1. Introduction

Data sharing between agencies refers to the transfer, exchange, or disclosure of information held by one organisation or government authority to another agency for a lawful purpose.

In the modern digital era, government departments, law enforcement agencies, financial institutions, healthcare authorities, and regulatory bodies collect vast amounts of personal information. Sharing such information can improve governance, prevent crime, and provide public services. However, it also creates risks of:

• Unauthorised surveillance
• Privacy violations
• Misuse of personal information
• Data breaches
• Excessive State control

Therefore, the legality of inter-agency data sharing depends upon balancing public interest and individual privacy rights. The Supreme Court has recognised privacy as a fundamental right and has held that collection, use, and disclosure of personal data must satisfy constitutional safeguards.

2. Constitutional Basis of Data Sharing Regulation

Article 21 – Right to Life and Personal Liberty

The right to privacy forms part of Article 21 of the Constitution of India.

Personal information, including:

• Identity details
• Financial records
• Medical information
• Biometric data
• Communication records

falls within the protection of informational privacy.

Any State action involving data sharing must therefore satisfy constitutional requirements.

3. Principles Governing Legality of Data Sharing

(A) Existence of Legal Authority

Data sharing must have a legal basis.

An agency cannot share personal information merely because it considers the sharing useful. There must be:

• Statutory authority,
• Valid regulations,
• Judicial authority, or
• Legitimate government purpose recognised by law.

(B) Legitimate Purpose

The purpose of sharing must be lawful, such as:

• Prevention and investigation of crime
• National security
• Delivery of welfare schemes
• Tax administration
• Public health management

Sharing for unrelated or excessive purposes may violate privacy rights.

(C) Necessity

Only information necessary for achieving the objective should be shared.

For example:

• Sharing a criminal suspect’s identity for investigation may be justified.
• Sharing unrelated personal details of ordinary citizens may not be justified.

(D) Proportionality

Data sharing must not be excessive compared with the objective sought.

The authority must consider:

1. Whether sharing achieves the purpose.
2. Whether less intrusive alternatives exist.
3. Whether the benefit outweighs the privacy harm.

(E) Data Security and Confidentiality

Agencies receiving information must ensure:

• Secure storage
• Controlled access
• Prevention of unauthorised disclosure
• Accountability mechanisms

The Supreme Court has emphasised safeguards relating to security and confidentiality of stored personal information.

4. Legal Framework for Data Sharing in India

1. Information Technology Act, 2000

The Information Technology Act regulates electronic information and provides protection against misuse of computer data.

Important provisions include:

• Section 43A – Compensation for failure to protect data
• Section 72 – Breach of confidentiality and privacy

2. Digital Personal Data Protection Act, 2023

The Act establishes principles relating to:

• Processing of personal data
• Consent
• Legitimate uses
• Obligations of data fiduciaries
• Protection against misuse

Government processing of data must also operate within statutory limits and constitutional requirements.

3. Right to Information Act, 2005

While promoting transparency, the Act protects personal information from unnecessary disclosure.

5. Types of Agency Data Sharing

(A) Government-to-Government Sharing

Examples:

• Tax authorities sharing information with investigation agencies
• Police sharing criminal records
• Government departments sharing beneficiary databases

Such sharing requires legal authority and safeguards.

(B) Public Agency-to-Private Entity Sharing

Examples:

• Government sharing information with technology providers
• Banks providing information to regulators

This requires stronger safeguards because private entities may use data for commercial purposes.

(C) International Data Sharing

Includes:

• Cross-border crime investigations
• Terrorism prevention
• Financial regulation

Such sharing requires compliance with privacy and security standards.

6. Important Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Facts:

The case concerned whether privacy is a fundamental right under the Constitution and examined issues related to collection and use of personal data under the Aadhaar system.

Judgment:

A nine-judge bench of the Supreme Court recognised privacy as a fundamental right under Articles 14, 19, and 21.

The Court held that any invasion of privacy must satisfy:

1. Legality
2. Legitimate State objective
3. Proportionality
4. Procedural safeguards

Principle:

Government agencies cannot collect, use, or share personal information arbitrarily.

