,00,00,000 users of , has become equivalent to a necessary public utility in Narnia.
With other options available, SayPM occupies the largest chunk in the relevant market and there is
no competitor who comes close.

Its boom is closely linked to the ruling party's decision of demonetization that brought down
Narnia's GDP by 2.75%, whereas SayPM witnessed a 1000% increase in overall usage of its
services and 1500% growth in the value of money added to SayPM's accounts. Further, SayPM
congragulated PM for taking the boldest financial decision by displaying PM's image in billboards
which attracted various PILs.

4. It is contended that SayPM collects various sensitive data from its customers, such as their bank
account, credit and debit card details and uses the same to allow the customers to access its
e-payment services to run its buisness. It is here pertinent to mention that SayPM also tracks
customers' usage pattern to make targeted advertisements to them. In response, SayPM claims that
it follows the highest category of data security measures to protect its customer data and is in
compliance with all applicable laws. Customers of SayPM need to agree to a lengthy consent form

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 2


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

before they are allowed to use SayPM's services. Very often, consumers do not understand the
terms and conditions in the consent form and thus, mechanically press the “I Agree” button to use
the services.

5. AnacondaPole, a highly acclaimed Narnian non-profit news website and television production
house, famous for its investigative journalism conducted an investigation titled "Operation
Swachch Narnia" through its star journalist Mr. Narad Lal who posed as a representative of a
fictitious organisation Jai Narnia Samiti, and met some of SayPM's top executives. Narad Lal
informed them that he is meeting on behalf of the “Samiti” to boost the probabilities of the ruling
party in the Parliamentary elections slated to be conducted in 2019.

The investigation reported that Mrs. Money Bag, who is a director of SayPM, during the meeting,
revealed that they had some association with the ruling party of Narnia and stated during a drunken
conversation that the e-wallet company had received a call from the Prime Minister's Office
("PMO") demanding some user data, right before the General Elections in Narnia. To authenticate
its claims, AnacondaPole has released the transcripts and video clips of Mrs. Money Bag on its
social media profiles in Legbook and MeTube.

Mrs. Money Bag said in the sting video:

“By the way, let me show you one more thing … this is our SayPM App. Nowadays, our Prime
Minister is right here. He has written a book Chai Time Tales. We are … we are actually selling
this book on our platform... Also, for the upcoming elections, they wanted our user data regarding
the sale and popularity of the book and some other information”.

However, the video did not mention whether or not SayPM complied with the alleged demand and
whether it involved demand of information other than the book's sale and popularity.

6. After AnacondaPole released the video and transcript, SayPM, on its official social media
profile, posted that “There is absolutely NO TRUTH in the sensational headlines of a video doing
rounds on social media. Our user data is 100% secure and has never been shared with anyone,
except law enforcement agencies on request. Thank you for your continued support.” SayPM,
however, did not reveal the name of “law enforcement agencies” with whom the company had
shared its user data, if any.

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 3


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

7. In light of the growing controversies around its data sharing practices, SayPM revised its
privacy policy and included a new clause stating, “I understand and permit SayPM, at its sole
discretion, to share my data with any third party for any purpose linked to the business of SayPM.”

SayPM ensured that users, who did not consent to the said new clause, were blocked from using
their application. Thus, large sum of money, which the users had in their SayPM wallet, could
neither be transferred to any third party's bank accounts nor be used to conduct other
e-transactions. The users of SayPM were highly upset. SayPM constantly countered the allegation
saying that the data was shared as per the contract entered into by the users and only for purposes
which are necessary for it to fulfill its obligations towards the users. Thus, they have already
complied with all the existing laws by entering into such contracts with the users of SayPM.
SayPM also stated that the money of the users in the wallet was not completely blocked; rather the
users have the option to transfer the amount in their wallet back to their own bank account linked
with the application by paying a minor fee, if their wallet is blocked.

8. Earlier this year, it was alleged that the Prime Minister's own mobile application (“SayMO”)
transferred user data to a few foreign companies for data analytics. While this was denied by the
PMO, general public was quite concerned about the safety of their data. Similar allegations were
also leveled against the applications of opposition parties in Narnia. However, no investigation
was conducted.

However, Narnia's data privacy and protection laws are allegedly weak and there is no proper law
which completely addresses the concerns relating to data protection and data privacy of Narnia's
citizens. The Government has continuously said that the existing general laws, such as the Narnian
Penal Code, IT Act, guidelines issued by sectoral regulators such as the Reserve Bank of Narnia,
Telecom Regulatory Authority of Narnia, etc. are all sufficient.

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 4


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

ISSUES RAISED

The following questions are presented before this Hon’ble Court for adjudication in the instant
case:

ISSUE I:

Whether the writ petition filed under Art 226 is maintainable before the High Court in the present
case?

