Virendra Khanna vs. State of Karnataka: Phone Privacy Ruling

Introduction

Can the police force you to share your phone password, or would that violate your fundamental rights? This question has gained new importance in the digital age, where our devices store every detail of our lives. Recently, two Indian courts had the opportunity to decide whether forcing an accused to reveal a passcode, password, or even biometrics amounts to self-incrimination under Article 20(3) of the Constitution. The rulings highlight the growing tension between investigative needs and the individual’s right against self-incrimination.

The High Court of Karnataka in the case of Virendra Khanna vs. State of Karnataka (2021) that the police cannot directly have access to someone’s phone during the investigation. Permission from the court is required for the same. It was made clear that a court warrant is required, and if the police try to access the phone without having permission it would be considered illegal.

Virendra Khanna vs. State of Karnataka (2021)

Facts of the case

The Bangalore police arrested the petitioner in September 2020 from Delhi. The arrest was made in connection with a 2018 case. The petitioner’s mobile phone was seized by the police. The special court was approached to get an approval and permission for a Polygraphy test because the petitioner had allegedly refused to share the passwords of his email and his phone. 

However, the petitioner claimed that he had already shared the passwords which were required. The permission was given by the Special Court on the request of the police but did not hear the petitioner before giving the approval. The petitioner then asked the court to withdraw the order stating that it violated his right under  Article 20(3) of Constitution. The same was refused by the court, so the petitioner filed a petition in front of the High Court of Karnataka. 

Issues raised in the case of Virendra Khanna vs. State of Karnataka (2021)

  1. Did the trial court’s order violate the appellant’s fundamental right to privacy?
  2. Can an investigating officer legally share an accused’s personal information with someone else without the accused’s consent?

Contention made by the parties 

Contention made by petitioner

  • The petitioner argued that the order given by the court which allowed the police to make the petitioner take a polygraph test was against the Article 20(3) of Indian Constitution. 
  • The right to self discrimination was violated. 
  • It was explained that the test produces physical responses, such as changes in heartbeat and sweating, which occur automatically based on the knowledge of the person being tested. 
  • These responses are involuntary, the person cannot choose to remain silent and may inadvertently give answers that could incriminate them in several crimes.
  • It was further contended that any order which limits personal freedom like forcing someone to take a polygraph test, must have a clear legal backing. 
  • There is no law currently which gives permission to the police or the court to compel a person who is accused to take such a test.
  • The representative of the petitioner also claimed that compelling the petitioner to unlock his mobile and give the password of his email also infringed his right to privacy. 
  • Under Article 21 of the Constitution guarantees right to privacy and any restriction on this right must be backed by legislation enacted by Parliament. 
  • Since no such law exists to authorize the court to demand mobile or email passwords, petitioner asserted that the court’s order was unconstitutional and violated both petitioner’s right to privacy and right to self discrimination. 

Contentions made by respondent 

  • Shri Veerana Tigadi, the public prosecutor, argued that providing passwords does not violate Article 20(3) of the Constitution, which protects against self-incrimination. 
  • He explained that passwords should be treated like physical evidence. Referring to the State of Bombay vs. Kathi Kalu Oghad (1961) case, he stated that being a “witness” is different from providing “evidence.” 
  • Just as fingerprints, signatures, footprints, and handwriting samples are collected for identification purposes, asking for a password is similar and does not involve the accused conveying personal knowledge to the court.
  • Tigadi further noted that the right to privacy, as recognized in the Puttaswamy case, is not absolute and can be restricted if three conditions are satisfied: legality, legitimate interest, and proportionate action. 
  • Legality requires that there must be a law allowing the restriction. Legitimate interest means that the restriction must serve a valid purpose, such as the investigation or prevention of crime. 
  • Proportionate action ensures that the measure taken is reasonable and not excessive in relation to the objective.
  • According to the prosecutor, disclosure of passwords meets all three conditions. There is a legal basis for the order under Section 139 of the Indian Evidence Act and Sections 54A (now Section 54 of Bharatiya Nagarik Suraksha Sanhita, 2023) which empower courts to request evidence or identification, including handwriting, signatures, or documents. 
  • The legitimate interest is satisfied because investigating and preventing crime is a valid purpose of the State. 
  • The action is proportionate because the request is limited to aiding the investigation and does not go beyond what is necessary. 
  • Therefore, the order to furnish passwords is reasonable, narrowly focused, and does not violate the constitutional rights of the accused.

Judgement and analysis in Virendra Khanna vs. State of Karnataka (2021)

Judgement of the case

The High Court said that making an accused share their password or biometric data doesn’t break Article 20(3), because it counts as physical evidence (like fingerprints or handwriting) and not as giving a statement against oneself. It also doesn’t violate the right to privacy, since the law allows it for investigations. The court gave a clear procedure for unlocking devices: first ask the accused, then get court permission, call in experts if needed, and if nothing works, even hack the device with the court’s approval. If this process isn’t followed, it can be held against the accused. In this case, the authorities didn’t follow the proper steps.

Right to self incrimination in the digital age

The High Court ruled that forcing someone to share their mobile phone or email password does not violate Article 20(3) of the Constitution. According to the court, a password is not a personal statement but more like physical evidence similar to giving fingerprints, blood samples, or handwriting. So, asking for a password was seen as legally acceptable.

However, this reasoning has been questioned. A password is not the same as fingerprints or blood samples. Once someone shares their password, it can reveal much more than just access, it shows that the person controls the device and links them directly to whatever evidence is found inside. This creates a “chain of evidence” that the Supreme Court, in the Selvi case, had warned against. For this reason, many believe that the decision of Virendra Khanna was not correct and needs to be reconsidered.

Right to privacy in the digital age

The High Court acknowledged that giving law enforcement access to digital devices could expose a person’s entire life, since these devices hold huge amounts of personal data. But after saying this, the court held that such access would not violate the right to privacy because it fell under certain legal exceptions. It only added that if the police shared this data unlawfully with third parties, penalties could follow.

While investigations may require some compromise on privacy, completely unrestricted access to personal devices takes away this fundamental right. The judgment allowed the police wide powers but failed to provide safeguards like limiting the duration or scope of access. Even though the Court mentioned risks of third-party disclosures, it offered no clear remedies or protections for individuals.

Analysis of the case

In Virendra Khanna vs. State of Karnataka (2021), the Karnataka High Court made a mistake by saying that giving a password to the police is not the same as giving testimony. But the Supreme Court in Selvi vs. State of Karnataka (2010) had already made it clear that if a person is forced to share something from their own mind which could be used against them, it counts as self-incrimination under Article 20(3). A password is not like a fingerprint or a physical document it comes from a person’s own knowledge. Forcing someone to reveal it allows the police to dig into personal data that may be used against them, which is like making the accused a witness against themselves.

Conclusion

The case of Virendra Khanna vs. State of Karnataka (2021) is a significant judgment that deals with the issue of police access to personal electronic devices during investigations. The court recognized that while law enforcement agencies may need information stored on mobile phones or laptops to carry out their work, this cannot come at the cost of an individual’s right to privacy. 

It stressed that proper legal procedures must be followed before compelling someone to unlock or share access to their device. By doing so, the judgment strikes a balance between the requirements of criminal investigations and the protection of personal rights, ensuring that the pursuit of justice does not compromise individual freedoms.

References

Categories

Related Posts

Linkedin-in Instagram Facebook