FULL PAPER. AUTHOR’S NAME: NUPUR AGARWAL AFFILIATION: INSTITUTE OF LAW , NIRMA UNIVERSITY MAILING ADDRESS: 1 , RADHANPUR SOCIETY , BEHIND SWAMINARAYAN MANDIR , RAMBAUG , MANINAGAR , AHMEDABAD – 380008 PHONE NO: 09898839289 EMAIL-ID: nupuragarwal201995@yahoo.com

CO-AUTHOR’S NAME: NUPUR JOSHI AFFILIATION: UNITED WORLD , SCHOOL OF LAW MAILING ADDRESS: 67, SWAGAT CITY , GANDHINAGAR – MEHSANA ROAD ADALAJ GANDHINAGAR PHONE NO: 9408968686 EMAIL-ID: nupurjoshi184@gmail.com

TITLE OF THE PAPER: CYBER SPACE MASS SURVEILLANCE PROGRAMS,INFRINGEMENT OF PRIVACY OF INDIVIDUALS, BY STATE IN THE NAME OF NATIONAL SECURITY. ABSTRACT:
In this present era of cyber revolution and globalization, citizens have turned into “Netizens”. The advancements in the field of technology is also accompanied with the development of various methods of surveillance and intervention by the State into individuals’ private information. Governments are keeping an eagle eye by monitoring individual's movements, businesses transactions and also the means of communication, which includes cyberspace. It is alleged that the United States of America’s National Security Agency runs a program known as PRISM, which enables the US government to gain access to e- mails , conversations, pictures, voice calls and even sign in details of people using websites and applications associated with
1|Page

Facebook, Yahoo, Microsoft, to name a few. Failure of cyber law mechanisms and national authorities to advance legislation and frameworks along with the technological developments and the increasing trends on States’ surveillance practices has created an environment in which citizen’s right to privacy is easily violated, leading to human rights violations also and lack of accountability, which raises questions on the legitimacy of such act of state. This research paper will mainly be focusing on this issue of privacy violation .Whether this kind of act of state is justified or is it a cybercrime, done under the veil of National security. This research paper will also be focusing on what kind of legislation do India have to protect its citizen from this kinds of privacy violation as cyberspace is global , not limited to a particular place or country.

RESEARCH OBJECTIVE:
This research paper aims at studying the cyber mass surveillance programs in the name of national interest and security run by various countries, especially USA. The paper will do in depth study of legitimacy of such mass surveillance programs and will try to find out whether this kind of surveillance programs are a violation of human rights , privacy violation of individuals , cyber law violations or not. Further research paper will do an analysis of Indian legal system with respect to right to privacy. Does India have required legislation to protect the right to privacy of individuals online. It’s a high time, to take immediate steps in order to protect the privacy of individual online .Thus, this research paper basically going to deal with this issue of mass surveillance and privacy right violations.

METHODOLOGY: This research paper has been finished through impressive research on both library and web i.e. our dependence has been essential on essential sources. To comprehend the skill and the groundwork of the task numerous research articles have been deliberately concentrated on from sites, for example Jstor, Heinonline and so forth. We have experienced numerous scrutinize papers on right to privacy, cyber surveillance programs, cyber security with a specific end goal to increase learning and outline our examination paper in best conceivable was and we have perused numerous books on Cyber laws, human rights and challenges ,rundown of the aforementioned books is given in the list of sources i.e in the bibliography. Separated from this
2|Page

information identifying with

cyber mass

surveillance programs has been gathered from

distinctive Newspaper cuttings .Further United Nations Human Rights Commission reports and data were also referred in this study, to make it much more accurate and efficient. Since the researchers are scholars , they have tried their best to procure information and information identifying with this issue from the accessible assets, to which they have access.

HYPOTHESIS:
With this foundation, we advance some speculations identified with the mass surveillance programs that in the name of national interest violates the right to privacy of individuals and it lacks legitimacy. Further it has been assumed that India doesn’t have adequate legislation to protect the rights of its citizen online. Hence it has been assumed that there is need of amending and strengthening the existing cyber laws in India, in order to ensure the protection of privacy of individuals online. KEY WORDS: PRIVACY, MASS SURVEILLANCE PROGRAM, INFORMATION TECHNOLOGY ACT 2000, CYBER SPACE.

