How the Right to Privacy Became Part of Article 21 — and What It Means Today

Opening

A woman discovers her employer has installed tracking software on her office laptop. A citizen is asked to link Aadhaar to a bank account, a SIM card, a school admission form. A journalist's phone is allegedly targeted by spyware. A same-sex couple wants the state to stay out of their bedroom. None of these situations look alike on the surface, but each one is litigated today using the same constitutional vocabulary: the right to privacy under Article 21. That this is even possible is a relatively recent development in Indian constitutional law, and understanding how it came about explains a great deal about how courts read the Constitution more generally.

What happened

Contemporary explainers on the right to privacy — including recent overviews aimed at students and citizens — trace a doctrine that has moved in three distinct phases: an early phase in which the Supreme Court refused to recognise privacy as a fundamental right at all, a middle phase in which smaller Benches carved out narrow, fact-specific protections without disturbing the earlier precedent, and a final phase in which a nine-judge Bench of the Supreme Court authoritatively declared privacy to be an intrinsic, inalienable part of the right to life and personal liberty under Article 21. That 2017 declaration did not arise from an abstract question; it arose in the course of examining the constitutional validity of the Aadhaar scheme, when the government argued that privacy was not a fundamental right at all — a position it was forced to take because two earlier decisions, from the 1950s and 1960s, had said exactly that. The Bench rejected that argument and, in doing so, formally overruled the older judgments. What is being reported now, across law-explainer and review pieces, is essentially this settled doctrine being revisited in light of newer pressures — data protection legislation, biometric mandates, and surveillance technology — that test how far the right actually extends in practice.

The law behind it

Article 21 is the constitutional anchor: \"No person shall be deprived of his life or personal liberty except according to procedure established by law.\" For decades this was read narrowly, as a bar only against arbitrary physical detention. The privacy jurisprudence rests on reading \"personal liberty\" expansively enough to include a bundle of related interests — bodily autonomy, informational self-determination, decisional freedom in matters of family and sexuality, and protection from unwanted surveillance. Because Article 21 protections can only be curtailed by a \"procedure established by law\" that is itself fair, just and reasonable, any state action that invades privacy must be backed by a valid law and must meet a standard of proportionality — not merely exist on paper.

Article 14, guaranteeing equality before the law and protection against arbitrary state action, works alongside Article 21 in this analysis: a law authorising intrusion into privacy must not be arbitrary or manifestly excessive relative to its stated purpose. Article 19, protecting freedoms such as speech and movement, is also frequently read in tandem with privacy claims, since surveillance or data collection often chills the exercise of these freedoms even when it does not physically restrain anyone. Together, Articles 14, 19 and 21 are often invoked as a composite \"golden triangle\" test for the constitutionality of privacy-restricting measures.

The enforcement architecture matters just as much as the substantive right. Article 32 allows a citizen to approach the Supreme Court directly for enforcement of fundamental rights, while Article 226 gives the High Courts an even wider writ jurisdiction to do the same. Without these remedies, a declared right to privacy would have no teeth. Article 12 defines \"the State\" for the purposes of Part III, which matters because privacy claims against government bodies, statutory corporations and instrumentalities of the state are actionable in a way that purely private disputes are not (though tort and contract law, and now data protection legislation, increasingly fill that private-sector gap). Article 13 is the provision that gives fundamental rights their bite against legislation: any law inconsistent with, or in derogation of, Part III rights is void to that extent — meaning a statute authorising disproportionate surveillance or data collection can itself be struck down. Finally, Article 141, which makes the law declared by the Supreme Court binding on all courts, is what allowed the 2017 nine-judge Bench to definitively displace the older precedents and settle the law for every court in the country going forward.

How we got here

The doctrinal starting point was unfavourable to privacy. In the 1950s, an eight-judge Bench considering the validity of search-and-seizure provisions held that the Constitution contained no express guarantee of a right to privacy comparable to the American Fourth Amendment, and declined to read one in. A few years later, a six-judge Bench upheld a police regulation permitting surveillance of habitual offenders, again on the footing that no independent fundamental right to privacy existed under Part III, although it did strike down the specific practice of nocturnal domiciliary visits as an unreasonable restriction on personal liberty. These two decisions, delivered by Benches larger than most that followed, effectively closed the door on privacy as a distinct constitutional right for decades.

Smaller Benches nevertheless found ways to protect privacy interests without confronting this precedent head-on. Cases dealing with prisoners' rights, the confidentiality of personal information published without consent, and telephone tapping recognised privacy-adjacent protections as flowing from Article 21's guarantee of personal liberty, treating them as narrower, fact-specific extensions rather than a freestanding right. This produced an uncomfortable inconsistency: courts were protecting privacy in practice while formally denying, on paper, that any general right to privacy existed.

That contradiction came to a head when the Aadhaar biometric identity scheme was challenged. The government's defence rested partly on the argument that since no fundamental right to privacy had ever been recognised by a Bench as large as the ones that had rejected it, individuals had no constitutional standing to object to mandatory biometric collection on privacy grounds. To resolve this foundational question, a nine-judge Bench was constituted specifically to decide whether a right to privacy exists under the Constitution at all. It held unanimously that it does — as an intrinsic and inseparable part of the right to life and personal liberty under Article 21, as well as flowing from the freedoms guaranteed under Article 19 and the dignity of the individual reflected in the Preamble. In doing so, it expressly overruled the two earlier decisions insofar as they held to the contrary. Only after this foundational point was settled could the Aadhaar case proceed to examine whether the specific scheme's provisions passed the proportionality test that privacy now demanded.

What it means in practice

For an ordinary citizen, the practical effect is that any government programme requiring the collection of biometric, financial, health or location data must now be backed by a valid law and must satisfy a proportionality standard: a legitimate state aim, a rational connection between the measure and that aim, no less intrusive alternative reasonably available, and a fair balance between the individual's rights and the state's interest. This is why data protection legislation enacted after 2017 speaks the language of consent, purpose limitation and data minimisation — these are, in effect, statutory attempts to operationalise the constitutional proportionality test. Bodily autonomy claims — from reproductive choice to the decriminalisation of consensual adult conduct — likewise now draw directly on the privacy-as-dignity reasoning of this doctrine rather than on scattered, older precedents.

For law students and UPSC or judiciary aspirants, this history is a compact case study in constitutional interpretation itself: how the size of a Bench affects precedential weight, how Article 141 operates to bind subsequent courts, how apparently settled precedent can be revisited and overruled by an equal or larger Bench, and how a single doctrinal question (does privacy exist as a right?) can be a threshold issue on which an entire regulatory scheme's fate depends. It is also a useful illustration of the \"golden triangle\" of Articles 14, 19 and 21 working together, rather than any one article operating in isolation.

What to watch

The doctrine's foundational question is settled, but its application is not. Courts continue to work out how the proportionality standard applies to specific technologies — facial recognition, communication interception, data-sharing between government departments, and private-sector data practices under new legislation. Ongoing and future litigation is likely to test how strictly the \"necessity\" and \"least intrusive means\" limbs of the proportionality test are enforced against the state, and how far privacy protections extend against private corporations rather than only against government action. Readers should treat any claim about a specific pending case's outcome with caution; what is certain is that the analytical framework — legality, legitimate aim, necessity and proportionality — will remain the starting point for every such dispute.