“If you are not paying for it, you are not the customer, you are the product.” This is a signboard on the information highway that you probably did not see if you missed the signal at “Medium is the message”. Along the way you clicked ‘I agree’ like a dutiful daughter on every single ‘Terms and Conditions’ box that popped up, and now your photo and biodata are available to Google and sundry like a BharatMatrimony ad. In fact, the simple act of browsing a website is now very much like the Indian wedding, with uninvited third parties and strangers assessing your age, profession, and salary package. The tracker cookies that sites drop without your knowledge in your browser can now build and share an uncannily accurate profile of you based on the sites you visit, and deliver tailored advertisements.
Privacy in the digital age
This information conundrum of the Internet user is expressed in more poetic terms in the Supreme Court judgment on the right to privacy: “In aggregation, information provides a picture of the being: of things which matter and those that don’t, of things to be disclosed and those best hidden,” writes Justice D.Y. Chandrachud in the judgment co-signed by former Chief Justice J.S. Khehar and Justices R.K. Agrawal and S. Abdul Nazeer. In those Romantic-era lines is a post-modern truth, that you are now the aggregate of the information about you.
When online, our new fundamental right to privacy has to contend with the reasonable restrictions of national security and data collection for justifiable reasons such as “ensuring that resources are properly deployed to legitimate beneficiaries”. It also has to contend with our own paradoxical behaviour. The justices draw on the observations of American legal luminary Richard Posner to make the point that while people value informational privacy, they will share it “at the drop of a hat” on everyday transaction if they stand to benefit from it.
Online privacy
While balancing the right to privacy with what it is up against online, the court mentions the nine principles suggested by the 2012 report of the government’s expert group on privacy. These included giving users notice on information collection; giving users the choice to opt out, limiting the nature of the information and the purpose for which it is collected; giving users access to the collected information; ensuring security for the collected information; preventing unauthorised sharing of the information; and holding the information collector accountable. The court, however, does not give clear directions on online privacy, taking note of the Centre’s commission headed by Justice B.N. Srikrishna that is reviewing data protection norms, and is to make its recommendations. It says: “We expect that the Union government shall follow up on its decision by taking all necessary and proper steps.”
But mere expectation might be too little, and too late, based on another observation that the court itself makes in the judgment: The total number of Internet subscribers in India stood at 391.50 million at the end of 2016, reflecting an 18.04% change over the previous quarter. That is 391.50 million potential personal profiles. “The figures only increase,” the court notes, almost ominously.