{"id":2110,"date":"2020-10-28T08:00:20","date_gmt":"2020-10-28T12:00:20","guid":{"rendered":"https:\/\/journals.law.harvard.edu\/hrj\/?p=2110"},"modified":"2022-01-19T12:44:12","modified_gmt":"2022-01-19T17:44:12","slug":"rule-by-executive-decree-constitutional-concerns-in-india","status":"publish","type":"post","link":"https:\/\/journals.law.harvard.edu\/hrj\/2020\/10\/rule-by-executive-decree-constitutional-concerns-in-india\/","title":{"rendered":"Rule by Executive Decree: Constitutional Concerns in India"},"content":{"rendered":"

Rule by Executive Decree: Constitutional Concerns in India<\/u><\/strong><\/h2>\n

Prashant Khurana & Parth Maniktala[*]<\/sup><\/a><\/h4>\n

 <\/p>\n

COVID-19 has spawned contact tracing efforts, thereby triggering the collection and processing of sensitive personal data across the world.[1]<\/sup><\/a> Legal protections surrounding this large-scale data collection are predominantly nascent, raising significant concerns about the precedent this sets for data privacy. In India, the Supreme Court\u2019s landmark Puttaswamy<\/em> judgement recognized privacy as intrinsic to the right to life and liberty, as secured by Article 21 of the Constitution.[2]<\/sup><\/a> However, the Court conceded that privacy may be abridged if a legitimate interest, say, an epidemic, exists \u2013 provided the doctrine of \u201cproportionality\u201d is satisfied.[3]<\/sup><\/a><\/p>\n

In this context, a recent order from the Kerala High Court in Balu Gopalakrishnan<\/em> assumes significance.[4]<\/sup><\/a> The Kerala government contracted a U.S.-based software company, Sprinklr Inc., for processing and analyzing medical data of people susceptible to, and suffering from, COVID-19.[5]<\/sup><\/a> The petitioners assailed the contract for lacking privacy protections\u2014arguing that it contained no safeguards against the commercial and unauthorized exploitation of the data entrusted to Sprinklr. The Court took note of these objections and issued several directions to prevent a \u201cdata epidemic.\u201d[6]<\/sup><\/a><\/p>\n

This case, however, raises broader concerns regarding India\u2019s data protection regime. With India\u2019s controversial data protection legislation[7]<\/sup><\/a> still in the pipeline, it is crucial to evaluate whether governments\u2014both at the state and federal level\u2014are complying with Puttaswamy<\/em>\u2019s privacy protections.<\/p>\n

Notably, the Kerala government is not alone in pursuing policies that endanger individual privacy. The central government\u2019s \u201cAarogya Setu\u201d COVID-19 tracing application has been impugned for lacking requisite protections despite the release of its data-use policy.[8]<\/sup><\/a> The state of Karnataka required people quarantined in their homes to upload their selfies every hour to \u201cQuarantine Watch,\u201d an application developed by the state\u2019s revenue department\u2014without specifying a privacy policy.[9]<\/sup><\/a> It is therefore imperative to examine if these governments even possess the authority to exercise such powers in the absence of specific<\/em> legislation.<\/p>\n

 <\/p>\n

 <\/p>\n

Rule of Law<\/strong><\/span><\/p>\n

A pandemic is inarguably a crisis of unusual proportions. A worried population, reluctant courts, and the general sense of rallying around the flag gives states enormous powers during crises. It is precisely at such moments that constitutional tenets are most vulnerable. Drastic measures undertaken during times of crisis have often been entrenched into the political and legal landscape long after the exigency has passed. In times like these, it is beneficial to remember Justice HR Khanna\u2019s words of caution, delivered in his ADM Jabalpur<\/em> dissent: \u201c[The] greatest danger to liberty lies in insidious encroachment by men of zeal, well-meaning but lacking in due deference for the rule of law.\u201d[10]<\/sup><\/a><\/p>\n

Rule of law is designed to function as a constraining apparatus against abuse of power. Strictly defined, \u201cEvery act done by the government or by its officers must, if it is to operate to the prejudice of any person, be supported by some legislative authority.\u201d[11]<\/sup><\/a> The need for legislative authority is based on the democratic principle that the legislature represents the will of the people and, therefore, any infraction of the people\u2019s rights must have statutory backing.<\/p>\n

