Personal Data Sharing Boundaries: Legal Framework and Case Laws

1. Introduction

Personal data sharing boundaries refer to the legal and ethical limits governing the collection, disclosure, transfer, access, and reuse of information relating to an identifiable individual. Such information may include names, addresses, contact details, financial records, medical histories, biometric identifiers, location information, employment records, online activity, and personal communications.

Personal data sharing is necessary for healthcare, employment, banking, education, public administration, and digital services. However, unrestricted sharing can result in identity theft, profiling, discrimination, surveillance, reputational harm, and loss of individual autonomy.

Under Indian law, the principal constitutional foundation is the right to privacy recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). Statutory obligations may arise under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, applicable rules, sector-specific legislation, and contractual obligations.

The fundamental principle is that possession of personal information does not automatically confer unrestricted authority to disclose or exploit it.

2. Meaning and Classification of Personal Data Sharing Boundaries

A. Consent-based boundaries: Information should be processed within the scope of applicable consent or another legally recognised basis. Consent to one purpose does not automatically authorise unrelated disclosures.

B. Purpose limitation: Data collected for payroll administration, medical treatment, or customer service should not automatically be repurposed for advertising, employee profiling, or unrelated commercial activities.

C. Confidentiality boundaries: Employers, healthcare providers, financial institutions, and professional advisers may have legal, contractual, or professional duties restricting disclosure.

D. Third-party sharing: Transferring information to affiliates, advertisers, analytics providers, cloud platforms, or contractors raises questions concerning lawful authority, safeguards, and responsibility.

E. Sensitive information: Medical, biometric, financial, and intimate information may create heightened privacy risks and may be subject to additional statutory or professional protections.

F. Cross-border transfers: International transfers can raise questions about applicable data-protection requirements, government access, security safeguards, and jurisdiction.

G. Public disclosure: Information already available publicly does not necessarily lose all privacy protection. Context, reasonable expectations, the nature of the information, and applicable law remain relevant.

3. Applicable Legal Framework in India

3.1 Constitutional right to privacy

Article 21 of the Constitution protects life and personal liberty, including the right to privacy. Articles 14 and 19 may also be relevant, depending on the nature of the interference and the rights involved.

Government restrictions on privacy must satisfy the applicable constitutional standards. Under Puttaswamy, the legality, legitimate aim, and proportionality of state interference are central considerations.

3.2 Digital Personal Data Protection Act, 2023

The DPDP Act establishes a statutory framework for processing digital personal data within its scope. Its provisions address consent, certain legitimate uses, notice, data-fiduciary obligations, individual rights, security safeguards, and regulatory enforcement.

The Act also regulates certain processing outside India and permits specified cross-border transfers subject to applicable restrictions. It is important to distinguish enactment from commencement: the operative provisions and applicable rules must be checked against their commencement notifications for the relevant date.

3.3 Information Technology Act, 2000

Section 43A historically addressed compensation for specified failures by body corporates to protect sensitive personal data or information. Its present operation must be considered in light of subsequent amendments and the DPDP Act's commencement and repeal provisions. Section 72A addresses disclosure of personal information in breach of lawful contractual requirements, subject to its statutory elements.

Other sector-specific requirements may govern banking information, medical confidentiality, telecommunications, insurance, and professional relationships.

4. Important Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Court: Supreme Court of India.

Facts and decision: A nine-judge Constitution Bench considered whether privacy is protected as a fundamental right under the Constitution. The Court unanimously recognised privacy as an intrinsic part of life, personal liberty, and the freedoms guaranteed by Part III.

Legal principle: Informational privacy is an essential component of individual autonomy and dignity. State interference must satisfy constitutional requirements, including legality, legitimate state purpose, and proportionality.

Relevance: This is the foundational authority for disputes concerning unauthorised sharing of personal data, intrusive profiling, excessive collection, and disclosure by public authorities. It also recognises that privacy concerns can arise from non-state actors.

2. Justice K.S. Puttaswamy (Retd.) v. Union of India (2019) 1 SCC 1

Court: Supreme Court of India.

Facts and decision: The Court examined the constitutional validity of the Aadhaar framework, including the collection and use of identity information and associated privacy concerns. The majority upheld the Aadhaar Act subject to important qualifications and invalidated or restricted certain aspects of the framework.

Legal principle: Large-scale identity-data systems must operate within lawful purposes and constitutional limitations. The collection and use of personal information cannot be justified merely by administrative convenience.

Relevance: This decision illustrates the importance of limiting data use to legally authorised purposes and preventing unnecessary linkage or disclosure of identity information. It is particularly relevant to government databases, biometric information, and identity-verification systems.

3. People's Union for Civil Liberties v. Union of India (1997) 1 SCC 301

Court: Supreme Court of India.

Facts and decision: The case concerned telephone tapping and the invasion of privacy through interception of communications. The Court recognised the privacy implications of telephone conversations and laid down procedural safeguards governing interception under the law then applicable.

Legal principle: Access to private communications is not an unrestricted governmental power. Legal authority and procedural safeguards are necessary to prevent arbitrary intrusion.

Relevance: The judgment is relevant to employee monitoring, interception of communications, access to private messages, and the sharing of communication records. Its original statutory context must be distinguished from the current telecommunications and interception framework.

4. District Registrar and Collector v. Canara Bank (2005) 1 SCC 496

Court: Supreme Court of India.

