"Privacy harms in India today arise less from the State alone than from the interplay of the State, private vendors and online networks." Critically examine.

In K.S. Puttaswamy (2017), the Supreme Court recognised privacy as part of Article 21 and set out a proportionality test for State action [1]. That test was designed for the State acting alone. Today, harm to privacy often travels along a chain that runs from a State camera, to a private server, to an online crowd. The statement is therefore largely valid, though the State remains the pivot of that chain.

Arguments in favour: the harm lies in the interplay

• State and vendor together: a Rajya Sabha MP has challenged the Delhi Police's use of facial recognition, drones and AI smart glasses at Jantar Mantar protests. The petition flags that the data was stored by private companies [2].
• Split accountability: a protester identified by a camera and then doxxed by anonymous accounts must go to three separate bodies of law: constitutional, data-protection and platform/criminal. Each actor can blame another.
• Private-network harms: deepfakes and doxxing violate privacy with no State action at all. Women face higher social costs, which discourages them from protesting.
• Technology amplifies scale: NITI Aayog warns that State use of FRT reduces anonymity in public spaces and can chill free speech [3].

Counter-view: the State remains central

• Legal exemptions: under the DPDP Act, 2023, citizens' rights do not apply to processing for the prevention and investigation of offences. The Centre can also exempt agencies on public-order grounds [1]. Vendors merely process data on the State's behalf.
• No deletion duty: PRS cautions that State exemptions may allow collection and retention beyond what is necessary [1]. This is a harm that comes from the State itself.
• Administrative data: mass revision of databases such as electoral rolls can exclude eligible citizens, and this harm comes from the State alone.
• Legitimate aims: identifying specific offenders is a valid policing goal. The problem is indiscriminate scanning, which fails the necessity test [1].

Way forward

• Narrow the DPDP policing exemption and add retention limits [1].
• Adopt NITI Aayog's FRT framework before deploying FRT at protests [3].
• Disclose vendor contracts publicly and make platforms liable for doxxing.

Privacy harm today is best understood as a system: the State sets its rules, vendors store the data, and online networks spread the harm. Laws built on Puttaswamy's proportionality test, applied across this whole chain, can secure the dignity promised under Article 21 and SDG 16's call for accountable institutions.