As statutory backing for its contract with Sprinklr Inc., the Kerala government relied on the Disaster Management Act, 2005 (\u201cDM Act\u201d), the Epidemic Diseases Act, 1897 (\u201cED Act\u201d), and the Kerala Epidemic Diseases Ordinance, 2020 (\u201cKerala Ordinance\u201d).[12]<\/sup><\/a> Section 2 of the ED Act authorizes \u201csuch measures\u2026as [the State Government] shall deem necessary to prevent the outbreak of such disease.\u201d[13]<\/sup><\/a> Section 4(2)(j) of the Kerala Ordinance enables such \u201cother measures as may be necessary for the regulation and prevention of epidemic diseases as decided by the Government.\u201d[14]<\/sup><\/a> These statutes were cited by the Kerala government to satisfy the requirement for legislative authority.[15]<\/sup><\/a> However, one must consider if the executive should be permitted to invoke such expansive and overbroad statutes to justify a specific abridgment of privacy; and if in so doing the checks and balances inherent in the Constitution are eroded.<\/p>\n

\u00a0<\/strong><\/p>\n

Need for a Specific Legislation<\/strong><\/span><\/p>\n

In Ram Jawya Kapur<\/em>, the Supreme Court noted that the Constitution broadly recognizes separation of powers, holding that executive authority sans \u201cspecific legislation\u201d cannot encroach upon the legal rights of any person.[16]<\/sup><\/a> In the context of data privacy, a piece of specific legislation<\/em> would be one that defines the purpose of data collection, details the procedural safeguards against misuse of such data, and lays down the period beyond which such data will be purged. The specificity caveat cannot be met through the overbroad clauses in the aforementioned statutes.<\/p>\n

Overbroad statutes run afoul of the test of constitutionality, particularly when evaluated against fundamental rights. In Shreya Singhal v. Union of India<\/em>, the Supreme Court struck down section 66A of the Information Technology Act for being \u201cvague and overbroad, and, therefore, unconstitutional.\u201d[17]<\/sup><\/a> When defending such statutes, the government often presents assurances of enforcement within constitutional limits, despite their unreasonable scope. Shreya Singhal <\/em>resoundingly rejected such assurances, holding that if a law \u201cis otherwise invalid, it cannot be saved by an assurance \u2026 that it will be administered in a reasonable manner.\u201d[18]<\/sup><\/a> Of note here is the fact that this liberal approach was adopted by the court in a case concerning free speech, not privacy. India\u2019s Constitution places certain limitations on free speech under Article 19(2) and, as such, it is a limited right. Being free of similar textual limitations, the right to privacy under Article 21 should merit a similar, if not stricter standard of scrutiny against overbroad statutes.<\/p>\n

There is a need for a piece of anchoring legislation that is specifically tailored to COVID-related data collection, with adequate safeguards and sunset clauses. Absent this legislation, such data collection and outsourcing is an exercise in executive usurpation. As Gautam Bhatia notes, legislation like the DM Act and ED Act grant carte blanche <\/em>authority such that \u201cjust about\u00a0any\u00a0<\/em>executive decree that (the executive believes) is required to tackle the disaster\u201d can be issued.[19]<\/sup><\/a><\/p>\n

The statutes invoked by the Kerala government are unsuited for the policy it seeks to pursue, as the statutes do not even contemplate large scale data collection, let alone adhere to the doctrine of proportionality. It would be grossly inaccurate to argue that the 1897 ED Act contemplated even the existence of complex data analytics. The invocation of the DM Act is also suspect, since it was designed to deal with natural disasters and not public health emergencies. Although the DM Act briefly refers to data collection,[20]<\/sup><\/a> it is only with reference to capacity building and mitigation for natural calamities, not sensitive personal data. The DM Act enumerates no specific purpose for data collection or limitations and safeguards against misuse. Finally, the Kerala Ordinance\u2014despite being passed in response to this pandemic\u2014makes no provision authorizing data collection and analysis.[21]<\/sup><\/a><\/p>\n

The requirement of specific legislation is not isolated to India. In a challenge to Kenya\u2019s biometric identification system, the Kenyan High Court held that \u201cthe provision for collection of DNA and GPS coordinates, without specific legislation detailing out the appropriate safeguards and procedures in the collection, and the manner and extent that the right to privacy will be limited, is not justifiable.\u201d[22]<\/sup><\/a> The need for anchoring legislation is, therefore, being recognized across jurisdictions.<\/p>\n

