Supreme Court to examine impact of data protection law on RTI, investigative journalism
The Supreme Court is examining petitions challenging provisions of the Digital Personal Data Protection (DPDP) Act, 2023 and its effect on the Right to Information (RTI) Act, 2005
The Court observed that both the DPDP Act and the RTI Act are central legislations and that there is a need to harmonise the two
The Court will examine whether the "restrictive" or "cautionary approach" to sharing personal data under the DPDP Act has the effect of diluting an earlier transparency law
The matter has been referred for detailed constitutional examination, with the Centre asked to respond to the pleas
Section 44(3), DPDP Act, 2023 — Amendment to Section 8(1)(j) of the RTI Act
Section 44(3) of the DPDP Act, 2023 amends Section 8(1)(j) of the RTI Act, 2005, the exemption clause governing disclosure of personal information. This is the specific provision at the heart of the harmonisation dispute the Supreme Court is examining.
Key Details
- The original Section 8(1)(j) of the RTI Act exempted personal information only if it bore no relation to any public activity or public interest, or if disclosure would cause unwarranted invasion of privacy — subject to a proviso that information could still be disclosed if a Public Information Officer (PIO) was satisfied that the "larger public interest" justified it
- After amendment by Section 44(3), the clause has been replaced with a simple blanket exemption for "information which relates to personal information," removing the public-activity test and the larger-public-interest override
- Practical effect: PIOs are no longer required to conduct a proportionality test balancing privacy against public accountability before withholding personal information
- The change is cited as significant for asset disclosures, transfer/appraisal records of public officials, and similar accountability-related RTI requests
The Court's stated concern — whether the DPDP Act's cautionary approach to data-sharing "worked to repeal" earlier transparency legislation — is a direct reference to this dilution of the Section 8(1)(j) public-interest override.
Right to Information Act, 2005
The RTI Act operationalises the fundamental right to information, itself read into Article 19(1)(a)'s freedom of speech and expression by the Supreme Court, by creating a statutory mechanism for citizens to seek information from public authorities.
Key Details
- Enacted 2005; establishes the Central Information Commission (CIC) and State Information Commissions (SICs) as appellate bodies
- Section 8 lists exemptions from disclosure (including Section 8(1)(j) on personal information); Section 8(2) provides a public-interest override for even exempted categories after 20 years in most cases
- Section 4 mandates proactive/suo motu disclosure by public authorities
- Investigative journalism and civil society accountability work rely heavily on Section 8(1)(j) requests for information such as asset declarations, promotions, and disciplinary records of public servants
Petitioners argue the DPDP amendment undermines the RTI Act's core objective of accountability, since a large share of investigative RTI use involves personal information about public officials acting in their official capacity.
Right to Privacy as a Fundamental Right — K.S. Puttaswamy v. Union of India (2017)
The DPDP Act's data-protection framework flows from the Supreme Court's 2017 recognition of privacy as a fundamental right, which now sits in constitutional tension with the RTI Act's transparency mandate.
Key Details
- A nine-judge Constitution Bench in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) held that the right to privacy is a fundamental right protected under Article 21 (and traced also to Articles 14 and 19), overruling the earlier M.P. Sharma and Kharak Singh rulings
- The judgment directed the government to enact a robust data protection law, which eventually resulted in the DPDP Act, 2023
- The current litigation asks the Court to reconcile this privacy right with the Article 19(1)(a)-based right to information — both derived from fundamental rights jurisprudence but pointing in opposite directions on disclosure of personal data
The Court's harmonisation exercise is essentially adjudicating a conflict between two lines of its own fundamental-rights jurisprudence — the Puttaswamy privacy right underlying the DPDP Act, and the Article 19(1)(a)-derived right to information underlying the RTI Act.
DPDP Act, 2023 — Data Fiduciary Obligations and Journalism
A separate concern raised alongside the RTI issue is that DPDP Rules classify certain data processing activities of investigative journalists and media entities as falling under "Data Fiduciary" obligations, exposing them to compliance duties and penalties designed for commercial data processors.
Key Details
- The DPDP Act, 2023 defines a "Data Fiduciary" as any entity that determines the purpose and means of processing personal data
- Penalties under the Act for data breaches can extend up to ₹250 crore for serious violations
- Critics argue that applying commercial data-fiduciary compliance standards to news-gathering activity could have a chilling effect on investigative reporting involving personal data of public interest
This is the second strand of the Court's examination — beyond the RTI amendment, whether treating journalistic data processing on par with corporate data processing restricts investigative journalism's ability to use personal information in the public interest.
- DPDP Act enacted: 2023; RTI Act enacted: 2005
- Provision under challenge: Section 44(3) of the DPDP Act, amending Section 8(1)(j) of the RTI Act
- Constitutional basis: right to information read from Article 19(1)(a); right to privacy read from Article 21 (Puttaswamy, 2017 — 9-judge bench)
- Maximum penalty under DPDP Act for certain data protection violations: up to ₹250 crore
- The petitions have been admitted by the Supreme Court, with notice issued to the Centre