Application of Justice K.S. Puttaswamy v. Union of India to HR Policies

1. Introduction

The decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 is one of the most important constitutional judgments concerning privacy in India. A nine-judge Bench of the Supreme Court unanimously recognised privacy as a fundamental right protected under the Constitution, particularly through Article 21, and also connected privacy with the freedoms guaranteed under Part III.

Although Puttaswamy arose in the context of the Aadhaar scheme, its principles have substantial implications for the employment relationship and HR policies. Modern employers routinely collect and process employees' personal information—identity documents, bank details, attendance records, medical information, performance data, biometric information, location data, emails and sometimes information about employees' personal activities.

The central HR principle emerging from Puttaswamy is:

An employer should not treat an employee's personal information as unrestricted corporate property merely because the employee works for the organisation.

HR policies must respect privacy, dignity, autonomy, informational self-determination and proportionality.

2. What did Puttaswamy establish?

The Supreme Court held that privacy is a constitutionally protected right and an intrinsic part of life, personal liberty, dignity and freedom. It overruled the contrary understanding contained in M.P. Sharma and Kharak Singh to the extent that those cases denied constitutional protection to privacy.

The judgment recognised several dimensions of privacy, including:

1. Physical privacy
2. Informational privacy
3. Decisional autonomy
4. Privacy of personal choices
5. Privacy of communications
6. Protection of dignity
7. Control over personal information

For HR purposes, the most important aspects are informational privacy and decisional autonomy.

3. Why is Puttaswamy relevant to HR?

The traditional employer-employee relationship involves considerable employer control.

For example, an employer may:

• maintain employee personnel files;
• collect Aadhaar/PAN information;
• record attendance through biometrics;
• monitor official email;
• operate CCTV cameras;
• track company vehicles;
• use GPS or location systems;
• conduct background checks;
• collect medical information;
• evaluate performance;
• monitor computer usage;
• use AI recruitment systems;
• conduct drug or alcohol testing where legally permissible;
• process salary and banking information;
• investigate workplace misconduct.

The existence of an employment relationship does not automatically eliminate the employee's constitutional interest in privacy.

Therefore, an HR policy involving personal information should be examined through principles of legality, legitimate purpose, necessity, proportionality, fairness, transparency and security.

4. The proportionality test and HR policies

One of the most important consequences of Puttaswamy is that a restriction on privacy cannot simply be justified by saying that the employer has a legitimate business interest.

A privacy-intrusive measure should satisfy a constitutional justification framework.

A. Legality

There should be a valid legal or contractual basis for the collection or use of information.

B. Legitimate objective

The employer should identify a legitimate purpose.

For example:

• preventing fraud;
• protecting confidential information;
• ensuring workplace safety;
• complying with statutory obligations;
• investigating misconduct.

C. Necessity

The employer should ask:

Is collecting this particular information actually necessary?

D. Proportionality

The employer should choose a method that does not unnecessarily interfere with employee privacy.

For example, if attendance can be effectively recorded through an ID card, continuous facial recognition or location tracking may require stronger justification.

E. Procedural safeguards

There should be safeguards against:

• unauthorised access;
• disclosure;
• misuse;
• excessive retention;
• discriminatory use;
• unauthorised surveillance.

5. Application to employee data collection

Example

Suppose an organisation asks employees to provide:

• Aadhaar;
• PAN;
• passport;
• bank details;
• emergency contact;
• medical information;
• photograph.

Some information may have a legitimate employment purpose.

However, an HR department should not automatically collect every conceivable piece of personal information simply because it may be "useful".

The Puttaswamy approach encourages purpose limitation and data minimisation.

HR policy should therefore specify:

• What information is collected?
• Why is it collected?
• Who can access it?
• How long will it be retained?
• Whether it will be shared with third parties?
• What security measures apply?
• Whether employees can challenge inaccurate information?

6. Biometric attendance systems

Biometric attendance is particularly relevant after Puttaswamy because fingerprints and facial information are highly personal forms of information.

