The Datafied State and Constitutional Privacy - Reconsidering the Limits of Executive Access to Personal Data in India

Abstract

The expansion of digital governance has transformed the relationship between the Indian State and personal information. Government authorities increasingly collect, store and process identity, financial, biometric, health and behavioural data for welfare administration, taxation, policing and regulatory purposes. While data-driven governance can improve administrative efficiency, it also creates significant constitutional concerns where executive authorities obtain or process personal information beyond the purpose for which it was originally collected. The recognition of privacy as fundamental right under Article 21 has therefore become increasingly significant in determining the limits of State access to personal data. This paper examines the constitutional limitations governing executive access to personal information in India, particularly through the principles of legality, legitimate State purpose, necessity and proportionality. It further examines the Digital Personal Data Protection Act (DPDPA), 2023 and its relationship with constitutional privacy. The paper argues that possession of personal information by the State cannot itself create unrestricted authority to access, combine, analyze or retain that information. A constitutional framework for the datafied State must instead ensure purpose limitation, proportionality, procedural safeguards, accountability and meaningful remedies against unlawful access.