INTRODUCTION:
As the world moves into the new techno century, we are facing an ever increasing reliance upon technology, and particularly the internet, in our day to day lives. The nature of the internet means that it is impossible accurately to estimate the number of people with access to it .However, its importance and pervasiveness are certain to continue to expand. Because of the exponential growth of the internet , legal institutions face serious questions , not only how to regulate the internet , but also about whether it should be regulated or monitored or put under surveillance by state in the name of national security or national interest . Up to what extent it is legitimate to interfere with the privacy of netizens. The countries who claim

themselves to be the champion of democracy and civil liberties, if themselves engage in such kind of infringement of privacy of not only of their own country citizens but also infringe the privacy of citizens of other country as well. Is such kind of act of states is legitimate to monitor what one browse over internet , to check the personal conversations, mails and profile

3|Page

information of individuals in the name of national security , does it not amount to violation of human rights. Article 12 of UNIVERSAL DECLARATION OF HUMAN RIGHTS states that:” “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.”1 Privacy is a fundamental human right recognized in the UN Declaration of Human Rights, the International Covenant on Civil and Political Rights and in many other international and regional treaties. Privacy underpins human dignity and other key values such as freedom of association and freedom of speech. It has become one of the most important human rights issues of the modern age.2 As it was the case with all of the previous technological revolutions throughout history, the law has been, and will continue to be stretched to its practical and theoretical limits in its efforts to overcome the challenges raised by the internet . The robust development of the Internet and online services over the last several years represent the most significant era for international flows of personal information since the first wave of computerization in the 1970s. During the early days of data processing, fears of omnipotent and omnipresent collections of personal information were largely conceived in terms of centralized computing and foreign data havens akin to tax havens.3 As the USA Supreme Court has noted in the case of Reno v. ACLU, cyberspace is “available to anyone, anywhere in the world, with access to the Internet.”4AS we know the Internet is the worldwide collection of computer networks and gateways that uses TCP/IP, a specific kind of software protocols for communication.5 We can also state that in a simpler manner, the Internet is a network of linked computers including all the millions of personal computers that are connected to it.6 If we look at the history of Internet, it is the outgrowth of a government program
1 2

Article 12 ,UNIVERSAL DECLARATION OF HUMAN RIGHTS, UN CHARTER. http://gilc.org/privacy/survey/intro.html 3 PRIVACY PROTECTION STUDY COMM'N, PERSONAL PRIVACY IN AN INFORMATION

SOCIETY (1977) (expressing concern about intrusions into personal privacy by government and large corporations) 4 Reno, 521 U.S. at 851. 5 KATIE HAFNER & MATTHEW LYON,(2006) WHERE WIZARDS STAY UP LATE: THE ORIGINS OF THE INTERNET 43-218 6 Gr Gromov (2000) History of the Internet and WWW: The roads and crossroads of Internet history .

4|Page

called ARPANET, which was created to enable transfers of data between computers operated by the military, defense contractors, and universities.7 Internet are high speed data communication lines between major host computers, also called nodes, that route data and messages.8 The Internet’s technical qualities also have a negative affect, they make possible an intense surveillance of activities in cyberspace.9As the Digital reality is constructed through agreement about technical norms . By cyberspace code, surfing and other cyberspace behavior generate finely granulated data about an individual’s activities—often without his or her permission or even knowledge.10

MAJOR FINDINGS: THE PROTECTION OF PRIVACY:
Privacy is a very wide concept. It includes the private space(such as home), private items(such as letters and photographs), private relationships such as sexual relationships) and private information (such as information about people).One of the earliest definition of privacy that still holds well is that it is a right to be let alone .’11This definition is supported by two newer concepts, ‘substantive privacy ‘and informational privacy’. The theory behind substantive privacy is that people should be free to make substantive decisions about how they lead their lives, free from interference by the state or by others. The theory behind informational privacy is that people should be able to control the flow of information about them. These two concepts are interconnected and a state of informational privacy is often prerequisite to enjoyment of substantive privacy.12

7

Scott Ruthfield (1995) The Internet's history and development: from wartime tool to fish-cam ,ACM Crossroads Student Magazine . 8 MICROSOFT DICTIONARY, supra note 1, at 331 9 BRIAN UNDERDAHL & EDWARD WILLETT,(1998). INTERNET BIBLE pp.124-26, 147 10 FRED H. CATE, (1997); PRIVACY IN THE INFORMATION AGE pp.50-51 11 S.D. Wareen and L.D. Brandies(1890) , The right to privacy , Harvard Law Review,4(5) 12 Cavazos, Edward A., and Gavino Morin. Cyberspace and the Law: Your Rights and Duties in the on-Line World. Cambridge,(1994) Mass: MIT Press.