An employer may argue that biometric attendance:

• prevents proxy attendance;
• improves payroll accuracy;
• increases workplace security.

These may constitute legitimate objectives.

However, HR should still consider:

Is biometric collection necessary and proportionate?

If the same objective can reasonably be achieved through less intrusive means, a blanket biometric system may raise privacy concerns.

The Supreme Court's later Aadhaar judgment also examined the collection, storage and use of demographic and biometric information under the proportionality framework.

7. Employee monitoring and surveillance

Modern HR departments increasingly use:

• CCTV;
• email monitoring;
• keystroke monitoring;
• screenshots;
• productivity software;
• GPS tracking;
• webcam monitoring;
• internet monitoring;
• AI-based productivity assessment.

These policies must be carefully designed.

Example

A company installs software that continuously records everything an employee does on a computer, including:

• websites visited;
• keystrokes;
• screenshots;
• private messages;
• personal browsing.

Even if the employee uses an office computer, unlimited surveillance may conflict with the values of privacy, dignity and autonomy.

A more constitutionally sensitive policy would:

1. clearly inform employees about monitoring;
2. restrict monitoring to legitimate purposes;
3. avoid unnecessary personal information;
4. limit access;
5. establish retention periods;
6. prohibit unrelated secondary use.

8. Recruitment and background verification

Privacy principles are also relevant before employment begins.

Employers may conduct:

• criminal-record checks;
• reference checks;
• educational verification;
• address verification;
• social-media screening;
• financial checks for certain positions.

The question is not simply whether the employer can obtain the information.

The question is:

Does the employer have a legitimate and proportionate reason to obtain and use it?

For example, extensive investigation into an applicant's private life for a position that does not involve sensitive responsibilities could be disproportionate.

9. Medical information and employee privacy

Medical information is highly sensitive.

HR departments may possess information regarding:

• medical examinations;
• disabilities;
• pregnancy;
• mental health;
• medical leave;
• treatment;
• workplace injuries.

Such information should not be unnecessarily disclosed to managers or colleagues.

For example, if an employee requests medical leave, a manager may need to know that leave is authorised, but may not necessarily need access to the employee's complete medical history.

This reflects the Puttaswamy emphasis on dignity and informational privacy.

10. Sexual orientation and personal choices

Puttaswamy also strengthened the constitutional protection of personal autonomy and intimate choices.

This has major implications for workplace policies.

HR policies should not discriminate against employees because of lawful personal choices involving:

• relationships;
• sexual orientation;
• gender identity;
• family arrangements;
• personal lifestyle choices.

This principle was reinforced by subsequent Supreme Court decisions.

11. AI-based HR decision-making

The Puttaswamy principles are particularly relevant to modern AI-driven HR.

Employers increasingly use algorithms for:

• recruitment;
• employee ranking;
• performance assessment;
• promotion;
• attrition prediction;
• disciplinary risk assessment.

Suppose an AI system collects thousands of pieces of employee information and generates a "risk score".

The employer should consider:

• What data is being used?
• Was the employee informed?
• Is the data accurate?
• Is sensitive information being used?
• Is there algorithmic discrimination?
• Can the employee challenge the decision?
• Is human review available?
• Is the amount of data proportionate to the purpose?

A privacy-compliant HR policy should not allow opaque and unlimited employee profiling.

12. Social-media monitoring

Employers increasingly examine employees' social-media activities.

However, there is an important distinction between:

professional misconduct affecting employment and lawful private conduct.

For example, an employer may legitimately investigate a public post involving:

• disclosure of confidential information;
• threats against colleagues;
• serious workplace harassment;
• misuse of company information.

But an HR policy that attempts to control every aspect of an employee's private life may interfere with autonomy and decisional privacy.

13. Six important case laws

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

Importance

This is the foundational case.

The nine-judge Bench held that privacy is a fundamental right protected by the Constitution and recognised privacy as closely connected with dignity, liberty and autonomy.