Importance:

This is the foundational case for legality of data sharing in India.

2. K.S. Puttaswamy (Aadhaar) v. Union of India (2018) 1 SCC 809

Facts:

The constitutional validity of the Aadhaar scheme was challenged, particularly regarding collection and sharing of biometric information.

Judgment:

The Supreme Court upheld Aadhaar with limitations but restricted unnecessary use and sharing of Aadhaar data.

The Court emphasised:

• Purpose limitation
• Data security
• Prevention of misuse

Principle:

Even when data collection serves public purposes, sharing must remain limited and proportionate.

3. People’s Union for Civil Liberties (PUCL) v. Union of India (1997) 1 SCC 301

Facts:

The case involved telephone tapping and government interception of communications.

Judgment:

The Supreme Court held that interception of communications affects privacy and must be regulated through safeguards.

Principle:

State access to private information requires procedural protection.

Importance:

The case establishes that government agencies cannot access personal information without lawful safeguards.

4. Selvi v. State of Karnataka (2010) 7 SCC 263

Facts:

The case concerned the use of involuntary narco-analysis, polygraph tests, and brain-mapping techniques during investigations.

Judgment:

The Supreme Court held that forced extraction of personal information violates constitutional protections.

Principle:

Individuals have control over personal information and mental privacy.

Importance:

Data obtained through intrusive methods cannot be freely collected or shared by agencies.

5. Anuradha Bhasin v. Union of India (2020) 3 SCC 637

Facts:

The case concerned restrictions on internet access in Jammu and Kashmir.

Judgment:

The Supreme Court held that restrictions affecting digital rights must satisfy proportionality requirements.

The Court emphasised that State actions affecting digital freedoms must be:

• Lawful
• Necessary
• Proportionate

Principle:

Government control over digital information and communication must remain within constitutional limits.

6. District Registrar and Collector, Hyderabad v. Canara Bank (2005) 1 SCC 496

Facts:

The issue involved government access to bank records without adequate safeguards.

Judgment:

The Supreme Court recognised that financial records contain private information and cannot be accessed arbitrarily.

Principle:

Confidential information held by institutions receives privacy protection.

Importance:

Sharing financial data between agencies requires legal authority and safeguards.

7. Shreya Singhal v. Union of India (2015) 5 SCC 1

Facts:

The case challenged Section 66A of the Information Technology Act, which regulated online communication.

Judgment:

The Supreme Court struck down the provision because it was vague and created excessive restrictions on speech.

Principle:

Digital regulation must be precise and cannot give unrestricted powers to authorities.

Importance:

Data monitoring and information-sharing mechanisms must avoid excessive interference with online freedoms.

7. Circumstances Where Data Sharing May Be Lawful

Data sharing may be justified when:

1. Law Enforcement Purpose

Example:
Police sharing information between agencies for investigation of serious offences.

2. National Security

Sharing may be permitted to prevent threats to national security, subject to safeguards.

3. Public Health Emergencies

Limited sharing may be justified for disease prevention and public safety.

4. Legal Obligations

Agencies may share information when required by statute or court order.

8. Situations Where Data Sharing May Become Illegal

Data sharing may violate law when:

1. There is no legal authority.
2. Information is shared for unrelated purposes.
3. Excessive personal data is transferred.
4. Security safeguards are absent.
5. Information is disclosed publicly without justification.
6. Individuals are subjected to unnecessary surveillance.

9. Balancing Public Interest and Privacy

10. Conclusion

Data sharing between agencies is an essential feature of modern governance, but it cannot operate without legal limitations. The constitutional right to privacy requires that every transfer of personal information must have a lawful basis, serve a legitimate purpose, and remain proportionate.

Indian constitutional jurisprudence, particularly through Puttaswamy, PUCL, Selvi, and Anuradha Bhasin, establishes that personal data is not merely administrative information but an aspect of individual autonomy and dignity.

Therefore, lawful data sharing requires a careful balance: agencies must have enough access to information to perform legitimate functions, while individuals must remain protected from arbitrary surveillance, misuse, and unnecessary disclosure.