 <\/p>\n

An Alternative Framework for Crisis Governance<\/strong><\/span><\/p>\n

\u00a0<\/strong>Rule by executive decree is not the only option during a pandemic. Under the Indian constitutional scheme, even an emergency proclaimed under Article 352 (cases of war, external aggression, or armed rebellion) must be ratified by the Parliament within a month.[23]<\/sup><\/a> Therefore, any suggestion that a health crisis should allow the executive to ride roughshod over the legislature would be incompatible with the spirit of the Indian Constitution. Parliaments are functioning across other democracies including Canada, the U.K., and the U.S.[24]<\/sup><\/a> Italy is being governed through \u201cdecree-laws\u201d subject to parliamentary approval within 60 days, absent which, they are void ab initio<\/em>.[25]<\/sup><\/a> Curiously though, India\u2019s executive, which possesses similar powers of ordinance,[26]<\/sup><\/a> is still refraining from promulgating anchoring legislation. It is instead using ordinances to enact broad, sweeping laws. There is no justifiable pretext for this other than the inherent tendency for overreach, a tendency which pervades most Indian governments across party lines.<\/p>\n

The lack of anchoring legislation not only permits executive excesses, it also creates a precedent that constitutional checks and procedures are dispensable. This is a very dangerous erosion of constitutional ethos, and reeks of a paternalistic mindset which paints elected legislators and local representatives as dispensable rubber stamps. Given the scale and efficiency with which technology can operate, placing practical, statutorily grounded limitations on the use and collection of individual data is the only real check on executive arbitrariness. Statutes\u2014including emergency statutes\u2014must evolve from instruments conferring broad powers into policy prescriptions specifying comprehensive limitations on discretionary authority. Absent that, the right to privacy will become a theorized prescription worthy merely of lip-service, without any practical teeth.<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

[*]<\/sup><\/a> Prashant Khurana is an attorney based out of New Delhi, India, and holds an LL.M. from University of California – Los Angeles. Parth Maniktala is a final year student of LL.B. at the University of Delhi, India. Views expressed are personal to the authors and do not reflect those of any organization with which they may be associated.<\/p>\n

[1]<\/sup><\/a> Kate Rogers, Contact Tracing has Become a Fast-Growing Job opportunity with Many People Still out of Work Due to the Pandemic<\/em>, CNBC (June 7, 2020), https:\/\/www.cnbc.com\/2020\/06\/07\/coronavirus-contact-tracing-has-become-a-fast-growing-job-opportunity.html<\/a>.<\/p>\n

<\/a><\/p>\n

[2]<\/sup><\/a> Justice KS Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (India).<\/p>\n

[3]<\/sup><\/a> Id. <\/em>at 182. The \u201cproportionality\u201d doctrine is used to review the constitutionality of limitations imposed on fundamental rights. A limitation is permissible if it: (i) has a legitimate goal, (ii) is rationally connected to the furtherance of this goal, (iii) is the least restrictive alternative, and (iv) is not excessive in nature, that is, the social benefits of achieving the goal outweigh the harms of limiting the right.<\/p>\n

[4]<\/sup><\/a> Balu Gopalakrishnan v. State of Kerala, (2020) W.P.(C). Temp. No. 84 of 2020 (India).<\/p>\n

[5]<\/sup><\/a> Id.<\/em><\/p>\n

[6]<\/sup><\/a> Id.<\/em><\/p>\n

[7]<\/sup><\/a> The Personal Data Protection Bill, Bill No. 373 of 2019.<\/p>\n

[8]<\/sup><\/a> Arshad R. Zargar, Privacy, security concerns as India forces virus-tracing app on millions<\/em>, CBS News (May 27, 2020), https:\/\/www.cbsnews.com\/news\/coronavirus-india-contact-tracing-app-privacy-data-security-concerns-aarogya-setu-forced-on-millions<\/a>.<\/p>\n

[9]<\/sup><\/a> Theres Sudeep, Internet experts raise privacy concerns over Covid-19 apps<\/em>, Deccan Herald (April 21, 2020), www.deccanherald.com\/metrolife\/metrolife-lifestyle\/internet-experts-raise-privacy-concerns-over-covid-19-apps-828137.html<\/a>.<\/p>\n

