A Right Built for One Actor, a Harm Spread Across Four: Security Tools vs a Privacy Chain No One Owns

Privacy Law Watches One Actor. The Harm Now Travels Through Four.

India's strongest privacy protection, the Puttaswamy judgment (2017), was built for a clear scene: the state intrudes, the citizen challenges, a court tests the intrusion. Today's exposure rarely looks like that. It moves along a chain:

1. Police cameras identify people at a protest - a petition alleges facial recognition, AI-enabled glasses and drones at Delhi's Jantar Mantar.
2. Private firms host that data, according to the same petition.
3. Anonymous accounts publish protesters' personal details - women at the Cockroach Janta Party protests reportedly faced rape and death threats.
4. Identity checks such as the Special Intensive Revision of electoral rolls decide who stays on the voter list. Each link may be defensible alone. Together, they leave a question the law cannot yet answer: who is responsible for the whole chain?

The case for the state's tools - Public order is a real duty. Protests in the capital can turn violent; identifying individuals who commit crimes quickly protects peaceful protesters too.

• The state lacks in-house capacity. Private firms supply the technology and storage that police forces cannot build themselves.
• Security work cannot run on consent. The DPDP Act's power to exempt agencies exists because intelligence and investigation cannot give notice to the very people being investigated.
• Doxxers are criminals, not the state. Blaming police for what anonymous accounts do punishes the wrong actor.
• Clean rolls protect democracy. The Supreme Court upheld the SIR; identity checks on voter lists are a constitutional function, not surveillance.

The case for chain-wide scrutiny - Puttaswamy's promise is not actor-specific in spirit. Privacy is a fundamental right; its value collapses if protection applies only at the first link and vanishes once data changes hands.

• Exemptions without scrutiny swallow the rule. A notification under Section 17 can take an entire agency outside the DPDP Act - and potentially the data it passes to vendors.
• Identification enables exposure. A camera that identifies a protester creates the raw material a doxxer uses. The chain is causal, not coincidental.
• The chilling effect is the real harm. If attending a protest means being identified, indexed and possibly threatened at home, fewer people will protest.

TAN's position Keep the tools - but make accountability follow the data, link by link. Every actor who touches personal data should inherit clear obligations and no exemption should be granted without published reasons, a proportionality test and independent review. Concretely: facial recognition at protests needs a statutory basis with limits on purpose and retention; private firms processing police data must remain bound by security and non-disclosure duties; doxxing of people identified at protests needs enforceable platform duties; and roll revisions must give notice before any deletion. What would change our view: evidence that such oversight would compromise specific operations in ways that sealed, independent review could not address. Without that, a right that protects only the first link of a chain is a right with a hole in it.