Introduction: Rights and Investigations
Cyber crime investigation operates within a constitutional framework that balances state power to investigate crimes with individual fundamental rights. Understanding these constitutional limits is essential for investigators to ensure that evidence is collected lawfully and is admissible in court.
By the end of this part, you will be able to:
- Apply Article 21 principles to digital investigations
- Understand the K.S. Puttaswamy privacy framework
- Apply the Shreya Singhal precedent correctly
- Implement the four-pronged proportionality test
- Recognize constitutional limitations on surveillance
Article 21: Right to Life and Personal Liberty
Article 21 of the Constitution states: "No person shall be deprived of his life or personal liberty except according to procedure established by law." This seemingly simple provision has been expansively interpreted by the Supreme Court to include numerous rights relevant to cyber investigations.
Rights Within Article 21 Relevant to Cyber Investigations
- Right to Privacy - Recognized as a fundamental right in K.S. Puttaswamy (2017)
- Right against Self-Incrimination - Protection against compelled disclosure of passwords/encryption keys
- Right to Fair Trial - Evidence must be obtained legally
- Right to be Forgotten - Limited recognition in digital context
- Right to Personal Data Protection - Now codified in DPDPA 2023
Article 21 requires that any deprivation of liberty must follow "procedure established by law." The Supreme Court has held that this procedure must be:
- Fair - Not arbitrary or unreasonable
- Just - Meeting standards of natural justice
- Reasonable - Proportionate to the objective
For investigators, this means that even if a procedure is prescribed by law (e.g., IT Act Section 69), its application must still meet these standards.
K.S. Puttaswamy v. Union of India (2017): The Privacy Judgment
This landmark nine-judge bench decision fundamentally transformed Indian constitutional law by recognizing privacy as a fundamental right. Every cyber crime investigator must understand this judgment.
Justice K.S. Puttaswamy (Retd.) v. Union of India
(2017) 10 SCC 1 | 9-Judge Constitution Bench
Context: Challenge to the Aadhaar scheme raised fundamental questions about privacy rights in India.
Issue: Whether the right to privacy is a fundamental right under the Constitution.
Key Holdings
- Privacy is a Fundamental Right under Article 21
- Privacy includes informational privacy (control over personal data)
- Privacy includes decisional autonomy (right to make choices)
- Privacy includes physical privacy (bodily integrity)
- Any restriction on privacy must satisfy the three-fold test:
- Legality (backed by law)
- Legitimate aim (valid state interest)
- Proportionality (no excessive intrusion)
Informational Privacy and Digital Investigations
Justice Chandrachud's lead opinion specifically addressed informational privacy in the digital age:
- Individuals have a right to control their personal information
- The state cannot indiscriminately collect and use personal data
- Any data collection must have a legitimate purpose and be proportionate
- Data minimization principles apply - collect only what is necessary
Scenario: An investigator wants to seize a suspect's mobile phone containing personal photos, messages, and banking apps.
Puttaswamy Application:
- There must be a valid law authorizing the seizure (IT Act/CrPC/BNSS)
- The purpose must be legitimate (investigating a specific offense)
- The scope must be proportionate - if investigating financial fraud, accessing intimate photos may be excessive unless relevant
- Data collected should be limited to what is necessary for the investigation
Shreya Singhal v. Union of India (2015): Free Speech Online
This judgment struck down Section 66A of the IT Act and provided crucial guidance on online speech and intermediary liability.
Shreya Singhal v. Union of India
(2015) 5 SCC 1
Context: Challenge to Section 66A of IT Act following arrests over social media posts critical of politicians.
Key Provisions Examined: Section 66A (offensive messages), Section 69A (blocking), Section 79 (safe harbour)
Key Holdings
- Section 66A struck down as unconstitutional - violates Article 19(1)(a)
- Section 66A was vague and overbroad - terms like "grossly offensive" and "menacing" lacked clarity
- Section 69A upheld with reading down - blocking orders can be issued only when content falls within Article 19(2) restrictions
- Section 79(3)(b) interpreted - "actual knowledge" means knowledge through court order, not mere complaint
- Discussion vs Advocacy vs Incitement distinction recognized - mere discussion/advocacy is protected, only incitement to imminent violence can be restricted
Implications for Investigators
Despite being struck down in 2015, thousands of cases continued to be registered under Section 66A. In 2019 and 2021, the Supreme Court issued strong directions:
- All pending 66A cases must be closed
- Police must be sensitized that 66A cannot be applied
- Any FIR under 66A is void ab initio
Alternative Provisions: For offensive online content, use IT Act Section 67 (obscene material), BNS 351 (criminal intimidation), BNS 356 (defamation), or other specific provisions.
The Discussion-Advocacy-Incitement Test
Shreya Singhal adopted the US approach distinguishing:
- Discussion - Talking about an idea (fully protected)
- Advocacy - Promoting an idea (protected)
- Incitement - Calling for imminent lawless action (can be restricted)
Only incitement to imminent violence can be restricted. Mere offensive or unpopular speech is protected.