ISSUE II:

Whether there has been violation of privacy as a fundamental right under the Constitution of
Narnia?

ISSUE III:

Whether the state is committing gross violations of the International obligations and existing legal
framework relating to privacy rights?

ISSUE IV:

Whether the present laws with it need amendment or other statues are sufficient?

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 5


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

SUMMARY OF ARGUMENTS

I. THAT THE WRIT PETITION FILED UNDER ART 226 BEFORE THE HON’BLE
HIGH COURT IS MAINTAINABLE

It is humbly submitted before the Hon’ble HC that the writ petition filed by the petitioner, Mr.
True Lies is maintainable, as a matter involves a substantial question of law of general public
importance. There has also been abuse of power by SayPM as it has exercised its authority beyond
its discretion and it is pertinent to make rules under Section 87 of the IT Act, 2000. Moreover, the
existence of an efficacious alternative remedy in would not oust the petitioner from filing the writ
petition as fundamental rights have been infringed.

II. THAT THERE HAS BEEN VIOLATION OF PRIVACY AS A FUNDAMENTAL


RIGHT UNDER THE CONSTITUTION OF NARNIA

Petitioner humbly submits that as collecting of personal information like their bank account, credit
card and debit card details, may have nexus to the objective of the e- commerce giants but sharing
of such intimate and personal information with third parties by misleading and embrangling users
and allowing them to use such information for personal purpose violates the Right to life including
Right to privacy under the Constitution of Narnia and since data is leaked hence, the Fundamental
Rights of users have been infringed. There is a grave violation of right to privacy by the
Government and SayPM as it has used the users’ data collected by it purely on confidential basis
for their personal benefits, thus, this infringes upon the dignity of the individual, which is the basic
element of the Constitution.

III. THAT THE STATE IS COMMITTING GROSS VIOLATIONS OF THE


INTERNATIONAL OBLIGATIONS AND EXISTING LEGAL FRAMEWORK
RELATING TO PRIVACY RIGHTS

It is submitted that the present case, substantially affects the rights of the parties as the violation of
International Obligations and existing legal framework is erroneous and prejudicial to the interest

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 6


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

of the people and State has erred in ignoring this laws while taking care of the rights of the citizens.

The recognition of privacy as a fundamental constitutional value is a part of Narnia’s commitment


to a global human rights regime. U/Art. 51 (C), The State is required to endeavor to “foster respect
for International law and treaty obligations in the dealings of organized peoples with one another.”
Grave miscarriage of justice has occurred because of this serious and flagrant violation of right to
privacy of the individuals.

IV. THAT THE PRESENT LAWS WITH IT NEED AMENDMENT AS OTHER


STATUTES ARE NOT SUFFICIENT

The petitioner contends that the collection of information by private entities is excessive and also
is not safe and stringent data protection laws should be complied with, since a large data is already
misused. Government should take measures to somehow protect the privacy of citizens. While,
penalties have been imposed for breach of data protection and leakage of data, there is lack of
measures at the preventive stage itself, which makes it susceptible to identity theft and other like
offences.

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 7


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

ARGUMENTS ADVANCED

I. THAT THE WRIT PETITION FILED UNDER ART 226 BEFORE THE HON’BLE
HIGH COURT IS MAINTAINABLE

It is humbly submitted that the writ petition filed by the petitioner under Art 226 is maintainable, as
it is independent of any alternative remedy [A] and there is abuse of power by the SayPM[B]. If the
Court will not intervene, it will result in gross injustice and that the rights of the public at large
have already been violated, the Court must use its wide jurisdiction under Art. 226, to correct the
wrong done and prevent further exercise of such actions.

A. EXISTENCE OF ALTERNATE REMEDY: A BAR TO WRIT PETITION

The existence of an alternative remedy does not operate as an absolute bar on the writ court 2 as it
is a process that the court chooses to opt out of convenience and discretion. 3 But to do that special
circumstance must exist. When an authority has acted without jurisdiction, the bar does not apply. 4

Under special circumstances the HC may grant writ remedies to a petitioner even with the
existence of an alternative remedy. SC held in a case5 that bar would not exist atleast in three
contingencies, namely,

(i) where the writ petition has been filed for the enforcement of Fundamental Rights.

(ii) where there has been a violation of the principles of natural justice or,

(iii) where the order or proceedings are wholly without jurisdiction or the vires of an Act is
challenged.

