Supreme Court is preparing for a major
hearing on the Digital Data Protection Act
Supreme Court has referred petitions challenging the
constitutional validity of the Digital Personal Data Protection Act, 2023, and
its Rules, 2025, to a five-judge Constitution bench. The case is expected to be
heard in March, sparking a significant legal debate in the country regarding
data privacy and digital rights. Petitioners have questioned several provisions
of the Act. They argue that certain sections may violate citizens' fundamental
rights, particularly the right to privacy. Furthermore, some of the powers
granted to the government have been described as overly broad and potentially
abuseable.
More on the News
¨
Core constitutional
challenge: The petitions primarily challenge Section 44(3) of the DPDP Act,
which amends Section 8(1)(j) of the Right to Information (RTI) Act,
2005.Earlier, personal information could be withheld only if disclosure had no
relation to public activity or caused an unwarranted invasion of privacy, with
a public interest override.The amended provision exempts disclosure of
“personal information” without explicitly retaining this balancing test, which
petitioners argue converts a calibrated exemption into an absolute bar.
¨
Petitioners claim this
weakens transparency, undermines participatory democracy, and violates
proportionality principles laid down in the Puttaswamy privacy judgment.
¨
Privacy vs transparency
debate: Petitioners argue the amendment removes the discretion of Public
Information Officers to weigh privacy against the larger public interest.They
contend the change could block access to documents such as asset declarations,
procurement records, and file notings, which often contain personal data but
are crucial for exposing corruption.It is also argued that the provision
extends privacy protections to public officials in a manner that dilutes
accountability under Article 19(1)(a).
¨
Concerns over press
freedom: The petitions warn that journalists may be treated as “data
fiduciaries” under the Act, requiring notice and consent for using personal
data.This could make investigative journalism difficult, especially in cases
involving scams or beneficiaries of public schemes.Non-compliance could attract
penalties of up to ₹250 crore, potentially creating a chilling effect on
public-interest reporting.
¨
Government access to
personal data: Section 36 of the Act, which allows the Union government to seek
data from fiduciaries, has been criticised as vague and overbroad.Petitioners
argue the provision lacks safeguards, independent oversight, or appeal
mechanisms, raising fears of surveillance and threats to journalistic
sources.Rule 23 of the 2025 Rules is also challenged for allegedly enabling
data sharing without adequate transparency.
¨
Independence of Data
Protection Board questioned: The composition of the Data Protection Board of
India has been challenged on the grounds of executive dominance.The appointment
process reportedly involves only government officials and nominees, raising concerns
about impartiality, especially as the State is the largest data collector.
¨
Court’s observations and
next steps: The Court declined to stay the law, stating that interim orders
should not introduce a new regime contrary to Parliament’s intent.It acknowledged
that both privacy and transparency involve fundamental rights and will require
careful balancing by the Constitution Bench.The outcome is expected to shape
how India reconciles the right to information under Article 19(1)(a) with
privacy protections under Article 21.
DPDP Act 2023
¨
DPDP Act is India’s first
comprehensive law for safeguarding the digital personal data of its citizens.
¨ It establishes a legal framework that recognizes both the right of individuals to protect their data and the need for organizations to process that data for lawful purposes.
¨ The Act replaces Section 43A of the IT Act, 2000, and supersedes the SPDI Rules, 2011, making the DPDP Act the primary legal instrument governing digital personal data in India.
