Who needs privacy when we have swabhiman

tl;dr 

On November 26, 2024, as all of us celebrated the 75th Constitution Day the Ministry of Culture launched a website encouraging people to upload videos of them reciting the preamble. What many did not realise at the time was that the Constitution 75 website is a privacy minefield. It encouraged Indians to not only upload videos but also made them publicly accessible on the platform, even permitting them to be downloaded. The platform’s Privacy Policy rather than protecting users grants the government unrestricted rights to use the uploaded data. 

Why should you care?

You should care because your personal data—ranging from basic details like your name and address to sensitive content such as photos and videos—could be collected, stored, and shared without your full understanding or explicit consent. The Privacy Policy lacks transparency, leaving unclear how your data will be processed, who will have access to it, and how long it will be retained. Worse, it permits data sharing with law enforcement, government bodies, and third parties, potentially exposing you to privacy violations and misuse. The vague age verification process also raises concerns about the safety of children’s data. In essence, without clear safeguards and accountability, your privacy and control over your personal information are at significant risk.

Background

This year, on Constitution Day, 26th November, India celebrated 75 years of the adoption of its Constitution. Ironically, the government viewed this day as another opportunity to collect sensitive personal information of the citizens. The Ministry of Culture launched a website, inviting citizens to share their videos while reciting the Preamble to win a certificate. Given the history of similar seemingly harmless initiatives that involved excessive data collection, we decided to review this one's Privacy Policy as well. As expected, this too is a massive data collection strategy, lacking adequate safeguards to protect users' right to privacy—guaranteed by the Constitution. Concerningly, the Ministry of Culture boasted of over 3 million people who posted their videos on the website. 

In a recent thread, we raised concerns regarding privacy issues surrounding the Ministry of Culture's initiative and its Privacy Policy. On December 3, 2024, while reviewing the policy, we noticed that it had been updated. However, despite the changes, our concerns remain unresolved. Moreover, we are uncertain whether users were adequately notified about the updates. In this blog, we will analyse both the issues and the changes made to the Privacy Policy.

Recite the Preamble and lose your privacy (?)

While these initiatives may seem well-intentioned, the privacy policies associated with them can sometimes be vague, leaving users unsure about how their data is being handled. In this context, it is essential to scrutinise these policies, especially when they involve sensitive personal information and fail to provide adequate safeguards for privacy. A few of the concerns with the website’s Privacy Policy are enumerated below: 

• Excessive data collection: The Privacy Policy [Clause 2(a)] states that while registering the user will share their personal information including name, date of birth, sex, address, location, etc. This extensive data collection goes beyond what is necessary for the initiative, raising concerns about privacy violations. The objective of collecting such sensitive information is unclear, and without proper safeguards, it increases the risk of misuse, data breaches, or unauthorized access. Alarmingly, the Privacy Policy was updated after November 26, 2024, with significant omissions. The updated version quietly removed references to 'browsing history' and 'nationality,' but most troubling is the vague term 'etc.' at the end. This deliberate ambiguity leaves the door wide open for the collection of an undefined range of personal data, that may include the data they have mentioned in the previous version.

• Third-party cookies: The Privacy Policy [Clause 7(a)]  states that users may encounter cookies from the Ministry of Culture’s affiliates but places the responsibility for third-party cookies entirely on the users, including those set by the Ministry of Culture’s own affiliates. This effectively shifts the risk onto users without offering adequate safeguards. While the policy claims that users can decline cookies if their browser permits it, it also warns that doing so may restrict access to essential website features. This creates a subtle but clear pressure for users to accept cookies, essentially making consent for data tracking indirectly mandatory for a functional and efficient experience on the website.
• Processing of data: The previous Privacy Policy [Clause 2(b)] explicitly stated that user data, including demographics, interests, and behavior, would be used for internal research to better 'cater' to users' preferences. Now, the updated policy has removed this section entirely, leaving no clarity on how this extensive personal data will be processed, stored, or used by the Ministry of Culture. This omission raises serious concerns about transparency and accountability, as users are left in the dark about how their sensitive information may be exploited or shared, further compromising their privacy rights.

• Data retention and data sharing: While the Privacy Policy mentions that uploaded media will be deleted after one year, it fails to provide clarity on broader data retention and deletion practices. Specifically, it does not outline how users can access, correct, or delete their personal data, leaving key privacy concerns unaddressed. More alarmingly, the Ministry of Culture claims the right to share user data with law enforcement agencies, government entities, and third-party rights holders, and in response to court or government orders, all under the pretext of acting in “good faith” and ensuring the "safety" of users. This lack of transparency paves the way for potential privacy violations, misuse, and overreach, as users’ personal information could be accessed and shared without clear consent or oversight. Moreover, the website has made users' uploaded photos and videos publicly accessible, meaning anyone with access to the platform can view, download, or share this sensitive content without restriction.

• Age verification: While the Privacy Policy [Clause 4] states that parental consent is required for minors and that measures will be implemented to verify users’ age and obtain such consent, it provides little detail on how this process will be carried out. The lack of clarity on the mechanisms for obtaining and verifying parental consent raises concerns about the effectiveness of these safeguards. Furthermore, the policy fails to outline any additional protections specifically designed to secure children’s data, leaving vulnerable minors at risk of potential exploitation or misuse. 

The government has consistently launched initiatives such as "Har Ghar Tiranga" and "Hamara Samvidhan, Hamara Swabhiman," which often purportedly aim to foster national pride or enhance civic engagement. Instead of blindly following the trends in the name of nationalism, we need to seriously question why such extensive data is collected without clear and transparent purposes. These programs frequently collect large volumes of sensitive personal information, but the privacy policies associated with them do not adequately address the risks associated with data storage, usage, and sharing. There is little transparency regarding who has access to the collected data, how long it will be stored, or what measures are being taken to ensure that it will not be misused. 

It is well-established that it is the government’s positive obligation to protect fundamental rights as guaranteed by the Constitution. However, ironically, the government is using the 75th anniversary of the Constitution to violate a fundamental right enshrined within it. Autonomy is crucial for people to make their own informed choices, free from unwarranted surveillance or intrusion. By disregarding this principle, the government is paradoxically undermining the very values the Constitution was designed to uphold.

Important documents

1. Updated Privacy Policy [Link]
2. Our analysis of the Har Ghar Tiranga campaign [Link]