Facts and decision: The dispute concerned statutory powers permitting inspection and seizure of private account books and documents maintained by a bank. The Court examined the privacy interests associated with financial records and the constitutional limits on intrusive access.

Legal principle: Financial and documentary records can carry legitimate privacy interests. Statutory powers affecting those interests must be interpreted and exercised consistently with applicable constitutional safeguards.

Relevance: This authority is useful when considering disclosure of bank statements, customer databases, transaction histories, and confidential commercial records to public authorities or other third parties.

5. R. Rajagopal v. State of Tamil Nadu (1994) 6 SCC 632

Court: Supreme Court of India.

Facts and decision: The case involved the proposed publication of an autobiography containing information concerning a prisoner and alleged state interference with publication. The Court considered privacy, personal information, and freedom of the press.

Legal principle: The judgment recognised privacy interests in matters concerning an individual's private life while also examining the limits of privacy where public records and legitimate public-interest considerations are involved.

Relevance: It demonstrates that personal information should not be disclosed indiscriminately merely because a publisher, employer, or institution possesses it. At the same time, privacy is not an absolute prohibition on disclosure, particularly where public records or legitimate public-interest considerations are involved.

6. X v. Hospital Z (1998) 8 SCC 296

Court: Supreme Court of India.

Facts and decision: The dispute arose after information concerning an individual's HIV-positive status was disclosed in the context of a proposed marriage. The Court considered medical confidentiality alongside the interests of the prospective spouse.

Legal principle: Medical confidentiality is important but not absolute. Disclosure may be justified in particular circumstances where legally recognised competing interests are sufficiently compelling.

Relevance: This case is significant for hospitals, healthcare professionals, employers, and insurers handling medical information. It illustrates why disclosure decisions must be assessed in context rather than by assuming that confidentiality always prohibits disclosure or that public-health concerns authorise unrestricted sharing.

7. K.S. Puttaswamy v. Union of India (2015) 8 SCC 735

Court: Supreme Court of India.

Facts and decision: In an earlier order in the Aadhaar litigation, the Court considered concerns arising from the collection and use of demographic and biometric information under the Aadhaar scheme and issued interim directions concerning its use.

Legal principle: Personal information collected for a specified public programme should not automatically be used for unrelated purposes. The legal authority for collection, use, and disclosure must be examined.

Relevance: The decision is useful for understanding purpose-specific data handling. However, it was an interim order in the litigation and must be read alongside the later Constitution Bench privacy judgment and the final Aadhaar decision.

5. Practical Tests for Determining Whether Data Sharing Is Lawful

The following framework can help evaluate a proposed disclosure:

Identify the information: Determine whether the data identifies an individual directly or indirectly and whether it contains sensitive or confidential material.

Identify the legal basis: Establish whether processing is supported by valid consent, a statutory requirement, a recognised permitted use, or another applicable legal basis.

Examine the purpose: Determine whether the proposed recipient will use the information for the original or a legally permitted purpose.

Apply necessity and proportionality: Consider whether the same objective can be achieved through less intrusive means or by sharing less information.

Verify the recipient: Establish the recipient's authority, role, security practices, and contractual obligations.

Preserve accountability: Maintain appropriate records of disclosures, access permissions, retention periods, and security incidents.

Provide appropriate remedies: Where legally available, individuals should be able to exercise applicable access, correction, grievance, or other statutory rights.

6. Common Legal Challenges

Personal data-sharing disputes frequently arise from vague consent forms, excessive collection, undisclosed transfers to third parties, employee surveillance, data breaches, and the reuse of information for advertising or profiling.

A further difficulty is that consent does not resolve every legal issue. Consent may be invalid if it fails applicable legal requirements, and other legal restrictions may apply even where consent exists. Conversely, some processing may be permitted without consent under a specific statutory provision.

Organisations should therefore establish clear privacy notices, access controls, documented sharing arrangements, data-minimisation practices, retention policies, and procedures for handling complaints. Individuals should preserve relevant notices, consent records, communications, and evidence of the disputed disclosure.

7. Remedies and Legal Consequences

Depending on the circumstances, unlawful disclosure may lead to regulatory proceedings, statutory penalties, contractual claims, injunctions, constitutional remedies against public authorities, or other relief available under applicable law.

The DPDP Act provides for specified penalties and enforcement mechanisms under its operative provisions. The Information Technology Act and sector-specific laws may also be relevant, depending on the conduct and the applicable statutory framework.

A privacy violation does not automatically entitle every affected person to compensation. The available remedy depends on the legal cause of action, applicable statutory provisions, evidence, jurisdiction, and the nature of the harm.

8. Conclusion

Personal data sharing boundaries protect individual autonomy, dignity, confidentiality, and informational privacy. Indian constitutional jurisprudence, particularly Puttaswamy, establishes that privacy must be balanced against legitimate governmental, commercial, and social objectives within the limits of applicable law.

The seven decisions discussed above address privacy, communications surveillance, financial records, publication, medical confidentiality, and identity-data governance. They do not all directly concern modern commercial data-sharing practices, but together they provide important principles for evaluating disclosure and reuse of personal information.

The governing principle is that personal data should be collected, accessed, disclosed, and reused only within a legally justified framework, with appropriate safeguards and accountability. Lawful data governance requires more than possessing information: it requires a defensible basis for every material use and disclosure.