The Proportionality Test
Indian courts have adopted a structured proportionality test from German constitutional law. This test is crucial for evaluating the constitutionality of any restriction on fundamental rights.
Four-Pronged Proportionality Test
-
Legitimate Goal
The restriction must pursue a legitimate aim recognized by the Constitution. Examples: national security, public order, prevention of crime. -
Rational Connection (Suitability)
The restriction must be rationally connected to achieving that aim. It must be capable of achieving the stated goal. -
Necessity
The restriction must be necessary - there should be no less restrictive alternative available to achieve the same goal. -
Proportionality Stricto Sensu (Balancing)
Even if necessary, the restriction must be proportionate - the harm caused to the right must not outweigh the benefit gained.
Scenario: Police want to intercept all communications of a suspect in a cyber fraud case.
Proportionality Analysis:
- Legitimate Goal: Yes - investigating financial crime
- Suitability: Yes - interception can yield evidence
- Necessity: Question - can evidence be obtained through less intrusive means (bank records, CDR analysis)?
- Proportionality: Total interception of ALL communications may be disproportionate - should be limited to communications related to the offense
Surveillance and Interception: Constitutional Limits
Surveillance powers under IT Act Section 69 must operate within constitutional limits established by the Supreme Court.
People's Union for Civil Liberties v. Union of India
(1997) 1 SCC 301 (Telephone Tapping Case)
Issue: Constitutional validity of telephone tapping under Telegraph Act.
Key Safeguards Mandated
- Authorization only by Home Secretary at Central/State level
- Recording of reasons in writing
- Time limit on interception (initially 2 months, extendable)
- Review Committee to examine necessity
- Interception orders cannot be open-ended
- Copies to be destroyed after relevant period
Anuradha Bhasin v. Union of India
(2020) 3 SCC 637 (Internet Shutdown Case)
Context: Challenge to prolonged internet shutdown in Jammu & Kashmir.
Key Holdings on Digital Rights
- Internet access is a constitutional right (implied from Article 19)
- Internet shutdown orders must be published
- Suspension must be temporary, not indefinite
- Must satisfy proportionality test
- Orders must be subject to judicial review
- Blanket shutdown is disproportionate - less restrictive alternatives must be considered
Procedural Safeguards for Interception (IT Act Rules)
The IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 mandate:
- Written order by competent authority (Home Secretary level)
- Specific reasons recorded in writing
- Review by Review Committee within 7 days
- Maximum duration of 60 days (extendable up to 180 days)
- Records maintained for destruction after use
- Strict confidentiality obligations
Article 20(3): Protection Against Self-Incrimination
Article 20(3) states: "No person accused of any offense shall be compelled to be a witness against himself." This has important implications for digital investigations.
Selvi v. State of Karnataka
(2010) 7 SCC 263
Issue: Constitutionality of narco-analysis, polygraph, and brain-mapping tests.
Key Holdings
- Involuntary administration of such tests violates Article 20(3)
- Protection extends to testimonial compulsion
- Right against self-incrimination includes right to remain silent
- Compelled disclosure of personal knowledge is prohibited
Contentious Issue: Can an accused be compelled to disclose passwords or encryption keys?
Arguments against compulsion:
- Password is "testimony" in the accused's mind
- Disclosure would be testimonial compulsion
- Violates Article 20(3)
Arguments for compulsion:
- Password is like a key to a locker - can be compelled
- Not "testimonial" in nature
- Similar to providing fingerprints or DNA
Current Position: No clear Supreme Court ruling on digital passwords. Investigators should obtain passwords through other means (technical, consent) rather than compulsion to avoid constitutional challenges.
Other Relevant Constitutional Provisions
Article 19(1)(a): Freedom of Speech and Expression
- Includes right to receive and impart information
- Extends to internet/digital communication
- Can only be restricted under Article 19(2) grounds
- Blocking/takedown must meet proportionality standards
Article 19(2): Reasonable Restrictions
Free speech can be restricted only on grounds of:
- Sovereignty and integrity of India
- Security of the State
- Friendly relations with foreign States
- Public order
- Decency or morality
- Contempt of court
- Defamation
- Incitement to an offense
Article 22: Protection Against Arbitrary Arrest
- Right to be informed of grounds of arrest
- Right to consult legal practitioner
- Right to be produced before magistrate within 24 hours
- Applies equally to cyber crime arrests
- Privacy is a fundamental right under Article 21 (K.S. Puttaswamy)
- Section 66A is unconstitutional - never apply it (Shreya Singhal)
- Any restriction on rights must pass the four-pronged proportionality test
- Surveillance powers have procedural safeguards that must be followed
- Internet access is a constitutional right (Anuradha Bhasin)
- Compelled password disclosure may violate Article 20(3) - avoid compulsion
- Investigative actions must be lawful, necessary, and proportionate
- Evidence obtained in violation of constitutional rights may be inadmissible