HR application

HR policies concerning:

• employee databases;
• surveillance;
• biometric attendance;
• medical records;
• employee monitoring;
• personal information

must respect the employee's privacy interests.

Case 2: K.S. Puttaswamy (Aadhaar) v. Union of India, (2018) 8 SCC 1

This case concerned the constitutional validity of the Aadhaar framework.

The Supreme Court considered whether the collection and use of demographic and biometric information satisfied constitutional privacy requirements. The judgment applied the proportionality framework developed after Puttaswamy.

HR application

Where employers collect:

• Aadhaar information;
• fingerprints;
• facial recognition data;
• biometric attendance information,

they should establish a legitimate purpose and appropriate safeguards.

Principle: Personal information cannot be collected indiscriminately merely because technology makes collection possible.

Case 3: National Legal Services Authority v. Union of India, (2014) 5 SCC 438

Principle

The Supreme Court recognised the importance of gender identity, dignity and personal autonomy.

HR application

HR policies should respect employees' gender identity and should avoid discriminatory treatment in:

• recruitment;
• workplace facilities;
• employment records;
• dress policies;
• promotions;
• benefits;
• workplace conduct.

The case is important because privacy is not merely about secrecy—it is also about the ability of an individual to live with dignity and exercise personal identity.

Case 4: Navtej Singh Johar v. Union of India, (2018) 10 SCC 1

The Supreme Court recognised constitutional protection for sexual orientation and personal autonomy.

The decision built upon the constitutional values of privacy, dignity, equality and individual choice.

HR application

An employer should not have policies that discriminate against employees because of their sexual orientation.

It also supports a broader principle:

HR policies should regulate legitimate workplace conduct rather than unnecessarily regulate employees' private lives.

Case 5: Joseph Shine v. Union of India, (2019) 3 SCC 39

The Supreme Court invalidated the criminal offence of adultery under Section 497 IPC.

The judgment emphasised:

• individual autonomy;
• dignity;
• equality;
• decisional privacy.

HR application

Employers should be cautious about excessively intrusive policies concerning employees' private relationships.

An organisation may regulate workplace misconduct, conflicts of interest or harassment, but a general HR policy should not unnecessarily police lawful private relationships.

Case 6: Suchita Srivastava v. Chandigarh Administration, (2009) 9 SCC 1

The Supreme Court recognised the importance of reproductive autonomy as part of personal liberty.

HR application

HR policies concerning:

• pregnancy;
• maternity;
• reproductive choices;
• medical information;
• leave;
• workplace benefits

should respect employee autonomy and dignity.

The employer's interest in workplace administration cannot automatically override an employee's fundamental personal choices.

Case 7: People's Union for Civil Liberties v. Union of India, (1997) 1 SCC 301

The Supreme Court recognised privacy interests in the context of telephone communications and held that telephone tapping cannot be carried out arbitrarily.

HR application

The principle is highly relevant to:

• employee telephone monitoring;
• email monitoring;
• workplace communications;
• electronic surveillance.

An employer should have clearly defined purposes and safeguards before monitoring employee communications.

14. Summary table of the cases

15. Application to specific HR policies

A. Recruitment policy

Problem: Collecting excessive personal information from applicants.

Puttaswamy approach: Collect only information reasonably connected with the recruitment purpose.

B. Employee monitoring policy

Problem: Continuous monitoring of every employee activity.

Puttaswamy approach: Monitoring should have a legitimate purpose and should be proportionate.

C. Biometric attendance policy

Problem: Mandatory fingerprints or facial recognition for all employees without examining alternatives.

Puttaswamy approach: Employer should justify necessity and implement strong safeguards.

D. Medical-information policy

Problem: Medical reports accessible to all HR personnel and managers.

Puttaswamy approach: Access should be restricted to persons who genuinely need the information.

E. Social-media policy

Problem: Employer attempts to regulate employees' entire private online lives.