The present case falls under category (i), the principle which was earlier also laid down in Wazir

2 Shivram Poddar v. ITO, AIR 1964 SC 1095; Also see Justice B L Hansaria’s Writ Jurisdiction (3 ed. 2005)
3 JUSTICE B L HANSARIA’S, WRIT JURSIDICTION (3 ed. 2005); Union of India v. Hidalco Industries (2003) 5
SCC 194 (198); Union of India v. Bajaj Tempo Ltd., (1998) 9 SCC 281
4 Kuntesh Gupta v Management H. K. Mahavidyalaya, AIR 1987 SC 2186
5 Whirlpool Corporation v. Registrar of Trade Marks, (1998) 8 SCC 1

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 8


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

Chand v. State of H.P.6

B. ULTRA VIRES EXERCISE OF POWER

The SC7 has observed that the HC exercising their jurisdiction under Art. 226 have the power to
issue a writ of mandamus or pass orders or give necessary directions when the Government or a
public authority has failed to exercise or wrongly exercised the discretion conferred upon it by a
statue or has exercised such discretion mala fide or on irrelevant considerations in such a manner
as to frustrate the object of conferring such discretion.

The principle has been well stressed in the leading English case of Sydney Municipal Council v.
Campbell8 where it has been held that the writ can be issued for a purpose which was beyond the
object of the statue.

II. THAT THERE HAS BEEN VIOLATION OF PRIVACY AS FUNDAMENTAL RIGHT


UNDER THE CONSTITUTION OF NARNIA

It is humbly submitted before this Court that fundamental rights have been violated on account of
arbitrary action of the respondents. There has been violation on account of sharing of user’s data
with third party without permission. Further, there is breach of confidentiality and privacy on part
of the respondents. The respondent authorities have collected various sensitive data from its
customers and striking their usage pattern to make targeted advertisements to them. 9

According to Black’s Law Dictionary, Privacy has been defined as, “right to be left alone”10, right
of a person to be free from any unwarranted publicity; right to live freely from any unwarranted
interference by the public in matter with which public is not necessarily concerned.” It is on the
desire of the people to choose freely under what circumstances and to what extent they will expose

6 AIR 1954 SC 415: (1955) 1 SCR 408


7
Comptroller and Auditor General of India v K S Jagannathann, AIR 1987 SC 537; (1986) 2 SCWR 35
8
1925 AC 338: (1924) AllER Ext 930: 94 LJPC 65: 133 LT 63
9
Moot proposition, para 3
10
Warren and Brandeis, The Right to Privacy, Vol.4 (5), Harvard Law Review, 195-196 (1890).

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 9


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

themselves, their attitude and their behaviour to others. 11

A. RIGHT TO PRIVACY UNDER ART 21

Art 21 of the Constitution envisages right to life and personal liberty of a person. The word "Life"
under Art 21 means a quality of life, as held in Francis Coralie v. Union Territory of Delhi12. As a
concomitant to the right to life, we contend that there is a fair argument that can be made for the
immanence of the right to privacy as well. 13

Though the Constitution of India has not guaranteed the right to privacy as a fundamental right to
the citizens but nevertheless, the Supreme Court has come to the rescue of common citizen, time
and again by construing “right to privacy” as a part of the right to “protection of life and personal
liberty”.

An obligation of confidence gives the data subject the right not to have his information used for
other purposes or disclosed without his permission unless there are other overriding reasons in the
public interest for this to happen. That is, where an obligation of confidence arises, it is unlawful
for a data user to use the information for a purpose other than that for which it was provided.

In the context of personal liberty, the Supreme Court has observed 14 that “those who feel called
upon to deprive other persons of their personal liberty in the discharge of what they conceive to be
their duty must strictly and scrupulously observe the forms and rules of the law.”

Further, in R. Rajagopal v. State of Tamil Nadu15, Justice B.P. Jeevan Reddy observed that:

The right to privacy is implicit in the right to life and liberty guaranteed to the citizens of this
country by Art 21. It is a “right to be let alone”. 16

In Maneka Gandhi v. Union of India17, in a seven- judge bench decision, Justice P N Bhagwati
held that the expression “personal liberty” in Art. 21 is of the widest amplitude and covers a variety
11
Alan Westin, Privacy and Freedom (1967) in Justice K.S.Puttaswamy (RETD.) and Anr. V. UOI and Ors. AIR 2015
SC 3081
12 AIR 1994 SC 1844
13 Ujwala Uppaluri & Varsha Shivanagowda, Preserving Constitutive Values in the Modern Panopticon: The Case

for Legislating toward a Privacy Right in India, NUJS L Rev 21 (2012)


14
Ram Narain v. State of Bombay, 1952 SCR 652
15
1995 AIR 264, 1994 SCC (6) 632
16
Olmstead v. US, 277 US 438, 478 (1927); Maneka Gandhi v. Union of India, (1978) 1 SCC 248.
17
1978 AIR 597, 1978 SCR (2) 621

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 10


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

of rights which constitute the personal liberty of man.

