Privacy Still Precarious

In a country where the humble mobile phone serves as the primary gateway to work, banking, social life, identity authentication, and personal memory, a new directive from the Department of Telecommunications had opened an unexpected constitutional debate. The order had required all smartphone manufacturers and importers to pre-install the Sanchar Saathi application on devices sold in India. But on Wednesday, the government withdrew the mandatory requirement after intense public scrutiny and political criticism. The Department of Telecom said it was removing the order following a tenfold jump in voluntary downloads in just one day. “Just in the last one day, 6 lakh citizens have registered for downloading the app, which is a 10x increase in its uptake. Given Sanchar Saathi’s increasing acceptance, the Government has decided not to make the pre-installation mandatory for mobile manufacturers,” the DoT said. The withdrawal, however, does not make the underlying questions vanish. The episode remains a revealing moment in the State’s evolving understanding of its power over personal technology and of how quickly constitutional concerns can rise when the boundary between governance and private digital life begins to blur.

As India enters the third decade of the digital age, the smartphone has evolved into a proxy for the individual. It contains one’s financial records, professional documents, health information, intimate conversations, and personal history. It hosts digital identity, digital payments, and increasingly, digital governance. To mandate that every such device must contain a government-controlled application is not merely a regulatory act. It is a statement of power. Even though the order has now been withdrawn, the fact that such a mandate was issued at all redefines the limits of State intervention in a citizen’s most personal technological environment. It raises urgent questions about legality, proportionality, transparency, and privacy that remain relevant long after the directive has been rolled back.

Telecom fraud is a real and growing threat. India is home to millions of first-generation digital users who fall prey to phishing schemes, malicious calls, SIM swapping, and identity theft every year. The black market for tampered or duplicate IMEI numbers continues to undermine law enforcement efforts. But acknowledging the seriousness of the problem does not absolve the State from meeting constitutional standards. The government’s argument had rested on the premise of public safety, which is no doubt legitimate. However, the legitimacy of purpose does not justify disproportionate means. The original mandate’s sweeping nature, its absence of user consent, and its lack of procedural safeguards set off constitutional alarms that could not be dismissed. That backlash and the rapid withdrawal of the order show that these concerns were neither hypothetical nor exaggerated.

The Sanchar Saathi application itself is not inherently troubling. Its stated functions include verifying the authenticity of a device using its IMEI number, reporting a lost or stolen phone, checking how many mobile numbers are linked to a user’s identity, and accessing authorised customer service contacts of financial institutions. These are useful features. No reasonable observer would argue that combating fraud is undesirable or excessive. The surge in voluntary downloads after public attention proves that citizens are open to tools that help them protect themselves. But constitutional law is not built on whether a tool is useful. It is built on whether a tool respects limits. At its core, the question raised by the original mandate remains: Can the State compel every citizen of a democracy to permanently host a government app on their personal device without consent or an option to remove it? The withdrawal of the order avoids that confrontation for now, but it does not resolve it.

In its landmark judgement in K. S. Puttaswamy (Retd.) v. Union of India, the Supreme Court held that privacy is intrinsic to the values of dignity, liberty, and autonomy. It articulated a four-pronged test for any State action that infringes privacy. There must be a law that authorises the intrusion. The action must pursue a legitimate aim. It must be proportionate, meaning the State must choose the least intrusive method of achieving the objective. And it must contain procedural safeguards to prevent abuse. When assessed against this framework, the now-withdrawn Sanchar Saathi mandate faltered in multiple respects.

The first prong is legality. For an intrusion into personal autonomy as significant as forced software installation, the State must have explicit statutory authority. The directive relied on executive power exercised through departmental rules rather than a specific law enacted by Parliament. Under Puttaswamy, executive notifications without legislative backing cannot justify infringements of privacy. The withdrawal avoids a likely legal challenge, but the constitutional principle remains unchanged: the right to privacy cannot be modified by circulars or administrative convenience.

The second prong is legitimacy, which the government satisfied. Preventing cyber fraud, protecting the integrity of the telecom network, and safeguarding users from identity theft are legitimate State interests. They are not frivolous objectives. The government’s statement that the mandate aimed to reach “less aware citizens” reflects a genuine policy concern. But constitutional scrutiny does not end with legitimacy.

The third prong is proportionality, where the mandate became most vulnerable. The government had not demonstrated that forcing a permanent, non-removable government application onto every smartphone was the least intrusive means of addressing telecom fraud. It had not explained why voluntary installation would not work—a claim now disproven by the very surge in downloads cited to justify withdrawing the mandate. The government itself admits that public acceptance is rising sharply without coercion. This only strengthens the argument that coercive measures were constitutionally unnecessary.

The fourth prong is procedural safeguards. The original directive was silent on critical issues. It did not specify what data the app collects, who has access to it, how long it will be retained, or under what circumstances it can be shared. It did not commit to independent audits, transparency reports, or deletion protocols. These omissions remain unresolved even after the rollback. The controversy triggered by the order shows how essential such safeguards are—especially when opposition leaders warned that the app could be used for snooping, listening to calls, or monitoring messages. Those allegations, even if technically inaccurate, gained traction because the policy lacked clarity.

Beyond the legal analysis lies a broader ethical and political question. What does it mean for a democratic government to place its software inside every citizen’s personal device? What message does it send about the locus of control over technology? Citizens often tolerate digital monitoring from private companies because they retain at least some choice. When the State mandates an app, that choice disappears. Even though the mandate has been reversed, the episode demonstrates how quickly lines can be crossed when digital governance is allowed to expand without constitutional discipline.

In a constitutional democracy, the State must not assume that such intrusion is normal. Digital trust thrives on consent, not coercion. When governments begin to treat smartphones as conduits for public administration rather than private tools owned by individuals, the architecture of liberty weakens. The withdrawal of the mandate is a corrective step, but it should also be a warning about the direction of future policymaking.

Comparisons with global practice remain instructive. No major democracy requires citizens to keep government applications permanently installed on their phones. Even during the COVID-19 pandemic, most democratic governments rejected compulsory digital tools. The brief life of the Sanchar Saathi mandate placed India closer to governance models where civil liberties do not constrain executive power. The rollback pulls India back from that path—but only if the lesson is internalised.

The socio-political risks endure. Once citizens see that the government is willing to issue such a directive, future administrations may feel emboldened to attempt similar measures. Even if no such attempts succeed, the precedent itself is significant. It shifts expectations about the boundary between the State and personal technology.

The economic considerations also remain. Smartphone manufacturers had already begun evaluating compliance. Even a temporarily issued mandate can create uncertainty in a market India hopes to lead globally.

Yet, at the heart of the issue are autonomy, dignity, consent, and the rule of law. The Supreme Court in Puttaswamy affirmed that privacy is central to human dignity. The withdrawal of the mandate acknowledges public discomfort, but it must also prompt a deeper commitment to constitutional restraint in digital policymaking.

The government is justified in wanting to combat telecom fraud. It is not justified in compelling citizens to accept mandatory software. Crime control cannot override constitutional freedoms. Administrative convenience cannot replace democratic accountability. The rapid rollback shows that public oversight, constitutional memory, and civic vigilance still matter.

India stands at a crossroads. It can strengthen digital security through voluntary tools, transparency, and user empowerment. Or it can allow episodic attempts at overreach to accumulate into a new normal. The Puttaswamy judgement affirmed that privacy is at the heart of human dignity. If that principle is to endure, the Sanchar Saathi episode must become a turning point—not an aberration.

Views expressed are personal. The writer is a Delhi-based advocate with a background in law, governance, and public administration