5|Page

Although there is no universally agreed definition of privacy, in most cases the difficulty does not lie in deciding whether information is private , but rather , whether the interference with privacy was lawful . Indeed, in a very important case, A v B&C13, Lord Woolf said: “The question of whether there is an interest capable of being the subject of a claim for privacy should not be allowed to be the subject of detailed argument. In those cases in which the answer is not obvious, an answer will often be unnecessary.” The word privacy has been derived from the Latin term “Privatus” which mean separate from rest 14. It can be define as capacity of an individual or group secludes themselves or information about themselves and thereby reveal themselves selectively.15 Privacy can be understood as a right of an individual to decide who can access the information, when they can access the information, what information they can access.16

MASS SURVEILLANCE PROGRAMS ENDANGERING THE PRIVACY OF INDIVIDUALS:
In this digital world, Digital communications technologies, such as the Internet, mobile smartphones and WiFi-enabled devices, have become part of our day to day life, it is something, without this digital communication, life is just like a tree without leaves. With increasing development and improving access to information and real-time communication, innovations in communications technology have boosted freedom of expression, facilitated global debate and fostered democratic participation.
17

It has somewhere have boosted the democracy springs,

changed government , in this present world of digitalization where the human being is been fully dependent upon the internet and communication devices, social networking sites , banking activities, transactions and many more , the list will not end. It has also amplified the voices of human rights defenders and providing them with new tools to document and expose abuses, these powerful technologies offer the promise of improved enjoyment of human rights. As

13 14

Av.B&C[2002]EWCA Civ 337 , 11 March 2002. http://en.wikipedia.org/wiki/Privacy. 15 Rowland, Diane, Uta Kohl, and Andrew Charlesworth. Information Technology Law. Abingdon, Oxon: Routledge, 2012. 16 Murray, Andrew. Information Technology Law: The Law and Society. Oxford: Oxford University Press, 2010. 17 Carlos Jensen, Colin Potts (2004)Privacy policies as decision-making tools: an evaluation of online privacy notices.

6|Page

contemporary life is played out ever more online, the Internet has become both ubiquitous and increasingly intimate. 18 In the digital age, also the communications technologies have enhanced the capacity and efficiency of Governments, enterprises and individuals to conduct surveillance, interception and data collection. Referring to the Special Rapporteur report on the right to freedom of expression and opinion, it has stated that technological advancements mean that the State’s effectiveness in conducting surveillance is no longer limited by scale or duration.19 Declining costs of technology and data storage have eradicated financial or practical disincentives to conducting surveillance. The State now has a greater capability to conduct simultaneous, invasive, targeted and broadscale surveillance than ever before.20 So it can be concluded that, the technological advancement of digital arena, upon which global political, economic and social life are increasingly dependent are not only vulnerable to mass surveillance, they have actually facilitate it. 21 It is a matter of deep concern that mass surveillance programs by states have been advancing day by day and interfering into the lives of individuals unnecessarily under the veil of state security. More and more state policies and practices are prepared and directed to exploit the privacy of individuals through electronic surveillance and interception .22 There are many examples of overt and covert digital surveillance in jurisdictions around the world have proliferated, with governmental mass surveillance emerging as a dangerous and draconian habit rather than an exceptional measure. Many Governments around the globe have reportedly have threatened to ban the services of telecommunication and wireless equipment companies unless given direct access to communication traffic, tapped fibre-optic cables for surveillance purposes, and required companies systematically to disclose bulk information on customers and employees.23 Even there have been allegations that some Governments have reportedly made wrong use of surveillance of telecommunications networks to target political rivals and political dissidents. As per reports that authorities in some States routinely record all phone calls and retain them for analysis, while the
18