B. RIGHT BASED APPROACH INSTEAD OF CONSENT BASED APPROACH

Reserve Bank being the apex body for regulating and supervising the payment system in India said
that there is need to adopt right based approach instead of consent based approach while collection
financial data rather than traditional consent based approach. With far reaching advancement in
technological aspects such as artificial intelligence, machine learning and big data have changed
the ways in which we process data and as a result, have made consent a less than effective tool to
protect personal privacy. Reserve bank of India in its report mentioned that the financial data need
to be divided data subjects and data controllers. In the rights-based model, the crucial difference
lies in the presumption that the data controller, is more likely to be aware of the purposes to which
the personal data will be put, than the data subject. Data controllers will be held liable for any
harm caused to the data subject as a consequence of the breach of their rights. Where possible,
the data controller should be required to either reset the record or to compensate the data subject to
the full extent of any loss caused as a result of the breach of a right. As SayPM being a payment
based service having large financial data of its customer and sharing of such sensitive data
might be a debacle and lead to financial loss. And it is clearly mentioned that consent form are too
lengthy to be read and as a consequence of which customers directly give their consent. Therefore,
the traditional method i.e consent based approach is no longer relevant in present scenario.

Nexus between Government and SayPM and legality of sting operation

The investigation conducted by AnacondaPole has exposed the nexus between Government and
SayPM being involved in sharing of users’ data of the sole purpose. The Indian position on
entrapment and sting operations was explained by the Delhi High Court in the case pertaining to a
“Live India” sting operation18.

In the very controversial cash-for-queries scam, the Delhi High Court in September 2010 upheld
the legality of the sting operation conducted by journalists Aniruddha Bahal and Suhasini Raj in
2005 to expose corruption in the Union Parliament.19 The guidelines further say that the subject
matter of reports or current events cannot make public any activities or material relating to an

18 WP (Crl.) No.1175/2007
19
Aniruddha Bahal v. State, (2010) 172 DLT 269

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 11


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

individual’s personal or public affairs, or which invades a person’s privacy, unless it involves an
identifiable, larger issue of public interest.

And in the present case the issue of public in large holds its ground strong. Thus, there has been
breach of privacy of users’ by the respective authorities.

III. THE STATE IS COMMITTING GROSS VIOLATIONS OF INTERNATIONAL


OBLIGATIONS AND EXISTING INDIAN LEGAL FRAMEWORK

The right to privacy is the right to individual autonomy that is violated when state interfere with,
penalise, or prohibit actions that essentially only concern the individual.

A. INTERNATIONAL INSTRUMENTS:

The first pronouncement on the right to respect for privacy and family is set out in the Universal
Declaration stipulating that ‘no-one shall be subjected to arbitrary interference with his privacy,
family, home or correspondence’ and that ‘the family is the fundamental group unit of society
entitled to protection by society and the state’. Numerous international human rights covenants
give specific reference to privacy as a right. The International Covenant on Civil and Political
Rights (ICCPR), ICESCR, the UN Convention on Migrant Workers and the UN Convention on
Protection of the Child and many other International and Regional Treaties adopt the same
language.

Indian courts have been influenced by customary international law despite the failure of the
legislature to sanction it. The Supreme Court has endorsed the doctrine of incorporation by which
customary international law has an immediate effect on domestic law. 20 In Gramophone Co. of
India Ltd. v. Birendra Bahadur Pandey, 21 it stated that rules of international law may be

20Michael P. van Alstine, The Role of Domestic Courts in Treaty Enforcement: Summary and Conclusions, in THE
ROLE OF DOMESTIC COURTS IN TREATY ENFORCEMENT: A COMPARATIVE STUDY (2009).
21
(1984) 2 SCC 534: AIR 1984 SC 667.

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 12


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

incorporated into domestic law even without sanction by the legislature, provided they did not
conflict with Acts of Parliament. 22

The International instruments that regulate the protection of privacy rights of individuals are:

i. Art 12 of UDHR
“No one shall be subjected to arbitrary interference with his privacy, family, home or
correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the
protection of the law against such interference or attacks.”

ii. Art 17 of ICCPR

The ICCPR, also adopted by the United Nations General Assembly (in 1996), was signed by India
on April 10, 1979. Art 17 of the ICCPR discusses the right to privacy in terms similar to the
European Convention, i.e., as a right against arbitrary interferences with privacy, with that
arbitrariness being determined by the three prong test.23

“1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home
or correspondence, nor to unlawful attacks on his honour and reputation.

2. Everyone has the right to the protection of the law against such interference or attacks.”

India has not, however, signed Optional Protocol-I to the ICCPR, as a result of which it is not
possible for Indian citizens to make a complaint concerning failures to fully implement Art. 17.24
In the context of privacy, particularly General comment no. 16 on the right to privacy, family,
home and correspondence, and protection of honour and reputation (Art. 17) of 1988 are of
immense importance.

