Examine how the growing state–Big Tech nexus in surveillance challenges human rights norms. What lessons does it hold for India's data governance framework?

The UN Guiding Principles on Business and Human Rights (2011) rest on three pillars: the state protects, business respects and victims get a remedy [3]. States now rely more and more on private cloud, analytics and data platforms for surveillance. US Big Tech's contracts with Immigration and Customs Enforcement (ICE) are an example [1]. This nexus strains all three pillars at once.

Challenges to human rights norms

• Due process: In January 2026 the UN human rights chief warned that US enforcement is undermining due process through arbitrary arrests and detentions [2]. A person flagged by a data system cannot question a database the way a lawyer can question a witness.
• Privacy and access to services: Suspected undocumented migrants are surveilled, arrested and detained in hospitals, schools and homes [2]. This keeps vulnerable families away from essential services.
• Family unity and right to life: The UN human rights chief has called for an end to practices that tear families apart and for investigations into rising deaths in ICE custody [2].
• Discrimination: UN Special Rapporteur report A/75/590 (2020) found that digital border technologies have a discriminatory impact on migrants, refugees and stateless persons [4].
• Accountability gap: When the state is the buyer, it has little reason to regulate its own supplier. ICE gained billions of dollars in funding under Trump's second term, and the only pressure left is voluntary: employees, customers and protesters [1].
• The "neutral tool" defence is weak: OHCHR's B-Tech Project says companies are responsible for how their technology is developed, deployed and used [5].

Lessons for India

• Proportionate exemptions: The DPDP Act, 2023 allows the Centre to exempt state agencies. Any such exemption must meet the Puttaswamy (2017) test of legality, legitimate aim and proportionality.
• Impact assessments: India should require human rights impact assessments and due diligence before buying surveillance tools, as OHCHR urges [5].
• Independent oversight: Surveillance by state agencies needs judicial or parliamentary oversight, which the Justice Srikrishna Committee also recommended.
• Corporate due diligence: Indian IT firms that serve foreign governments should build board-level due diligence based on the UNGPs [3]. This would shield them from the reputational backlash US firms now face [1].
• Protect the most vulnerable: Migrants and informal workers need grievance redress and a right to an explanation of automated decisions.

Technology does not carry its own ethics; how it is deployed decides whether it serves security or suppresses rights. India can combine the DPDP Act with proportionality-tested exemptions, rights impact assessments and independent oversight. Doing so would give effect to Article 21, Puttaswamy and SDG 16.10 (protecting fundamental freedoms), and could make India's model a trusted one.