Julia Brande Earp, David L. Baumer(2012) Innovative web use to learn about consumer behavior and online privacy. Communications of The ACM . 19 Aaron J. Burstein (2010) An Uneasy Relationship: Cyber Security Information Sharing, Communications Privacy, and the Boundaries of the Firm 20 A/HRC/23/40, para. 33., UNITED NATIONS HUMAN RIGHTS COMMISSION SPECIAL RAPPORTEUR REPORT. 21 Lorrie Faith Cranor, Joseph Reagle, Mark S. Ackerman (2003),Beyond Concern: Understanding Net Users' Attitudes About Online Privacy.Computing Research Repository . 22 Ann Bartow(2011) Colloquium on Privacy & Security. 23 Kim Bartel Sheehan (2012),Toward a Typology of Internet Users and Online Privacy Concerns The Information Society .

7|Page

monitoring by host Governments of communications at global events has been reported. This kind of act of state is really devastating for the democracy and sovereignty of a country. 24 Mass surveillance programs have turned the digital technology from a bone to a bane in terms of individual rights and privacy. Now even non-State actors are reportedly developing sophisticated digital surveillance capabilities. Mass surveillance technologies are now entering into the global market, endangering that digital surveillance will escape governmental controls25. The matter of mass surveillance have come into lime light after revelations in 2013 and 2014 by whistleblowers such as EDWARD SNOWDEN who had been a former NSA contractor. Revelations of mass surveillance programs such as PRISM that suggested that, together, the National Security Agency in the United States of America and General Communications Headquarters in the United Kingdom of Great Britain and Northern Ireland have developed technologies allowing access to much global internet traffic, calling records in the United States, individuals’ electronic address books and huge volumes of other digital communications content. These technologies have reportedly been deployed through a transnational network comprising strategic intelligence relationships between Governments, regulatory control of private companies and commercial contracts.26

24

IDO OREN(2014) Is Culture Independent of National Security?How America's National Security Concerns Shaped `Political Culture' Research.European Journal of International Relations 2014. 25 William J. McDonough(2013). Cyber risk and privacy liability: A click in the right direction. Journal of Healthcare Risk Management 2007 26 Mtthew M. Aid (2013)The time of troubles: The US national security agency in the twenty‐first century Intelligence & National Security 2013.

8|Page

Also the United Nations General Assembly have affirmed that the rights held by people offline must also be protected online, and called upon all States to respect and protect the right to privacy in digital communication. There is a need that States shall review their procedures, practices and legislation related to communications surveillance, interception and collection of personal data. Also there is a need for the protection and promotion of the right to privacy in the context of domestic and extraterritorial surveillance and/or the interception of digital communications and the collection of personal data, including on a mass scale. 27 . It is also a matter of concern that whether access to and use of data are tailored to specific legitimate aims also raise questions about the increasing reliance of Governments on private sector actors to retain data “just in case” it is needed for government purposes. Mandatory thirdparty data retention – a recurring feature of surveillance regimes in many States, where Governments require telephone companies and Internet service providers to store metadata about their customers’ communications and location for subsequent law enforcement and intelligence agency access – appears neither necessary nor proportionate.28 One factor that must be considered in determining proportionality is what is done with bulk data and who may have access to them once collected. Many national frameworks lack “use limitations”, instead allowing the collection of data for one legitimate aim, but subsequent use for others. The absence of effective use limitations has been exacerbated since 11 September 2001, with the line between criminal justice and protection of national security blurring significantly. The resulting sharing of data between law enforcement agencies, intelligence bodies and other State organs risks violating article 17 of the Covenant, because surveillance measures that may be necessary and proportionate for one legitimate aim may not be so for the purposes of another. A review of national practice in government access to third-party data found “when combined with the greater ease with which national security and law enforcement gain access to private-sector data in the first place, the expanding freedom to share that information among agencies and use it for purposes beyond those for which it was collected represents a

27

Mark S. Boddy, Johnathan Gohde, Thomas Haigh, Steven A. Harp(2012) Course of Action Generation for Cyber Security Using Classical Planning. 28 Fred H. Cate, James X. Dempsey and Ira S. Rubinstein, “Systematic government access to private-sector data”, International Data Privacy Law, vol. 2, No. 4, 2012, p. 198.

