Digital Personal Data Protection Act Under Judicial Scrutiny: Privacy vs Transparency Debate Intensifies

Why in the News?

Three PILs have been filed in the Supreme Court challenging the constitutional validity of the Digital Personal Data Protection Act, 2023 (DPDP Act).

The petitioners argue that while the law seeks to protect digital privacy, certain provisions dilute transparency under the Right to Information Act, 2005, restrict investigative journalism, and expand state surveillance powers.

The Supreme Court has admitted the pleas, issued notice to the Centre, and referred the matter to a five-judge Constitution Bench. However, it declined to stay the Act.

1. Privacy vs Transparency: RTI Amendment at the Core

Amendment to Section 8(1)(j) of RTI Act

Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act.

Earlier Position:

• Personal information could be denied only if:
  • It had no relation to public activity, OR
  • It caused an unwarranted invasion of privacy.
• Crucially, disclosure was permitted if a “larger public interest” justified it.

Post-Amendment Position:

• Broad exemption for “information which relates to personal information.”
• Removal of the public interest override.

Petitioners’ Concerns

• Public Information Officers (PIOs) lose discretion to balance privacy and public interest.
• Asset disclosures, tender documents, file notings may become inaccessible.
• Anti-corruption investigations could be hampered.

Critics argue that the amendment converts a qualified exemption into an absolute bar, potentially weakening participatory democracy.

2. Proportionality and the Puttaswamy Doctrine

The petitions rely heavily on the Supreme Court’s 2017 judgment in Justice K.S. Puttaswamy v. Union of India, which recognised privacy as a fundamental right under Article 21.

Proportionality Test Requirements:

1. Legitimate State aim
2. Rational nexus with objective
3. Least restrictive means
4. Procedural safeguards

Petitioners argue that:

• A blanket exemption fails the “least restrictive means” requirement.
• Removing public interest safeguards makes the provision “manifestly arbitrary.”
• It creates an opaque category of information immune from scrutiny.

3. Impact on Journalism: Data Law vs Press Freedom

Journalists as “Data Fiduciaries”

Under the DPDP framework, journalists collecting personal data during investigations may be classified as “data fiduciaries.”

This imposes obligations such as:

• Issuing notices
• Seeking consent
• Ensuring purpose limitation

Practical Concerns

• Seeking consent from subjects under investigation is often impractical.
• Withdrawal of consent may require erasure of data.
• Post-publication verification could be disrupted.

Chilling Effect

• Penalties up to ₹250 crore for non-compliance.
• Fear of sanctions may deter investigative journalism.
• Risk of limiting reporting in matters of public interest.

Petitioners argue this impacts Article 19(1)(a) (freedom of speech and expression).

4. Concerns Over State Power and Surveillance

Section 36: Government Access to Data

Section 36 authorises the Union government to demand information from any “data fiduciary.”

Petitioners claim:

• Provision is vague and overbroad.
• Lacks prior judicial authorisation.
• No independent oversight mechanism.
• No statutory appeal against government orders.

Risks Identified

• Potential for mass data access.
• Possible disclosure of journalistic sources.
• Concentration of power in the executive.

The challenge raises concerns about balancing national security and individual liberty.

5. Independence of the Data Protection Board

The DPDP Act establishes the Data Protection Board of India.

Key Concern:

• Appointment process dominated by executive officials.
• Search-cum-selection committee comprises government secretaries and nominees.

Since the Board performs quasi-judicial functions (adjudication, penalties), critics argue that:

• Executive dominance undermines separation of powers.
• Conflict of interest arises as the State is the largest data collector.
• Regulatory oversight over government actions may be compromised.

Constitutional Issues Involved

• Article 14 – Equality before law
• Article 19(1)(a) – Freedom of speech and press
• Article 21 – Right to privacy
• Doctrine of proportionality
• Separation of powers

Significance of the Case

• Defines the future relationship between privacy and transparency.
• Clarifies limits of executive power in digital governance.
• Impacts RTI jurisprudence and anti-corruption mechanisms.
• Tests institutional independence of regulatory bodies.
• Shapes India’s evolving digital constitutionalism.