1. INTRODUCTION

Public access to sensitive data refers to the availability, disclosure, publication, or unauthorised dissemination of information concerning an individual's private life, health, finances, biometric identity, genetic characteristics, or other confidential matters. Such access may arise through government databases, research repositories, healthcare institutions, employers, digital platforms, or cybersecurity breaches.

Although public access to information promotes transparency, accountability, scientific research, and public participation, unrestricted disclosure of sensitive information can violate privacy, facilitate discrimination, enable identity theft, and cause reputational or financial harm. The legal position therefore requires balancing public interest against confidentiality, individual autonomy, and data protection obligations.

In India, the principal legal framework includes the Constitution of India, the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, applicable rules, and sector-specific legislation. The applicability of particular provisions depends on commencement notifications, implementing rules, exemptions, and the circumstances of disclosure.

2. LEGAL FRAMEWORK

A. Constitutional protection: Article 21 protects life and personal liberty, including the fundamental right to privacy. Article 14 may become relevant where state action involving sensitive data is arbitrary or discriminatory.

B. Digital Personal Data Protection Act, 2023: The Act establishes a framework governing digital personal data processing, including obligations relating to lawful processing, security safeguards, and personal-data breaches, subject to its applicable provisions, commencement, and exemptions.

C. Information Technology Act, 2000: Section 72 addresses breach of confidentiality and privacy by persons who obtain access to information under powers conferred by the Act. Section 72A concerns disclosure of personal information in breach of a lawful contract, subject to its statutory requirements. Section 43A historically addressed compensation for failure by a body corporate to protect sensitive personal data; its current operation must be assessed in light of the DPDP Act's amendment and commencement framework.

D. Right to Information Act, 2005: Section 8(1)(j), as amended, addresses personal information in the context of disclosure under the RTI regime. Requests must be assessed under the applicable statutory text, exemptions, and overriding public-interest considerations.

E. Aadhaar legislation: The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 contains restrictions on disclosure and publication of Aadhaar information, including core biometric information.

3. MAJOR LEGAL IMPLICATIONS

A. Violation of privacy: Unauthorised publication of medical records, genetic information, biometric identifiers, or financial details may infringe informational privacy. Depending on the facts, affected individuals may seek constitutional, statutory, or civil remedies.

B. Data security and organisational liability: Organisations handling sensitive information may face regulatory scrutiny or liability when inadequate safeguards, excessive access permissions, or unlawful disclosure causes harm. Liability depends on the applicable statutory requirements and proof of relevant violations.

C. Discrimination and reputational harm: Disclosure of genetic, medical, employment, or financial information may expose individuals to prejudice, social stigma, insurance-related disputes, or economic disadvantage. Separate anti-discrimination, employment, consumer-protection, or civil-law remedies may apply.

D. Criminal and civil consequences: Depending on the circumstances, unlawful disclosure may attract statutory penalties, compensation claims, contractual remedies, or criminal proceedings. Mere public availability does not automatically establish that information may lawfully be republished or used for any purpose.

E. Public interest and transparency: Public access may be justified where disclosure is authorised by law or necessary to advance a legitimate public interest. However, decision-makers should consider proportionality, necessity, anonymisation, and whether less intrusive disclosure would achieve the same objective.

4. IMPORTANT JUDICIAL PRECEDENTS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) — Direct authority. The nine-judge Supreme Court bench recognised privacy as a fundamental right protected by the Constitution. The judgment provides the principal constitutional foundation for challenging unjustified collection, use, or disclosure of sensitive personal information.

2. K.S. Puttaswamy v. Union of India (Aadhaar judgment, 2018) — Direct authority. The Supreme Court examined the constitutional validity of Aadhaar's collection and use of personal and biometric information. The decision addressed privacy, proportionality, statutory safeguards, and restrictions on information use.

3. R. Rajagopal v. State of Tamil Nadu (1994) — Direct authority. The Supreme Court recognised privacy protections against unauthorised publication of aspects of a person's private life, while considering the distinction between private information and matters legitimately available in public records.

4. District Registrar and Collector v. Canara Bank (2005) — Direct authority on informational privacy. The Supreme Court considered privacy concerns arising from state access to private documents and emphasised the importance of legal safeguards against intrusive access.

5. PUCL v. Union of India (1997) — Analogous authority. The Supreme Court recognised privacy concerns in telephone interception and established procedural safeguards for intrusive surveillance. Its principles are relevant by analogy to government access to sensitive communications and personal data.

6. Kharak Singh v. State of Uttar Pradesh (1963) — Historical and partly analogous authority. The Court examined police surveillance and personal liberty. Its earlier treatment of privacy was subsequently overruled to the extent inconsistent with the constitutional right to privacy recognised in Puttaswamy (2017).

5. PRACTICAL COMPLIANCE MEASURES

Organisations should classify sensitive information, restrict access according to job responsibilities, use encryption and secure authentication, maintain access logs, and establish retention and deletion policies. Before releasing datasets, they should assess re-identification risks rather than assuming that removing names guarantees anonymity.

Data-sharing agreements should specify permitted purposes, confidentiality duties, security standards, breach reporting, and responsibility for onward disclosure. Institutions should also establish procedures for responding to data-subject requests, investigating incidents, and notifying affected persons or authorities where legally required.

6. CONCLUSION

Public access to sensitive data creates a legal conflict between transparency and the protection of individual privacy. Indian constitutional jurisprudence recognises privacy as a fundamental right, while legislation regulates personal-data processing, confidentiality, and particular categories of protected information. The legality of disclosure depends on its purpose, authority, necessity, safeguards, and applicable statutory provisions. Responsible access controls, data minimisation, proportionate disclosure, and effective accountability mechanisms are essential to prevent misuse and protect individual rights.