9|Page

substantial weakening of traditional data protections.”29 In several States, data-sharing regimes have been struck down by judicial review on such a basis. Others have suggested that such use limitations are a good practice to ensure the effective discharge of a State’s obligations under article 17 of the Covenant,21 with meaningful sanctions for their violation. 30

A

CASE

STUDY

OF

UNITED

STATES

OF

AMERICA

MASS

SURVEILLANCE PROGRAM:
“This will be the best security for maintaining our liberties . . . a nation of well-informed men, who have been taught to know and prize the rights which God has given them, cannot be enslaved, It is in the regions of ignorance that tyranny begins.”31 The above quote was given by Benjamin Franklin, which is a warning and suggestion given to the citizens of the newly-formed republic to be aware in order to preserve personal freedoms and it clearly underscores the goal of this unit. The founding fathers of USA were acutely aware of the results of tyranny and sought to prevent abuses of the enormous powers given to the government. The United States Constitution and the Bill of Rights are a testament to the seriousness with which they approached the difficult task of constructing a society in which every citizen could live free of governmental restraint. Now the Electronic surveillance, which is utilized as a tool for national security, law enforcement, industrial espionage, or domestic relations can limit and ultimately negate the citizens right to be let alone. The history of the indiscriminate uses to which this technology has been applied on the domestic level, suggests that American citizens are highly vulnerable and endangered to attacks on rights to personal privacy and freedom.32 PRISM PROGRAM:On 5 June 2013, whistleblower and former NSA contractor Edward Snowden revealed the first in a series of disclosures addressing digital mass surveillance

29

Official Records of the General Assembly, Thirty-sixth Session (see footnote 27), annex XIX, paras. 12.2-12.3, and annex XX, para. 10.3. 30 Su Sheng, W. L. Chan, K. K. Li, Duan Xianzhong, Zeng Xiangjun(2012) Context Information-Based Cyber Security Defense of Protection System.IEEE Transactions on Power Delivery 2007. 31 Michele M. Easter (2008)Freedom in speech: Freedom and liberty in U.S. presidential campaign discourse, 1952– 2004. Poetics . 32 R Bigelow (2013)Computer security, crime and privacy in USA — a status report — part IV .Privacy.Computer Law & Security Report .

10 | P a g e

programs operated by US government.33 The revelations addressed particularly PRISM. PRISM (2007) refers to a “special source operation” run by the United States National Security Agency (NSA) with the aim of collecting and mining a wide range of internet communication content and metadata. PRISM includes a number of surveillance programs, such as Upstream, X Key score and BULLRUN 34. In Upstream data collection, data is copied from both public and private networks and sent to the NSA from international fibre-optic cables, and from central exchanges which switch internet traffic between major carriers. The X Key score system enables the searching of a “3 day rolling buffer” of “full take” data stored at 150 global sites on 700 database servers .35 According to the US Foreign Intelligence Surveillance Act (FISA, section 702), the NSA may require a service provider to “immediately provide the government with all information, facilities, or assistance necessary to accomplish the acquisition” of foreign intelligence information.36 This potentially includes disclosure of keys used to secure data-in-transit by major internet companies. Personal data collected through PRISM and other programs is shared in bulk between the intelligence communities of the US, the UK, Canada, Australia, and New Zealand under the “Five Eyes” agreement37. Other intelligence sharing agreements exist to varying degrees between these countries and EU member states.38 The program facilitates extensive, in-depth surveillance on live communications and stored information. The law allows for the targeting of any customers of participating firms who live outside the US, or those Americans whose communications include people outside the US. It also opens the possibility of communications made entirely within the US being collected without warrants.39

33 34

The Guardian, Friday 7 June 2013 Casper Bowden for the LIBE Committee Report, 2013: 13-14 35 Brian T Casey(2013) How Do the Privacy Laws and USA Patriot Act Apply to the Life Settlement Industry? The Journal of Structured Finance 2013. 36 Carr, G. James.(2012) The Law of Electronic Surveillance. NY , NY; Clark Boardman Co., Ltd,. 37 Moraes, December 12, 2013. 38 Theoharis, Athan(2013). Spying on Americans. Philadelphia: Temple University Press. 39 Morgan, Richard.(2013) Domestic Intelligence. Austin, London, Texas: University of Texas Press.