Puttaswamy approach: Distinguish legitimate workplace concerns from protected private activity.

F. AI recruitment policy

Problem: AI collects and analyses extensive personal information without transparency.

Puttaswamy approach: Require legitimate purpose, proportionality, safeguards and meaningful human oversight.

G. CCTV policy

Problem: Cameras placed in highly private areas.

Puttaswamy approach: Surveillance must respect bodily privacy and dignity. Cameras in places such as toilets or changing areas would ordinarily raise extremely serious privacy concerns.

16. Privacy notices in HR policies

A good HR privacy policy should explain:

1. What data is collected

For example:

• name;
• contact information;
• salary information;
• attendance;
• identification information.

2. Why it is collected

The organisation should state the purpose.

3. Who can access it

Access should be limited according to role and necessity.

4. How long it will be retained

Information should not be retained indefinitely without justification.

5. Whether it is shared

Employees should know whether information is shared with:

• payroll providers;
• insurers;
• background-check agencies;
• government authorities;
• technology vendors.

6. Security

The organisation should maintain reasonable safeguards against:

• hacking;
• unauthorised access;
• accidental disclosure;
• internal misuse.

17. Consent is not always enough

An important point for HR is that employee consent should not be treated as a universal solution.

There is often an unequal bargaining relationship between employer and employee.

If an employer says:

"Give consent to unlimited monitoring or you cannot work here",

the formal existence of consent does not automatically make every intrusive practice constitutionally reasonable.

The Puttaswamy framework requires attention to legality, legitimate purpose and proportionality, rather than relying solely on a consent form.

18. Employer's legitimate interests vs employee privacy

Privacy does not mean that an employer can never monitor employees.

There are legitimate organisational interests, such as:

• prevention of fraud;
• cybersecurity;
• protection of trade secrets;
• workplace safety;
• prevention of harassment;
• compliance with law;
• investigation of misconduct.

The legal question is therefore not:

"Privacy or employer interest?"

Instead, the question is:

"How can the legitimate employer objective be achieved while interfering with employee privacy as little as reasonably possible?"

This is the essence of proportionality.

19. Practical HR compliance checklist

An organisation implementing Puttaswamy-compliant HR policies should consider:

Before collecting information:

• Is collection legally permitted?
• What is the specific purpose?
• Is the information necessary?
• Can the same objective be achieved with less information?

During processing:

• Who has access?
• Is the information secure?
• Is it being used for another purpose?
• Is automated profiling occurring?

After processing:

• How long is the information retained?
• Can unnecessary information be deleted?
• Is third-party sharing controlled?
• Can employees raise privacy complaints?

20. Constitutional significance for employment law

The broader significance of Puttaswamy is that it changes the understanding of an employee from merely being a worker subject to managerial control to being a constitutional rights-bearing individual.

Employment contracts and HR policies therefore operate within a broader legal environment consisting of:

• Article 14 — equality and non-arbitrariness
• Article 19 — relevant freedoms
• Article 21 — life, liberty, dignity and privacy
• applicable labour legislation;
• contractual obligations;
• data-protection requirements;
• principles of natural justice.

Thus, an HR policy can be commercially useful and still be legally problematic if it is arbitrary, excessively intrusive or disproportionate.

21. Conclusion

Justice K.S. Puttaswamy v. Union of India has profound implications for modern HR management. Its central contribution is the constitutional recognition that privacy is an essential component of dignity, liberty and individual autonomy.

For HR departments, this means that employee information cannot be treated merely as an organisational resource. Policies concerning biometric attendance, employee surveillance, medical records, background checks, AI recruitment, workplace communications, social-media monitoring and employee databases should be designed around legitimate purposes and proportionality.

The most important practical rule is:

An HR policy should collect and use only the personal information reasonably necessary for a legitimate employment purpose, with transparency, security and safeguards against misuse.

Accordingly, Puttaswamy provides a constitutional foundation for developing privacy-respecting, dignity-oriented and proportionate HR policies in India.