New Delhi: Delivering a significant verdict, the Karnataka high court on March 12 laid down the procedure that an investigating agency must follow to examine the smartphone or email accounts of a person, also holding that action should be taken against investigating officers who leak private data of accused persons to third parties.

According to LiveLaw, the high court held that an investigating officer has “no right” to disclose private data seized from the smartphones or electronic gadgets of an accused to a third party, “without the written permission of the concerned court”. Any investigating officer who leaks private data to a third party should be “proceeded against for dereliction of duty or delinquency”, Justice Suraj Govindaraj said in the order.

However, the court made it clear that using private data that was retrieved during the course of the investigation would not amount to a violation of the right to privacy, as it is covered under the exceptions laid out in the Puttaswamy judgment.

According to LiveLaw, the order said:

“The responsibility of safeguarding the information or data which could impinge on the privacy of the person will always be that of the investigating officer, if the same is found to have been furnished to any third party the investigation officer would be proceeded against for dereliction of duty or such other delinquency as provided.”

The order was delivered by the high court in a petition filed by Virendra Khanna, one of the accused in the Sandalwood drugs case that saw many Kannada actors being called in for questioning. Khanna had challenged the order passed by a Special NDPS Court in September last year, directing him to “cooperate” in the unlocking of his mobile phone, seized by the police. Khanna’s petition described this order as “illegal and abuse of process of law”.

The court noted that held that a search warrant is necessary for the examination of a smartphone, laptop or email account of an accused. A mere order from a trial court to cooperate with the investigation cannot force an accused to disclose the password/passcode of his gadgets, the judge held.

Justice Govindaraj also laid out an elaborate procedure that investigating agencies must follow to examine smartphones or gadgets of an accused. To quote from the order extensively:

“It would be required for the prosecution to approach the Court to seek a search warrant to search the smartphone and or e-mail account. Once a search warrant is issued, it is up to the accused to provide the password, passcode etc.

The investigating agency could also serve a notice on the accused indicating that in the event of the accused not furnishing the said password, passcode, biornetrics etc., an adverse inference would be drawn against the accused as regards the aspects notified in the said notice. The accused can then, in order to avoid the the adverse inference being drawn, furnish the password, passcode or biometrics to the authorities.

In the event of the accused or any other person not providing the password, passcode or biometrics, on an application made by the prosecution, the court could direct the service provider, manufacturer of smartphone and/or e-mail service provider, to open or unlock the smartphone and/or email account to enable access to the said smartphone and/or email account.

In the event of the manufacturer and the service provider not facilitating the opening of the smartphone, ernail account or computer equipment, then the Court on an application being filed in that regard permit the Investigating Officer to hack smartphone and/or email account.

The Investigating agency would be empowered to engage the services of such persons as may be required to hack into the smartphone and or e-mail account and make use of the data available therein, which would be akin to breaking open a lock or door of the premises when the accused were to refuse to co-operate with the Investigating officer and open the door of locked premises.

In the event of the investigating agency is unsuccessful in hacking into the smartphone and or the e-mail account and during the course of such a procedure, if the data on the smartphone and or the e-mail account being destroyed then, the Investigating agency/prosecution would be free to rely upon the notice by which the accused was warned of adverse Inference being drawn.”

The high court partly allowed the petition, setting aside the trial court’s order asking the accused to furnish the password while directing him to cooperate with the investigation. The court said that the investigating officer will have to seek a search warrant as per the above procedure to examine the smartphones/email accounts.

The spirit of the proposed policy change, which looks to provide relief on the AGR front, may conflict with what the letter of the law may dictate and remains a niggling issue. Photo: Reuters

Petitioner’s arguments

According to LiveLaw, senior advocate Hashmath Pasha, appearing for the petitioner, submitted that insisting the petitioner unlock his mobile phone which contains his personal information is violative of the right to privacy.

There is no specific law that enables the taking away of his right to privacy or for a direction to be given by any court either to give the password of his mobile or to unlock the same for the purpose of the investigation.

Since the right to privacy is recognised as a fundamental right under Article 21 of the Constitution, for it to be taken away, there must be a law enacted by parliament, which must meet the test of Article 21 as laid down in the Maneka Gandhi case, that it must be just fair and reasonable not illusory.

The court said technology has become all-pervasive, with smartphones becoming the central device for running the affairs of a person, used to perform a variety of functions, including communication, transactions and storing documents. The court said that a smartphone has “replaced a laptop, which has replaced the office”. The smartphone “by itself is an office for several persons”, the judge observed.

The HC said it cannot “per se issue any directions to the accused to furnish the password, passcode or Biometrics and direction to cooperate”. The method of gathering information and evidence and the “mode and methodology” of an investigation is in the ex-facie domain of the investigation officer, it said.

On the contentions raised by the petition about the right to privacy, the bench observed that once the investigating agency has an access to electronic equipment like smartphones or laptops, the investigating officer has “free access” to all data, not only on the device but also any cloud service that may be connected it. This could include personal details, financial transactions and privileged communications.

It noted that the rules which are applicable to a physical document that could be classified as privileged communication or strictly private and confidential cannot apply to data which is stored on electronic devices, since the investigating officer would have complete access to the data.

The court opined:

“Though such data may not be incriminatory may be very private or secret to the person or such data could incriminate the said person in any particular offence. The use of such data during the course of investigating would not amount to violation of the Right to Privacy and would come within the exceptions carved out in the Justice Puttaswamy’s case. However, the disclosure making public or otherwise in court proceedings would have to be determined by the concerned judge by passing a judicial order (sic).”

The court strictly prohibited the investigating officer from providing these details or data to any third party during the course of investigation without the written permission of the court seized of the matter.

Conducting a polygraph test

The bench also set aside the trial court’s order directing the petitioner to undergo a polygraph test. It said:

“An application if any for such polygraph test has to be served on the said person on whom the polygraph test is to be administered, as also on the lawyer of the said person if so appearing. The effect and impact of the polygraph test and any answers given during the conduct of the polygraph test has to be clearly made known to the said person. The consent in writing to be obtained from such a person before directing the administration of the polygraph test.”

Mere silence of the said person would not amount to consent for the polygraph test. “If a person were to refuse the administration of polygraph test, no such polygraph test could be administered and even if administered, the result of the said test would be void and cannot be considered by a Court of Law,” the judge held.