Right to Privacy in the International Covenant on Civil and Political Rights (ICCPR) to which

22
(1984) 2 SCC 534 : AIR 1984 SC 667
23
UN Human Rights Committee, General Comment 16 in ‘Compilation of General Comments and General
Recommendations Adopted by Human Rights Treaty Bodies’, UN Doc HRI/GEN/1.Rev 6, (1988).
24
Graham Greenleaf, Promises and Illusions of Data Protection in Indian Law, 1(1)
INTERNATIONAL DATA PRIVACY LAW (2011).

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 13


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

India is a signatory State Party emphasized that:25

“The gathering and holding of personal information on computers, data banks and other devices,
whether by public authorities or private individuals or bodies, must be regulated by law. Effective
measures have to be taken by States to ensure that information concerning a person's private life
does not reach the hands of persons who are not authorized by law to receive, process and use it,
and is never used for purposes incompatible with the Covenant. In order to have the most effective
protection of his private life, every individual should have the right to ascertain in an intelligible
form, whether, and if so, what personal data is stored in automatic data files, and for what
purposes. Every individual should also be able to, ascertain which public authorizes or private
individuals or bodies control or may control their files. If such files contain incorrect personal data
or have been collected or processed contrary to the provisions of the law, every individual should
have the right to request rectification or elimination.”

The expression of data protection in various declarations and laws varies only by degrees. All
require that personal information must be:

 obtained fairly and lawfully;

 used only for the original specified purpose;

 adequate, relevant and not excessive to purpose;

 accurate and up to date; and

 destroyed after its purpose is completed.

The above exegeses have been violated as data has been collected by users by misguiding them,
compelling them to agree to a lengthy consent form which they never read completely. Moreover,
the language used is technical which is difficult for the common man to comply with. The data
which was obtained by SayPM for its sole purpose has been shared with others without the proper

25
General Comment No. 16 to Art 17

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 14


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

consent of the users. However one thing is sure as laid by the Supreme Court in Basheshar
Nath v. CIT26— that a fundamental right cannot be waived. Hence, even if a privacy policy is
“accepted” by the data subject in a given instance, the subject is still giving up his/her entire right
to privacy by giving the data recipient sweeping rights to use the data at will. As such, this will be
construed as a breach of the citizen's fundamental rights.

Companies that receive and handle personal data must be aware that irrespective of whether or
not privacy is a fundamental right, it is not prudent for them to take “consent” from customers in
ways that effectively allows them to use personal data in any form, manner or purpose. Doing so
could arguably be considered as a waiver of citizen's privacy rights—something that has no
legitimacy under the law.

Also, there has been retention of users’ data by such companies despite the existing provisions of
destroying the data after a certain period of time.

B. THE EXISTING LEGAL FRAMEWORK AND OTHER SIGNIFICANT


LEGISLATIONS

The IT Act, 2000 is understood by many to define a data protection regime for the handling of
digital information in India.

The ITA was ratified by the Indian Parliament in 2000 applies to the whole of India and to any
offense or contravention of the Act committed by an individual in or outside of India. 27 Broadly,
the ITA provides legal recognition of electronic commerce and electronic documents. The ITA has
been amended through the IT (Amendment) Act 2008, which received assent from the President of
India in 2009. Many of the sections added to the ITA through the Amendment Act have been
criticized as lacking critical safeguards to prevent against abuse, and a number of cases have been
filed in the Supreme Court of India asking for sections of the ITA to be struck down and declared
ultra vires under the Indian Constitution. 28

26 AIR 1959 SC 149


27 Section 1(2), IT Act, 2000.
28
For example, in the case Shreya Singhal v. UoI, the petitioned asked the Supreme Court to strike down section 66A
of the IT Act, 2000. In the case Mouthshut.com v. Union of India the petitioner challenged the IT (Intermediaries
Guidelines) Rules, 2011 and argued that the Rules are unconstitutional and go beyond the scope of the IT Act 2000.

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 15


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

Section 69 of the IT Act states that only if “sovereignty or integrity of India, the security of the
State, friendly relations with foreign states or public order” is in danger “or for preventing
incitement to the commission of any cognisable offence” can websites or mobile apps share details
with any government agency. But, as per the section 69 of the IT Act, the reasons for sharing
personal details have to be “recorded in writing, by order.”

The IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information)
Rules, 2009, which says; “No person shall carry out the interception or monitoring or decryption of
any information generated, transmitted, received or stored in any computer resource under
sub-section (2) of section 69 of the Act, except by an order issued by the competent authority.”

