'Message on salary not political campaign': HC interprets Data Protection Act to dismiss petition on privacy breach

The High Court, which dismissed the petition challenging bulk messaging by the Office of the Chief Minister, relied on section 7 of the Digital Personal Data Protection Act, 2023, to determine how the state is empowered to use data for legitimate purpose. Justice Bechu Kurian Thomas, observed that not all provisions of the act have come into force and some of the crucial provisions of the Act, including section 7 will come into effect only after 18 months from the date of notification i.e. by May 13, 2027.

According to the court, when section 7 comes into force, the state will be able to process personal data of a person, which is available with it, only for the limited purpose for which such data has been given. Since this provision is yet to come into effect, the court placed reliance on another judgment which said that the data which the state has collected has to be utilised for legitimate purposes of the state and ought not to be utilised unauthorizedly for extraneous purposes. This will ensure that the legitimate concerns of the state are duly safeguarded while, at the same time, protecting privacy concerns, according to the previous judgement.

The court then concluded that the WhatsApp message, though sent in the name of the Chief Minister's Office, actually emanated from an official WhatsApp account registered under KSITM (Kerala State IT Mission). KSITM has been appointed as the nodal agency for implementation of SPARK (Service and Payroll Administrative Repository for Kerala) and also manages the State Data centre where SPARK data is also stored. The data so stored by KSITM has been accessed and used for sending the messages. However, there are no materials to assume that the Chief Minister's Office had any access to those data, the judgment said.

The court then deliberated on the nature of message to find out if it was illegitimate. The message in question referred to three informational aspects which are (i) in addition to the 3% DA sanctioned with the February salary, an order has been issued sanctioning the remaining 10%, which has enhanced the DA to a total of 35%, (ii) the initially enhanced 3% DA will reach the employees along with the salary payable in March and the presently enhanced DA of 10% will be disbursed along with the salary of April, and (iii) that the House Building Advance (HBA) has been restored.

The message ends with the closing statement that the Government is always with the recipient to protect the welfare and right of its employees and the said care is a promise which will continue in the days to come.

The HC observed that these messages cannot, by any stretch of imagination, be regarded as a political campaign to impute the message with a colour of illegality or as something done for an illegitimate purpose. The message can hence be regarded as a measure of informing the employees of the Government, the benefits rolled out relating to salary and other perquisites, which can be viewed as a measure of good governance in a social welfare state, the order said.

The HC, however, noted that in the democratic system of governance under the constitution, the Chief Minister is not synonymous with the government. Communications to the public are to be generally made under the identity of the government and not that of the Chief Minister, Justice Bechu Kurian noted in the order. According to the court, the message sent by KSITM informing details about DA and HBA cannot be regarded as violating the right to privacy of the recipients of those message.

The petitioners had alleged that the bulk messaging campaign from the office of the Chief Minister, primarily targeting the state government employees, has been carried out after illegally accessing the personal data of those recipients. According to the petitioners, the data provided for intimating the crediting of monthly salary was used, without their consent, on the eve of the legislative assembly elections, as a measure of election campaign, resulting in an intrusion into the right to privacy of the employees of the state.