[10]<\/sup><\/a> ADM Jabalpur v. Shivkant Shukla, AIR 1976 SC 1207 (India).<\/p>\n

[11]<\/sup><\/a> State of MP v. Thakur Bharat Singh, 1967 AIR 1170 (India).<\/p>\n

[12]<\/sup><\/a> Balu Gopalakrishnan v. State of Kerala, W.P.(C). Temp. No. 84 of 2020. (India).<\/p>\n

[13]<\/sup><\/a> Epidemic Diseases Act, \u00a72, Act No. 3 of 1897.<\/p>\n

[14]<\/sup><\/a> Kerala Epidemic Diseases Ordinance, \u00a74(2)(j), No. 6650\/Leg.H1\/2020\/Law. Under the Indian Constitution, ordinances are temporary statutes promulgated by the executive when the Parliament is not in session. Unless ratified by the Parliament within 6 weeks of its reassembly, ordinances cease to have effect.<\/p>\n

[15]<\/sup><\/a> Balu Gopalakrishnan v. State of Kerala, W.P.(C). Temp. No. 84 of 2020. (India).<\/p>\n

[16]<\/sup><\/a> Ram Jawaya Kapur v. State of Punjab, (1955) 2 SCR 225 (India).<\/p>\n

[17]<\/sup><\/a> Shreya Singhal v. Union of India, (2015) AIR 2015 SC 1523. (India).<\/p>\n

[18]<\/sup><\/a> Id.<\/em> at 96.<\/p>\n

[19]<\/sup><\/a> Gautam Bhatia, Coronavirus and the Constitution \u2013 XXI: The Mandatory Imposition of the Aarogya Setu\u00a0App<\/em>, Indian Constitutional Law and Philosophy Blog (May 2, 2020), https:\/\/indconlawphil.wordpress.com\/2020\/05\/02\/coronavirus-and-the-constitution-xxi-the-mandatory-imposition-of-the-aarogya-setu-app<\/a>.<\/p>\n

[20]<\/sup><\/a> The Disaster Management Act 2005, \u00a7\u00a7 36, 39, Act No. 53 of 2019.<\/p>\n

[21]<\/sup><\/a> Kerala Epidemic Diseases Ordinance, No. 6650\/Leg.H1\/2020\/Law.<\/p>\n

[22]<\/sup><\/a> Nubian Rights Forum v. The Hon. Attorney General (2019) eKLR.<\/p>\n

[23]<\/sup><\/a> India Const. art. 352.<\/p>\n

[24]<\/sup><\/a> Agence France-Presse, A Historic Day: Canada’s Parliament Goes Virtual Through Coronavirus Pandemic<\/em>, NDTV (May 17, 2020), https:\/\/www.ndtv.com\/world-news\/canada-parliament-goes-virtual-through-coronavirus-pandemic-2230097<\/a>.<\/p>\n

[25]<\/sup><\/a> Diletta Tega and Michele Massa, Fighting COVID 19 \u2013 Legal Powers and Risks: Italy<\/em>, Verfassungsblog (March 23, 2020), https:\/\/verfassungsblog.de\/fighting-covid-19-legal-powers-and-risks-italy<\/a>.<\/p>\n

[26]<\/sup><\/a> India Const. art. 123.<\/p>\n","protected":false},"excerpt":{"rendered":"

Rule by Executive Decree: Constitutional Concerns in India Prashant Khurana & Parth Maniktala[*]   COVID-19 has spawned contact tracing efforts, thereby triggering the collection and processing of sensitive personal data across the world.[1] Legal protections surrounding this large-scale data collection are predominantly nascent, raising significant concerns about the precedent this sets for data privacy. In […]<\/p>\n","protected":false},"author":101946,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2110","post","type-post","status-publish","format-standard","hentry","category-online-journal"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/posts\/2110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/users\/101946"}],"replies":[{"embeddable":true,"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/comments?post=2110"}],"version-history":[{"count":0,"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/posts\/2110\/revisions"}],"wp:attachment":[{"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/media?parent=2110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/categories?post=2110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/journals.law.harvard.edu\/hrj\/wp-json\/wp\/v2\/tags?post=2110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}