Supreme Court seeks Centre's response on pleas challenging data protection law
The Supreme Court has issued notice to the Union government seeking its response on a batch of petitions challenging provisions of the Digital Personal Data Protection (DPDP) Act, 2023, along with the Digital Personal Data Protection Rules, 2025.
The core challenge targets the changes the DPDP Act makes to the Right to Information (RTI) Act, 2005 — specifically the amendment of Section 8(1)(j), the exemption clause for personal information.
Petitioners argue the amendment removes the "larger public interest" safeguard that previously allowed disclosure of personal information when public interest outweighed privacy harm, replacing it with a broader, near-blanket exemption for any information "relating to personal information."
The Court declined to grant an interim stay on the challenged provisions but agreed the matter required substantive consideration.
Section 8(1)(j) of the RTI Act and the DPDP Act's Section 44(3) Amendment
Section 8(1)(j) of the RTI Act, 2005 originally exempted "information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual" — but carved out an exception: such information could still be disclosed if "the larger public interest justifies the disclosure." Section 44(3) of the DPDP Act, 2023 amends this provision, replacing the qualified exemption with a broader clause exempting "information which relates to personal information," dropping the public-interest override.
Key Details
- RTI Act enacted: 2005, flows from the right to know as part of freedom of speech and expression under Article 19(1)(a).
- DPDP Act enacted: August 11, 2023; DPDP Rules notified: November 14, 2025, alongside constitution of the Data Protection Board of India (November 13, 2025).
- Girish Ramchandra Deshpande v. Central Information Commissioner (2012) — Supreme Court held that service and disciplinary records of a public servant are "personal information" exempt under the original Section 8(1)(j) unless a larger public interest is shown — the very balancing test petitioners say the amendment removes.
- Petitioners include RTI activists and press-freedom bodies who argue the amendment allows any public authority to deny information merely by labelling it "personal," even where it concerns misuse of public office or public funds.
The Supreme Court's notice to the Centre signals that the constitutionality of using a data-protection statute to narrow a transparency-law exemption — without retaining a public-interest test — is now a live constitutional question requiring an authoritative response from the Union government.
Right to Information vs Right to Privacy — Balancing Article 19(1)(a) and Article 21
The RTI framework and the right to privacy both derive from fundamental rights but pull in different directions: RTI advances the citizen's right to know (Article 19(1)(a)), while privacy protects individuals from unwarranted disclosure (Article 21). Indian courts have historically resolved this tension through a public-interest balancing test rather than an absolute rule favouring either right.
Key Details
- K.S. Puttaswamy v. Union of India (2017) — a 9-judge bench unanimously held that the right to privacy is a fundamental right intrinsic to Article 21, protected also under Articles 14 and 19; it overruled the earlier M.P. Sharma and Kharak Singh judgments.
- RTI Act, 2005, Section 8(1)(j) (pre-amendment) was the statutory mechanism balancing these two rights on a case-by-case basis via the "larger public interest" test.
- Petitioners contend Section 44(3) tilts this balance entirely toward privacy/data protection, without a proportionality safeguard, contrary to the balancing approach courts have followed.
Because both rights trace to fundamental rights recognised by the Supreme Court itself (Puttaswamy for privacy; earlier RTI jurisprudence for the right to know), the pleas frame the DPDP amendment as disturbing a judicially evolved constitutional balance — which is why the matter has been found to require the Centre's considered response rather than summary dismissal.
- DPDP Act, 2023 enacted: August 11, 2023 (Digital Personal Data Protection Act).
- DPDP Rules, 2025 notified: November 14, 2025; Data Protection Board of India constituted: November 13, 2025.
- Provision under challenge: Section 44(3), DPDP Act, 2023, amending Section 8(1)(j), RTI Act, 2005.
- Removed safeguard: the "larger public interest" override for disclosure of personal information.
- Right to privacy recognised as a fundamental right: K.S. Puttaswamy v. Union of India (2017), 9-judge bench, unanimous.
- Supreme Court action in the present matter: notice issued to the Centre; interim stay declined.