“Provided that in unavoidable circumstances, such order may be issued by an officer, not below
the rank of Joint Secretary of the Government of India, who has been duly authorised by the
competent authority,” the rule further reads. In case of an emergency, as per the rule, decryption
“may be carried out with the prior approval of the Head or the second senior most officer of the
security and law enforcement agency”.

Further, it is provided in Reasonable security practices and procedures and sensitive personal data
or information Rules that a body corporate may collect information only if the collection is for a
lawful purpose and connected to a function or activity of the Body Corporate, or the collection is
necessary for that purpose.29

Thus, there has been violation of the above provision as SayPM in both seeking and parting with
the data as it has shared the users data with the Government (PMO) right before the General
elections in Narnia 30, that was solely for the individual benefit.

29 Rule 5(2), IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules
2011.
30
Moot Proposition, para 6

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 16


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

IV. THE PRESENT LAWS WITH IT NEED AMENDMENT AS OTHER STATUTES


ARE NOT SUFFICIENT

The IT laws for a long time been outdated and way behind its counterparts in other parts of the
world. The Act needs more teeth to handle the dark web. It is to be realised that the IT Act passed
in 2000 was last amended 10 years ago, i.e. in 2008 and needs to be amended in many respects due
to advancement in technology. Current realities, challenges and the policy aspects of cyber space
have not been addressed. There are no provisions, for instance, for mandatory reporting of
cybercrime and cyber security breaches. Attention has been drawn to the failure of the proposed
law in safeguarding individuals’ personal data from the excessive collection by the State for the
purposes of national security.

A. ABSENCE OF QUALITY DATA PROTECTION OBLIGATIONS IN


RELATION TO PERSONAL INFORMATION

India does not have specific data protection legislation, other than the IT Act, which may give the
authorities sweeping power to monitor and collect traffic data, and possibly other data. The IT Act
does not impose obligations on private sector organisations to disclose details of the practices in
handling personal information. The questions have been raised whether the Act has sufficient
'byte' to become an effective legislation. Then there are so- called concerns over certain grey areas
within the Act...lack of confidence building measures, consumer protection, draconian power to
the police, silent on intellectual property rights, taxation...the list is endless. In short, the question
is of legislative competence in framing the Act. The issue with India’s IT Rules is that they only
cover “sensitive” data. However, since even non-sensitive data can be useful for a phishing
attack, the law needs to go further and cover all information about a person that could
potentially be used against them. When data is available openly, it is possible to write scripts
that “scrape” or read the data from web pages, harvesting thousands or millions of records. This
could either be done in a few hours, before any system administrators can notice, or over weeks
or months to avoid raising suspicion. Therefore even seemingly benign data leaks create a clear
and present risk of individual financial fraud conducted on a large scale, such that people may

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 17


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

lose confidence in online services and stop using them. Given the trend towards increasing
digitalisation of commerce, slowing that momentum could pose a significant setback to the
whole economy.

B. PRINCIPLE OF UPDATING CONSTRUCTION

What we need is continued legislative activities and it is time to amend other enactments, like the
Indian Telegraph Act of 1885, The Indian Post Office Act of 1888 and The Indian Wireless
Telegraphy Act of 1993 to bring them at par with the new technological developments. This new
medium requires new laws.

Thus, the Supreme Court also approves the principle of updating construction, i.e., law must
constantly be on the move adapting itself to the fast changing society and not lag behind.31

It also pertinent to note here, that the absence of a specific privacy law in India has resulted in a
loss of substantial foreign investment and other business opportunities. This deficiency has also
served as an obstacle to the real growth of electronic commerce. Thus, a statute addressing various
issues related to privacy is of utmost importance today, if not an entire act can be brought into
force, then at least specific provisions relating to privacy and data protection be incorporated into
the Act.

i. Loopholes in the IT Act that needs to be looked upon

Although the National Commission to Review the Working of the Constitution recommended that
an Art. 21-B (granting a constitutional right to privacy) be inserted into the Constitution by
amendment, 32 that recommendation never came to fruition. Also, India lacks effective and
inclusive privacy coverage in legislation, although there are some scattered attempts to address it
in specific contexts, such as in the IT law, the Right to Information Act and consumer protection
laws, etc.33

While the purpose of the IT (Amendment) Act was to address increasing trends of cybercrime and
in effect, make it difficult to be a cybercriminal, the irony rests in the fact that what the

31 State of Maharastra v. Dr. Praful B. Desai, (2003) 4 SCC 601


32 National commission to review the working of the Constitution, A Consultation paper on Enlargement of
Fundamental Rights
33
The Centre for Internet and Society (Aug 25, 2018, 10:18 PM), https://cis-india.org/

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 18


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

Amendment Act eventually has created is a situation wherein it perhaps, isn’t ‘easier to be a
criminal’, but rather, ‘easier to be classified as a criminal’. The loophole of the Act are:

ia. The IT (Amendment) Act, 2008, reduced the quantum of punishment for a majority of
cybercrimes. This needs to be rectified. The majority of cybercrimes need to be made non-bailable
offences.

ib. The IT Act does not cover a majority of crimes committed through mobiles. This needs to be
rectified.

ic. Cyber war as an offence needs to be covered under the IT Act.

id. Parts of Section 66A of the IT Act are beyond the reasonable restrictions on freedom of speech
and expression under the Constitution of India. These need to be removed to make the provisions
legally sustainable.

