Source: Ideas and Institutions Issue #2
Analysis
The Three Mistakes in the Privacy Debate
As India inches closer to a legislation on data privacy, it is worth examining how the discussion on privacy has evolved over the last five years. The Joint Parliamentary Committee (JPC) submitted its report on the Personal Data Protection Bill, 2019. The journey of this legislation started approximately five years ago, in the litigation over the constitutional validity of Aadhaar, India’s unique identification system. Since then, the way the demand for privacy has been articulated—from the exposition on the fundamental right to privacy by the Supreme Court in 2017 to the JPC report in 2021—highlights certain problems.
I argue in this essay that the landmark decision of the Supreme Court in 2017 that declares privacy to be a fundamental right was, and continues to be, problematic. The decision and design of the data protection law exhibit three mistakes that the proponents of the data protection law have made. First, of taking an unduly legalistic approach to the issue; second, of being excessively ambitious by trying to create an economy-wide data privacy law; third, of assuming that a powerful and intrusive data protection regulator will help achieve reform of state surveillance practices.
The Privacy Judgement
In August 2017, India’s Supreme Court handed down a judgement interpreting a fundamental right to privacy into the Indian Constitution (Justice K. S. Puttaswamy (Retd.) and Anr. vs Union Of India, or “Puttaswamy I”).
I have written elsewhere on how creating Aadhaar has led to concerns over government surveillance and violations of privacy. These concerns culminated into the judgement on privacy (Puttaswamy I). A five-judge bench was created to decide the constitutional validity of Aadhaar, and this bench in turn made a reference to a nine-judge bench in Puttaswamy I to decide on whether a right to privacy existed under the Constitution.
Since the nine-judge bench was set up to decide a purely legal or interpretative question, the bench in Puttaswamy I was unmoored from the question of Aadhaar’s constitutional validity or to any other factual dispute. This has led to two consequences: (a) the creation of a broad, overarching right to privacy—in the form of a philosophical treatise; (b) the clarification of when state power can be used to violate privacy within permissible limits, rather than to limit state power itself.
The judges in Puttaswamy I held that there is a fundamental right to privacy under the Indian Constitution. This construction does not seek to locate specific areas of human activity that are protected but states the right to privacy as an overarching concept derived from natural rights. The main weakness with this formulation is that it does not, by itself, provide clarity on how specific conflicts between privacy interests and societal interests can be resolved.
To adjudicate future cases, the court formulated a test. The court held that privacy rights can only be violated by constitutionally valid state action. Constitutionally valid state action is one that is exercised under a law, is in furtherance of valid government objectives, and is proportionate to the objective sought to be achieved. So, the state can violate privacy as long as it enacts a law, is able to justify the objective of the law, and can argue that the means used to violate privacy are necessary for achieving that objective.
Repercussions and Mistakes
The court’s enthusiasm for being the supplier of a landmark fundamental right has arguably had some problematic consequences.
Mistake #1: Privacy Protection as a Legalistic Exercise
The tendency of declaring overarching rights in the abstract, complete with prescriptions for state action, hinders if not subverts the organic process through which rights develop case-by-case. If the judges in this case had construed a narrower definition of privacy, it would have been possible to have different tests and principles for different kinds of privacy violations in the future. Not only is the formulation all encompassing, but it is also grounded in a legalistic perspective of privacy. This is perhaps not surprising when coming from a judicial institution. But it is limiting as a treatise on privacy that is intended to funnel all future discussions on the subject.
These shortcomings are evident in the work of the Justice SriKrishna Committee that was constituted by the Indian government to propose a data protection regime for India. Just like the Puttaswamy I judgement, the committee report takes an expansive view of data protection regulation. It borrows from similarly expansive regulatory frameworks in the EU and other parts of the world. While it is rich in its discussion on legal concepts, it does not include perspectives from other disciplines.
The committee’s report is replete with legal research and best practices in other legal frameworks, but thin on empirical evidence from India and on inter-disciplinary perspectives on privacy. It does not provide any analysis of how its proposals would affect the Indian economy. It pushes the claim that privacy as a norm is too important to be subjected to pragmatic concerns.
