Privacy, data protection and responsible computing notes — Unit 5

In the digital age, 'privacy' is no longer just about hiding secrets; it is about having control over one's personal information. When companies harvest location data, search history, and biometric data to build highly accurate predictive profiles, the balance of power shifts drastically away from the user.

⇒1.1 Privacy as a Fundamental Right (India)

In 2017, the Supreme Court of India delivered a landmark judgment (Justice K.S. Puttaswamy v. Union of India), unanimously declaring that the Right to Privacy is a Fundamental Right guaranteed under Article 21 (Right to Life and Liberty) of the Indian Constitution. This forced the government to begin drafting comprehensive data protection laws.

The European Union's General Data Protection Regulation (GDPR), enacted in 2018, is the most stringent privacy law in the world and serves as the template for global legislation.

⇒2.1 Key Principles of GDPR

• Consent: Must be explicit, informed, and actively given (no pre-ticked checkboxes).
• Data Minimization: Only collect the absolute minimum data required for the specific service.
• Right to Erasure (Right to be Forgotten): Users can demand a company permanently delete all their personal data.
• Right to Portability: Users can download their data in a machine-readable format to move to a competitor.
• Massive Penalties: Fines can reach 4% of a company's global annual revenue.

India's response to the privacy mandate is the DPDP Act (2023). It establishes the framework for processing digital personal data within India, and outside India if it involves offering goods/services to Indians.

⇒3.1 Key Terminology

• Data Principal: The individual to whom the personal data relates (the User).
• Data Fiduciary: The entity determining the purpose and means of processing data (the Company, e.g., Swiggy or Google).
• Data Processor: Any entity processing data on behalf of the Fiduciary (e.g., AWS hosting the database).

The Act mandates that Data Fiduciaries must obtain clear consent, maintain security safeguards, and immediately report data breaches to the Data Protection Board of India.

Privacy by Design (PbD) is an engineering philosophy. It mandates that privacy cannot be an afterthought, a compliance checklist, or a bolt-on feature. It must be embedded into the core architecture of the software from the initial planning phase.

⇒4.1 The Seven Foundational Principles

• 1. Proactive not Reactive; Preventative not Remedial.
• 2. Privacy as the Default Setting (users shouldn't have to navigate menus to protect themselves).
• 3. Privacy Embedded into Design.
• 4. Full Functionality (Positive-Sum, not Zero-Sum; you shouldn't have to trade privacy for security).
• 5. End-to-End Security (Full Lifecycle Protection).
• 6. Visibility and Transparency (Keep it open).
• 7. Respect for User Privacy (User-Centric design).

This final unit bridges ethical duties with massive modern regulatory frameworks.

• The Puttaswamy Judgment: Know this case name. It is the bedrock of modern Indian privacy law.
• DPDP Act Terminology: Be able to clearly distinguish between a Data Principal (User) and a Data Fiduciary (Company).
• GDPR Rights: Memorize the core rights given to users (Erasure, Portability, Informed Consent).
• Privacy by Design: Understand that this means making privacy the default state of the software architecture, rather than an opt-in feature.