Fifteen Years On: Revisiting India's Surveillance Safeguards from the IT Act to Puttaswamy, Pegasus, and the DPDP Act

Abstract

In 2010, critiques of India’s online surveillance regime rested on unstable doctrinal ground: privacy was, at best, a contested emanation of Article 21, and the procedural safeguards attached to interception under Section 69 of the Information Technology Act, 2000 existed without any independent authorisation requirement or a companion statute governing how gathered data could be processed. This article asks whether two intervening developments, the recognition of privacy as a fundamental right in Justice K.S. Puttaswamy v. Union of India and the enactment of the Digital Personal Data Protection Act, 2023, have actually corrected the specific structural defect that animated the earlier critique, namely the absence of any check on the executive’s own decision to intercept, prior to interception taking place. Tracing the doctrinal arc from Puttaswamy’s proportionality standard through the Pegasus spyware litigation to the DPDP Act’s exemption for state processing, this article argues that the constitutional and statutory landscape has been transformed while the operative architecture of Section 69 itself, an executive order followed only by a post-facto, non-judicial review committee, has remained essentially unchanged since 2009. Drawing a comparison with the judicial pre-authorisation, or “double lock”, mechanism under the United Kingdom’s Investigatory Powers Act, 2016, including its own recent narrowing, the article proposes a calibrated form of prior judicial authorisation for Section 69 interception orders as the specific reform needed to close the gap between India’s proportionality doctrine and its surveillance practice.