Mistake #2: Over-Ambition
In their enthusiasm for infusing all aspects of the economy with privacy, proponents of the cause may have won the battle but lost the war. A consequence of the vague, all-pervasive privacy framework—first articulated in Puttaswamy I—has been that specific arenas remain easily contestable. There have been new allegations about the government’s use of surveillance malware against Indian citizens. Intended checks against government surveillance in the proposed data protection legislation continue to be whittled down.
A narrower approach that attempted to fix privacy issues in specific areas may have yielded better results. The EU, for example, has developed its latest regulations in the GDPR on the basis of earlier regulations and jurisprudence that go back at least three decades. Therefore, even though EU regulations seem expansive, they build on a body of jurisprudence developed by focusing on specific issues. The original impetus for the right to privacy litigation in India was the reform of government use of citizen data and surveillance practices. A narrower focus on this issue may have yielded better results.
From a regulatory perspective, this creation of an expansive regulatory framework in one go will also mean that relative to the EU, Indian regulators and courts will have a larger degree of discretion when applying data protection law. Firms and individuals will also face a much higher degree of regulatory uncertainty, because of the prior lack of jurisprudence but also due to the expansive scope of regulation.
Mistake #3: Tasking the State with Regulating Itself
The Puttaswamy I judgement tasks the government with protecting privacy, especially for informational privacy. Yet, it also seeks to guard citizens’ privacy from the same state. The use of state power is inescapable for regulating the excesses of private markets. In such cases, suitable designs and practices may constrain the state from excesses. However, this route is arguably not appropriate for checking state overreach itself. As the steady erosion of checks on the government in the data protection legislation shows, the Data Protection Authority (DPA) will be most effective in policing business but least effective in policing the state.
This would likely not have arisen had the court been trying to interpret privacy rights in the context of a specific factual situation. Had the judgement on privacy been delivered to deal with the use of Aadhaar itself, the court may have been constrained by having to look at a specific practice of the state while thinking about the right to privacy. This would likely have not resulted in the proposal that a data protection authority be the primary mechanism for imposing accountability on the state’s use of data. A narrower judgement on privacy that focuses on the state’s data collection and use, and a privacy law focused on solving specific privacy issues may have helped achieve the original objective of restraining the state.
To conclude, the development of privacy legislation over the last five years has shown a surprising lack of scepticism about using state power, while remaining sceptical of state power itself. This is not to argue that real problems with the use of data and the infringement of privacy do not exist. It might however be good to ask how the discussion on privacy and data would have proceeded if:
- The Supreme Court in Puttaswamy II had constituted a 9-judge bench to decide on the constitutionality of Aadhaar and decided on the right to privacy question within that judgement itself, instead of referring the question of privacy to another bench.
- The Justice SriKrishna committee had identified five major privacy and data protection issues in India through empirical research, crafted legislation narrowly tailored to solving them, and the remit of the proposed data protection regulator was limited to just those issues.
—By Anirudh Burman
Review
The House the Ostroms Built
Alexis de Tocqueville’s exploration of democracy initiated a tradition of scholarship that speaks to Alexander Hamilton’s question: Are societies capable of “establishing good government from reflection and choice” or must they “depend for their political constitutions on accident and force”? Tocqueville’s themes—local liberty, equality of conditions, self-interest rightly understood, civic associations, the role of religion in democracies, centralization, and administration—have inspired many.
But few have responded to Tocqueville’s call with the flourish of Elinor and Vincent Ostrom. In 1973, they founded the workshop on political theory and policy analysis at the Indiana University Bloomington, which explored Tocquevillian themes through what they called Tocquevillian analytics.
A recent book edited by Jayme Lemke and Vlad Tarko— Elinor Ostrom and the Bloomington School: Building a New Approach to Policy and the Social Sciences—reviews the scholarship of this enterprise. The book places them in conversation with certain other traditions: the foundational influence of the public choice perspective of James Buchanan and Gordon Tullock (Chapter 2); the interactions with and differences from other New Institutional Economics research, especially that of Douglass North, Oliver Williamson and Ronald Coase (Chapter 3); and the potential to learn from and inform new economic sociology of Mark Granovetter and Richard Swedberg (Chapter 5).