11 | P a g e

INTERNATIONAL LEGAL FRAME WORK FOR THE PROTECTON OF PRIVACY:40
If we look at Paragraph 2 of article 17 of the International Covenant on Civil and Political Rights, which explicitly states that everyone has the right to the protection of the law against unlawful or arbitrary interference with their privacy.41 This implies that any communications surveillance program must be conducted on the basis of a publicly accessible law, which in turn must comply with the State’s own constitutional regime and international human rights law. “Accessibility” requires not only that the law is published, but that it is sufficiently precise to enable the affected person to regulate his or her conduct, with foresight of the consequences that a given action may entail. The State must ensure that any interference with the right to privacy, family, home or correspondence is authorized by laws that :42 (a) are publicly accessible; (b) contain provisions that ensure that collection of, access to and use of communications data are tailored to specific legitimate aims; (c) are sufficiently precise, specifying in detail the precise circumstances in which any such interference may be permitted, the procedures for authorizing, the categories of persons who may be placed under surveillance, the limits on the duration of surveillance, and procedures for the use and storage of the data collected; and (d) provide for effective safeguards against abuse. 43 So, neither do laws or rules that give the executive authorities, such as security and intelligence services, excessive discretion; the scope and manner of exercise of authoritative discretion granted must be indicated (in the law itself, or in binding, published guidelines) with reasonable clarity.44 A law that is accessible, but that does not have foreseeable effects, will not be adequate. The secret nature of specific surveillance powers brings with it a greater risk of arbitrary exercise of discretion which, in turn, demands greater precision in the rule governing the exercise of

40 41

http://www.ohchr.org/EN/HRBodies/HRC/RegularSessions/Session27/Documents/A.HRC.27.37_en.pdf Breckenridge Carlyle, Adam. (2014)The Right to Privacy. Lincoln, Nebraska: University of Nebraska Press. 42 Lewis, James Andrew, and Zoë Baird(2013). Cyber Security. Washington, D.C.: CSIS Press, Center for Strategic and International Studies. 43 European Court of Human Rights, Malone v the United Kingdom, No. 8691/79, 2 August 1984, paras. 67 and 68. 44 Anthony Rutkowski (2011).Public international law of the international telecommunication instruments: cyber security treaty provisions since 1850.

12 | P a g e

discretion, and additional oversight.45 Several States also require that the legal framework be established through primary legislation debated in parliament rather than simply subsidiary regulations enacted by the executive a requirement that helps to ensure that the legal framework is not only accessible to the public concerned after its adoption, but also during its development, in accordance with article 25 of the International Covenant on Civil and Political Rights. 46 The requirement of accessibility is also relevant when assessing the emerging practice of States to outsource surveillance tasks to others.47 There is credible information to suggest that some Governments systematically have routed data collection and analytical tasks through jurisdictions with weaker safeguards for privacy. Reportedly, some Governments have operated a transnational network of intelligence agencies through interlocking legal loopholes, involving the coordination of surveillance practice to outflank the protections provided by domestic legal regimes. Such practice arguably fails the test of lawfulness because, as some contributions for the present report pointed out, it makes the operation of the surveillance regime unforeseeable for those affected by it. 48It may undermine the essence of the right protected by article 17 of the International Covenant on Civil and Political Rights, and would therefore be prohibited by article 5 thereof.49 We can conclude that, states have also failed to take effective measures to protect individuals within their jurisdiction in the implementation of the right to privacy in the digital age, and provided suggestions for initiatives at the international level50. They included encouragement to the Human Rights Committee to update its relevant general comments, in particular on article 17 of the International Covenant on Civil and Political Rights; the establishment by the Human Rights Council of a special procedures mandate on the right to privacy; and/or the engagement of existing relevant special procedures mandate holders in joint or individual initiatives to address

45 46

Augastine, Paul T.(2007) Cyber Security. New Delhi: Crescent Pub. Corp. Mitra, Ananda.(2012) Digital Security: Cyber Terror and Cyber Security. New York: Chelsea House. 47 Hoffman, Daniel and Halperin, Morton H.(2013) Freedom vs. National Security Secrecy & Surveillance. New York, London: Chelsea House. 48 Davis, David Brion(2013)The Fear of Conspiracy Images of Un-American Subversionfrom the Revolution to the Present. Ithaca and London: Cornell University Press. 49 Bayuk, Jennifer L.(2012) Cyber Security Policy Guidebook. Hoboken, N.J.: Wiley. 50 G. Grove(2010)Cyber-attacks and international law Survival .