A comprehensive data protection regime needs to be incorporated in the law to make it more
effective. Detailed legal regime is needed to protect privacy of individuals and institutions. As
provided for under section 43A of the ITA, through powers conferred by section 87(2), on April
13, 2011, the Government of India's Department of IT issued through a gazette notification the IT
(Reasonable security practices and procedures and sensitive personal data or information) Rules
(Rules).34

ia. The Rules are silent as to whether Body Corporate needs to provide notice of changes in its
privacy policy.

ib. As a side note, the Rules do not clarify when the provision of a privacy policy35 applies and
when notice is to be provided for direct collection,36 which is an undefined term.

ic. Even though this Rule provides for a Grievance Officer, the mechanism is weakened by the
fact that the scope of the Grievance Officer's duties is limited to addressing grievances relating to
how quickly the Body Corporate processed information.

34 IT (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.
35
Id. At Rule 4
36
Id. At Rule 5(3)

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 19


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

ii. Guidelines for the Regulation of Computerized Personal Data Files

On December 14, 1990, the United Nations adopted General Assembly Resolution 45/95. The
resolution, Guidelines for the Regulation of Computerized Personal Data Files, set out Fair
Information Practices for the use of personal data. The United Nations General Assembly
recommended that governments incorporate the privacy guidelines into legislation and
administrative regulations. It has laid down ten principles and extends the applicability of the
principles37 “to all public and private computerized files.”

There are other privacy principles as well:

a. The European Union

The EU has a considerable collection of laws and institutions relating to Data Protection. The
Human Rights Act 1998 sets out the fundamental rights and freedoms that everyone in the UK is
entitled to. It incorporates the rights set out in the European Convention on Human Rights (ECHR)
into domestic British law. The Human Rights Act came into force in the UK in October 2000.

The Charter of Fundamental Rights of the European Union (2000)

Art 7 - Respect for private and family life

“Everyone has the right to respect for his or her private and family life, home and
communications.”

Art 8 - Protection of personal data

It sets out the right to respect for private and family life, home and correspondence, as well as a
number of possible limitations. Authorities may not interfere with this right except as is ‘in
accordance with law and is necessary in the interests of a democratic society, in the interests of
national security, public safety or the economic well-being of the country, for the prevention of
disorder or crime, for the protection of health and morals, or for the protection of the rights and
freedoms of others.’

The European Court has made it clear that a state has a duty not to interfere with its subjects’

37 Guidelines for the Regulation of Computerized Personal Data Files (Sep 1,2018, 3:31 PM),
http://www.refworld.org/docid/3ddcafaac.html

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 20


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

privacy, except under the strictly limited circumstances prescribed in Art 8 ECHR; i.e., only if
prescribed by law, in the public interest and necessary in a democratic society. The Court has ruled
that a person’s private life extends to moral and physical integrity, including sex life, and it has
found that in certain circumstances a state has a duty to act to ensure that the right to privacy can be
enjoyed.

There is nominally a data protection law in India in the form of the Reasonable Security Guidelines
under Section 43A of the IT Act. However, it is a toothless law and is never used.

The Report of the Group of Experts on Privacy

In 2010, the Department of Personnel and Training (DoPT) published on its website an “Approach
Paper for a Legislation on Privacy,” which was drafted by a group of officers for the purpose of
developing a “conceptual framework that could serve the country's balance of interests and
concern on privacy, data protection, and security…” 38 The Paper reviewed privacy laws in
thirteen different jurisdictions and set forth recommendations for a privacy regime in India.

The Paper39 that in many ways India does not have a culture of privacy - for example,

The Government often discloses personal information of citizens as part of its transparency efforts.
Another factor cited as a driving force for privacy legislation in India was the trend towards
centralization of governmental databases. Finally, the paper pointed out the increased collection of
personal data by private sector organizations.

The Report40 recommends both a regulatory framework for privacy in India and lays out Nine
National Privacy Principles that would be applied across sectors to harmonize legislation, policy
and practice. The Report has also suggested other measures to be taken.