The book highlights certain methodological innovations of the Bloomington School: Elinor Ostrom’s work to expand the notion of rationality in the rational choices model (Chapter 4); the ideas that the Bloomington School developed on the social context of knowledge—especially the role of language, shared understanding, and institutions (Chapter 6); and so on.
The book also gives an overview of the workshop’s insights on a variety of topics: community-based management of common-pool resources as an alternative to state control and privatization and the lessons these experiences offer for contemporary environmental issues (Chapter 7); the problems of central planning and economic calculation, what it takes for individuals and groups to coordinate actions for generating collective benefits, and how a political system can collect and process information about what the citizens need (Chapter 8); the field of public administration, and how a political economy perspective can reduce the tendency to think in terms of bureaucratization and centralisation (Chapter 9); the working of polycentric, federal political systems and how the institutional analysis approach—pioneered by the school—can help understand such systems (Chapter 10).
The Ostroms built a tradition of instruction and scholarship that lives on after they have passed away. Like the work of the workshop, the book is full of insights. To give a flavour of both, here are four points from this book about the workshop.
First, the Ostroms’ approach to research involved asking important questions in a variety of areas and exploring the answers over decades. They studied formal and informal political systems, public administration systems, community-based mechanisms, and more. They studied the social and psychological foundations of economic and political institutions. Because of their wide-ranging research agenda, they were able to bring insights from various domains together. For instance, their research on collective action mechanisms in a variety of common property domains yielded broad principles that seemed to explain the successes (and failures) of these mechanisms.
Second, while the Ostroms followed the public choice theorists in taking a clear-eyed, unromantic view of collective action, they enriched this approach in important ways. They worked on the peripheries of the earlier public choice tradition rather than its core, which was about applying a somewhat narrow economic reasoning to nonmarket decisions. For instance, Elinor Ostrom argued that a broader conception of rationality—which considers generosity, fairness, and group identity—understands real-life collective action choices better in certain contexts. She wrote: “Humans have a more complex motivational structure and more capability to solve social dilemmas than posited in earlier rational choice theory.” Similarly, their evaluative criteria for institutions considered variables beyond efficiency and productivity. They recognised that “more than economic efficiency is needed for the successful management of at least some public economies, especially over the long term.”
Third, since they built and revised their theories and models from real world observations, their theories allowed for dynamic changes. Their approach is encapsulated by Elinor Ostrom’s law—what works in practice can also work in theory. In an attempt to understand why actual management of common property resources often does not devolve into the tragedy of the commons that Garrett Hardin famously theorised, Elinor Ostrom showed that Hardin’s theory is based only on analysis of operational-choice rules but doesn’t consider the collective-choice rules that shape the operational rules. Nor does it consider the constitutional-choice rules that shape the collective-choice rules. In practice, under certain conditions, the collective-choice and constitutional-choice rules could shape operational rules that did not lead to the tragedy of commons. As Elinor Ostrom argued elsewhere: “Such systems look terribly messy and hard to understand. The scholars’ love of tidiness needs to be resisted.”
Fourth, they were cautious to emphasize that even their core ideas and findings should not be treated as ‘blueprints’ for success. Polycentricity in governance, for example, is not a structural panacea that necessarily promotes positive outcomes. Instead, it is the “ability of citizens to organize and rearrange the structure in multiple governing authorities that communicate, cooperate, and resolve resulting conflicts specific to a variety of local conditions.” There is no suitable decision rule applicable to all collective action situations. And while institutional design matters, it is constructive actions by citizens, especially public entrepreneurs and leaders, that leads to good outcomes.
In her Nobel Prize speech, Elinor Ostrom presented a vision: “A core goal of public policy should be to facilitate the development of institutions that bring out the best in humans.” As the Ostroms’ work shows, there is no shortcut to realise this optimistic vision. Interestingly, many systems of sustainable local self-governance of common property resources they studied are in South Asia. In the Tocquevillian perspective, these are among the roots of our democracy, warts and all. As citizens, we should engage with the Ostroms’ work to reflect carefully on modes of collective action in a democracy, so that we can choose better. This book shows that the Ostroms worked with such a mission to, in Tocqueville’s words, “educate democracy….to revive its beliefs; to purify its mores; to regulate its impulses; to substitute, little by little, knowledge of affairs for inexperience and understanding of true interests for blind instincts.”
—By Suyash Rai