13 | P a g e

issues related to the right to privacy in the context of digital surveillance and to provide goodpractice guidance. 51

NEED OF STRENGHTENING CYBER LAWS IN INDIA TO PREVENT PRIVACY INFRINGEMENT:
Indian one of those country which has been largely impacted by the Information Technology revolution. Since India is one of the 2nd largest country in terms of population , thus making it one of the largest user of internet. Now the question arises whether, India have adequate legislation to protect the rights of its citizen online. The Indian constitution defines the privacy as personal liberty in Article 21. “Protection Of Life And Personal Liberty” No person shall be deprived of his life or personal liberty except according to procedure established bylaw. The privacy is considered as one of the fundamental rights provided by constitution in list I.52

Considering the Indian context there is a lack of proper privacy legislation so far, so it has become extremely difficult to ensure protection of privacy rights. Although privacy purpose 53. Certain legislative framework that provides indirect support to privacy concerns in India, like Article 2154,Indian Constitution, IT Act 200055Indian Contract Act 187256,Indian Penal Code57,Indian Copyright Act58,Consumer Protection Act Telegraph Act61. The basic regulations aimed at protecting the privacy of individuals are as follows:
59

in

absence

of

specific laws there are some few proxy laws or related law that the government is using for

,Specific Relief Act60,Indian

51

Felici, Massimo (2013)Cyber Security and Privacy: Trust in the Digital World and Cyber Security and Privacy EU Forum 2013, Brussels, Belgium. 52 Article 21 of the Constitution of India. 53 Ponnurangam Kumaraguru, Privacy in India. 54 Article 21 of the Constitution of India. 55 IT Act 2000, Gazette of India Part 2 –Section 1 56 Indian Contract Act 1872, ACT No. 9, 1872 57 The Indian Penal Code 1860, ACT No. 45, 1860 58 Indian Copyright Act 1957. 59 Consumer Protection Act 1986 60 Specific Relief Act 1963 61 Indian Telegraph Act 1985.

14 | P a g e



Information Technology Act 2000 ( IT Act): Section 43A of the IT Act provides for protection of sensitive personal data and information of individuals. A body corporate possessing, dealing with or handling sensitive personal data or information in a computer resource must implement and maintain reasonable security practices and procedures. If the body corporate is negligent in implementing these security practices and procedures and as a result causes wrongful loss or wrongful gain to any person, it may be required to pay damages to the affected person.62



The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ( IT Rules). The IT Rules, framed under section 43A of the IT Act, set out the reasonable security practices and procedures that must be implemented to protect sensitive personal data.63

While the IT Act and the IT Rules regulate the collection and use of sensitive personal information, the government has proposed to enact a specific legislation on privacy (Privacy Bill) which will override the IT Rules.64 The Privacy Bill recognises an individual's right to privacy and provides that it cannot be infringed except in certain circumstances, such as for reasons of:65
   

Protection of India's sovereignty or integrity. National security. Prevention of commission of crime. Public order.

In the present global digital scenario , the Unauthorised collection, processing, storage and disclosure of personal information is treated as infringement of privacy under the Privacy Bill. 66 The IT Act, and correspondingly the IT Rules, have extra-territorial applicability. However, through a press release dated 24 August 2011, the government clarified that the IT Rules only

62

The state of e-commerce laws in India: a review of Information Technology Act .International Journal of Law and Management 2010. 63 Subhajit Basu, Richard Jones (2012)Indian Information and Technology Act 2000: review of the Regulatory Powers under the Act.International Review of Law, Computers & Technology . 64 Lee, Newton.(2013) Facebook Nation: Total Information Awareness. New York, N.Y.: Springer. 65 Singh, Yatindra.(2010) Cyber Laws: A Guide to Cyber Laws, Information Technology, Computer Software, Intellectual Property Rights, E-Commerce, Taxation, Privacy, Etc., Along with Policies, Guidelines, and Agreements. New Delhi: Universal Law Pub. Co.