38 Government of India. Ministry of Personnel, PG & Pensions, Department of Personnel Training, Approach Paper
for a Legislation on Privacy, (18th October 2010) ,
http://ccis.nic.in/WriteReadData/CircularPortal/D2.D02rti/aproach_paper.pdf.
39David J. Kessler, Sue Ross and Elonnai Hickok, A Comparative Analysis of Indian Privacy Law and the

Asia-Pacific Economic Cooperation Cross-Border Privacy Rules, 26 NLSI Rev 31 (2014)


40 Government of India Planning Commission, Report of the Group of Experts on Privacy (2012)

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 21


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

b. APEC (Asia- Pacific Economic Cooperation)

The APEC41 privacy framework consists of Cross-Border Privacy Rules (“CBPR” 137) and a
common set of privacy principles. Additionally, the framework seeks to improve data sharing
between governments, and ensure the safe transfer of information between across borders. To date,
India has not been granted membership. Reasons cited for this have included a lack of political
clout, government instability, and a lack of strong support for membership within APEC. APEC’s
CBPR define personal information very broadly. 42

The nine recommended National Privacy Principles as laid out in the Report of the Group of
Experts on Privacy, though not an exact fit, reflect many of the principles central to the APEC
privacy framework. India's privacy requirements as found under section 43A of the ITA and
subsequent Rules are a close fit with the APEC Cross-Border Privacy Rules, but they are not
perfectly aligned. To more closely match the APEC privacy framework, India would generally
need to expand a few aspects of its privacy requirements. 43

Of course, APEC is involved with far more than privacy matters. But if India were to become a
member of APEC, compliance with APEC's privacy requirements seems relatively
straightforward.

iii. Sri Krishna Committee Report Summary- Data Protection Expert Committee

The Committee of Experts on a Data Protection Framework for India (Chair: Justice B. N.
Srikrishna) released a white paper on November 27, 2017. The Committee was constituted in
August 2017 to examine issues related to data protection, recommend methods to address them,
and draft a data protection law. The objective was to ensure growth of the digital economy while
keeping personal data of citizens secure and protected. The Committee sought comments on
certain questions raised by it till December 31, 2017.

Principles: The Committee suggested that a framework to protect data in the country should be
based on seven principles: (i) law should be flexible to take into account changing technologies,

41
Asia-Pacific Economic Cooperation Fact Sheets, APEC Data Privacy Pathfinder, (Aug 9, 2018, 5:22 PM),
http://www.apec.org/About-Us/About-APEC/Fact-Sheets/APEC-Privacy-Framework.aspx.
42
“Any information about an identified or identifiable individual”
43 Id.

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 22


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

(ii) law must apply to both government and private sector entities, (iii) consent should be genuine,
informed, and meaningful, (iv) processing of data should be minimal and only for the purpose for
which it is sought, (v) entities controlling the data should be accountable for any data processing,
(vi) enforcement of the data protection framework should be by a high-powered statutory
authority, and (vii) penalties should be adequate to discourage any wrongful acts.

The committee recommends giving “data principles” the ‘the right to be forgotten’. This means
they will be able to restrict or prevent any display of their personal data once the purpose of
disclosing the data principal withdraws consent from disclosure of their personal data. The
principle has been put into practice in European Union (EU) since 2006.

Thus, the guidelines need to be drawn from above instruments, reports and suggestions. In today's
global economy, and particularly for India, the importance of strong, enforceable, and
internationally interoperable data protection standards cannot be underestimated. This is very true
for India, as it has sought, and is seeking to position itself as an attractive destination for business
and data processing. To help achieve this goal, India sought ‘data secure’ status from the European
Union in 2012 as part of negotiations on the free trade agreement with the region.

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 23


3RD SYMBIOSIS LAW SCHOOL, HYDERABAD, NATIONAL MOOT COURT COMPETITION- 2018

PRAYER

Wherefore in the lights of the facts stated, issues raised, authorities cited and arguments
advanced, it is most humbly prayed before this Hon’ble Court that it may be pleased to:

1. Declare that, the writ filed is maintainable in the Court of law;

2. Declare that there is blatant violation of Fundamental Right under the Constitution of Narnia;

3. Issue directions to the Government to frame or amend rules/ regulations under Section 87 of the
IT Act, 2000 and to the SayPM to prevent it from sharing its users’ data without the express written
consent of the data subject;

4. Issue directions to Central Investigation Agency to investigate any nexus between the
Government and SayPM resulting in compromise of any citizen’s personal data;

AND/OR

Pass any other order that it deems fit in the interest of Justice, Equity and Good Conscience.

And for this act of kindness, the petitioner shall forever pray.

COUNSELS ON BEHALF OF PETITIONER

Sd/

WRITTEN SUBMISSION ON BEHALF OF PETITIONER 24

You might also like