Supreme Court Reshapes the Digital Privacy Doctrine
A unanimous bench has redrawn the contours of informational privacy, holding that consent must be specific, granular, and revocable across all categories of personal data.
A unanimous bench has redrawn the contours of informational privacy, holding that consent must be specific, granular, and revocable across all categories of personal data.
In a decision that will be cited for a generation, the Court has anchored informational privacy firmly within Article 21, but with operational teeth that were previously aspirational. The judgment binds private platforms and the State in equal measure.
The bench distinguishes between transactional consent and continuing consent, signalling that downstream processing — including model training and behavioural analytics — requires fresh, purpose-limited authorisation.
For compliance teams, the immediate work is twofold: re-audit consent receipts and re-architect revocation flows so that withdrawal is not buried behind dark patterns.
The opinion stops short of mandating data localisation, but it leaves the door open for sector regulators to do so where the proportionality test is satisfied.
Key takeaways
- Bundled consent for unrelated data uses is no longer enforceable.
- Data fiduciaries must offer a revocation channel as accessible as the original consent.
- State surveillance triggers a heightened proportionality test going forward.
Never Miss a Critical Legal Update
Get the next issue delivered to your inbox.
More in Case Law
High Court Clarifies Stamp Duty on Digital Instruments
An electronic instrument is liable to stamp duty in the State of execution, not the State where the server is hosted, the Court has held.