Ed Note: As part of our New Scholarship Section, we have been inviting discussants to respond to specific articles. This is part of a series of posts discussing the public law themed research articles featured in Volume 9 of the Indian Journal of Constitutional Law. You can access all the posts in this discussion here . In this piece, John Sebastian and Aparajito Sen provide us a summary of their paper titled ‘Unravelling the Role of Autonomy and Consent in Privacy’.
Our paper attempts to understand the normative and doctrinal role of consent in privacy claims, which is an important, but under-theorised issue. This has relevance for many contemporary concerns involving privacy. As a recent example, the contact-tracing Aarogya Setu app launched by the government claims to rely on user consent for usage and sharing of information. While many have questioned the nature of the consent involved in the process, we ask a different question: what are the limitations of consent, even if it is given with a full understanding of the consequences? Can a person consent to have their medical data permanently available in the public domain without the possibility of erasure, which can adversely affect their future employment prospects? The limitations of consent have troubled philosophers for long, and we seek to address these and related concerns within the Supreme Court’s privacy jurisprudence.
Philosophical Foundations – Dignity, Autonomy and Waiver of Rights
Puttaswamy I builds upon a foundation rich with references to dignity, autonomy and liberty. Reading Puttaswamy I along with cases which have followed (Navtej Johar and Common Cause in particular), we have conceptualised an ‘autonomy-rich’ formulation of dignity, which focuses upon an individual’s continued capacity to exercise autonomous choices. We have then situated consent within this matrix, as a key variable which signifies the importance of individual choice. However, preserving an autonomy-rich formulation of dignity can, in certain situations, require us to balance consent against other factors such as the continuing autonomy of the individual concerned. In this sense, the balancing exercise is a combination of subjective (consent) and objective (autonomy) factors, both of which have to be considered by a court.
This conception of the role of consent also helps us explain the otherwise tricky issue of ‘waiver’ of fundamental rights. We demonstrate that consent in the disclosure of information does not lead to a complete abandonment of a person’s privacy interests in that information, as is required by an autonomy-rich formulation of dignity. Consent does, however, alter the landscape within which privacy rights can be claimed. Once the information is in the public sphere, other rights, such as freedom of speech, will have to be balanced against the person’s continuing privacy rights. Therefore, when a person seeks erasure of their personal information (exercising their ‘right to be forgotten’), this claim has to be examined while considering various factors such as: the nature of the information in question, how sensitive it is, its importance to the public, and its corresponding link to the rights to information and free speech.
Doctrinal Formulations
Doctrinally, the right to privacy has two parts: 1) the reasonable expectation of privacy test (‘RET’) is adopted to locate the permissibility of a privacy claim; and 2) the alleged infringement of the privacy claim is justified (or rejected) on the footing of proportionality. We have analysed the implications of these principles upon the doctrinal tests used in Puttaswamy I and II, to determine the validity of privacy infringements.
In relation to RET, we endorse an approach which does not limit consent to a ‘one-time’ act. Reinforcing this, we also show how Puttaswamy I unambiguously rejects the American third-party doctrine (which postulates that an individual loses her privacy claim when she consents to sharing the information with a third party). The Court in Puttaswamy I adopts a standard which takes into account subjective and objective factors which emphasises constitutional values based on dignity. Ultimately, we endorse an approach where the scope of review at the RET stage is minimal – allowing non-trivial privacy claims to be balanced with state interests at the proportionality stage.
Puttaswamy I and II cement the role of a proportionality analysis in determining the validity of privacy infringements. We argue that consent should be considered as a factor which affects the balancing stage during the proportionality analysis, rather than as an ‘all-or-nothing’ variable. The weight and intensity ascribed to consent will vary depending on the facts of a particular case, and will be balanced against such factors as the autonomy of the individual, the rights of others and the public interest.
We also discuss the different opinions in Puttaswamy II and endorse Chandrachud, J’s approach, which is far more consistent with an autonomy-rich formulation of dignity than Sikri, J’s decision. We show how questions of consent are involved at many stages of the analysis – from the dangers of profiling, purpose limitations, and the ability to ‘opt out’ – and argue for an approach which recognises that an individual continues to possess valuable privacy interests in their information, even if they initially consented to its use.
The Way Forward
Using our approach, when examining the constitutionality of the Aarogya Setu app, for instance, the state would have to answer a number of questions: is the initial consent offered by the individual meaningful, considering the many coercive forces surrounding the enrolment into the app? If not, can consent play any role to justifying the proportionality of the measure? Does the individual have control over the use of information being supplied through the app? Can an individual opt out of the app and have her information deleted from the database? Is there a possibility that the information be used for profiling (thereby undermining future choices of the individual)?
Our analysis shows that a person’s consent in enrolling into the system would not amount to a ‘waiver’ of rights. This has important implications for the design of such systems, which must necessarily have features which ensure continuing consent of the individual concerned, along with the ability to opt out and have the relevant data erased in most circumstances. Similar concerns will arise with technology and data collection playing an increasing role in new schemes such as the recently-announced Health ID card. Debates surrounding these measures will immensely benefit from a more robust understanding of the role of consent in privacy claims.
Several important issues remain to be addressed. For instance: how are courts to evaluate ‘objective’ constitutional values and construct the image of an autonomy-rich individual without unduly affecting a person’s actual choices? What is the exact weight to be given to consent in the proportionality analysis? Which public interests can weigh against a person’s privacy interests? These questions need to be answered as well, and our paper is only the first step in unravelling the tricky issue of consent.
Prof. John Sebastian is an Assistant Professor and Assistant Dean (Examination) at Jindal Global Law School. Aparajito Sen is a student at Jindal Global Law School.