15 | P a g e

apply to bodies corporate or persons located in India.67 Therefore, the IT Rules do not apply to foreign corporations or persons located outside India, or when information is collected from persons located outside India. The press release further clarified that the provisions of the IT Rules governing collection and disclosure do not apply to bodies corporate collecting data from data subjects (that is, a data processor) on behalf of another entity (that is, a data controller) under a contract between the data processor and the data controller. However, the provisions relating to transfer of sensitive personal information continue to apply to data processors.68

IMPLICATIONS:
After going through the above information relating to the Indian legislation with regard to the privacy of individuals online . We can infer the followings. Loop Holes in present Indian legal frame work for protection of privacy in cyber space are as follows:69       There is no comprehensive law and particular law, still the privacy issue is dealt with some proxy laws which has no convergence on the privacy issue. There is no classification of Information as public information, private information or sensitive information.70 There is no legal frame work that talks about ownership of private and sensitive information and data. There is no accurate procedure of creating, processing transmitting and storing the information. There is no guideline that defines about Data Quality, Proportionality and Data Transparency. There is no framework that deals with the issue of cross-country flow of information.71

67

Kamath, Nandan.(2009) Law Relating to Computers, Internet, and E-Commerce: A Guide to Cyberlaws and the Information Technology Act, 2000. Delhi: Universal Law Pub. Co. 68 Kosturi Ghosh and Suvojit Halder, Trilegal Data protection in India: overview, http://uk.practicallaw.com/1-5059607. 69 Law, Wai K. (2007)Information Resources Management: Global Challenges. Hershey: Idea Group Pub. 70 Gour, Hari Singh, and A. B. Srivastava.(2010) The Penal Law of India: Being an Analytical, Critical & Expository Commentary on the Indian Penal Code, Act XLV of 1860 :As Amended by Information Technology Act, 2000 (Act No. 21 of 2000). Allahabad (India): Law Publishers. 71 Bhansali, Sanwat Raj.(2007) Information Technology and Cyber Law. Jaipur: University Book House, .

16 | P a g e

Thus in this digital era of information technology such loopholes in legal framework cannot be ignore and which can lead to severe infringement of privacy of individuals as well as of the Nation. Which results is disastrous in terms of human rights and fundamental rights of an individual. Hence, it is the need of the hour that , government should come with legislations which will ensure the protection of individuals privacy in the cyber space, being one of the country having largest number of internet users, India should take immediate step in this regard , such that rights of individual can be ensured in the cyber space. addition to obtaining the data subjects' consent at the point of collection of sensitive personal information, the data controller must ensure that reasonable steps are taken to provide the data subjects. All the nations must ensure that their surveillance programs should be in accordance to the existing international laws and shall not violate the individual right to privacy. Governments should ensure that, Rights of individuals shall be protected and respected both online and offline.

KEY REFRENCES:  UNITED NATIONS HUMAN RIGHTS COUNCIL WEBSITE, http://www.ohchr.org/EN/HRBodies/HRC/RegularSessions/Session27/Documents/A. HRC.27.37_en.pdf).      ECONOMICS AND POLITICAL WEEKLY WEBSITE,

http://www.epw.in/?ip_login_no_cache=b98d1eb49579ec3c67a36ba9b37f4022 JSTORWEBSITE, http://www.jstor.org/action/showAdvancedSearch?acc=on&wc=on HEINONLINE WEBSITE, http://heinonline.org/HOL/Welcome Kosturi Ghosh and Suvojit Halder, Trilegal Data protection in India: overview, http://uk.practicallaw.com/1-505-9607. Wikipedia , http://en.wikipedia.org/wiki/Privacy.

BIBLIOGRAPHY:  Subhajit Basu, Richard Jones (2012)Indian Information and Technology Act 2000: review of the Regulatory Powers under the Act. International Review of Law, Computers & Technology .

17 | P a g e

   

Bhansali, Sanwat Raj.(2007) Information Technology and Cyber Law. Jaipur: University Book House, . The New Politics of Surveillance and Visibility By Richard V. Ericson, Kevin D. Haggerty, 2013. Cyberlaw: National and International Perspectives By Rosario J. Girasa. Bayuk, Jennifer L.(2012) Cyber Security Policy Guidebook. Hoboken, N.J.: Wiley.

18 | P a g e