Personal Data vs Public Interest: The Privacy Dilemma

Q: Consider the following statements regarding the Digital Personal Data Protection (DPDP) Act, 2023: 1. It applies exclusively to digital personal data collected and processed within the geographic territory of India. 2. Appeals against the orders of the Data Protection Board of India lie directly with the Supreme Court. 3. It amends the Right to Information Act, 2005, removing the 'larger public interest' exception for disclosing personal information.

Correct answer: Option 2. Statement 1 is incorrect; the Act applies to data processing outside India if it involves offering goods or services to individuals in India. Statement 2 is incorrect; appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Statement 3 is correct; Section 44(3) alters the RTI Act's public interest provision.

The Supreme Court of India is examining the definition of 'personal data' under the newly implemented Digital Personal Data Protection (DPDP) Act, 2023 and DPDP Rules, 2025. This article delves into the friction between the right to privacy and the Right to Information (RTI), highlighting concerns over government exemptions, press freedom, and the removal of the 'larger public interest' clause.

Personal Data vs Public Interest: The Privacy Dilemma

Introduction

The implementation of the Digital Personal Data Protection (DPDP) Act, 2023 and the corresponding DPDP Rules, 2025 has ignited a significant legal and democratic debate in India. Recently, the Supreme Court agreed to examine the nuanced definition of 'personal data' under this new framework. The core controversy lies in the inherent tension between two fundamental rights: the Right to Privacy and the Right to Information (RTI). Critics and journalists argue that by eliminating the 'public interest' exemption in the RTI Act, the new law may inadvertently shield public officials from accountability, complicating the media's ability to act as a democratic watchdog.

Context & Background

Following the enactment of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, systemic concerns have surfaced regarding the definition and scope of 'personal data.' A petition filed in the Supreme Court highlighted that Section 44(3) of the DPDP Act introduces a sweeping restriction on RTI requests by overriding the phrase 'public interest' found in Section 8(1)(j) of the RTI Act. This has raised alarms that critical information pertaining to public officials could be concealed under the guise of privacy, effectively neutralizing the Right to Information framework. Recognizing the gravity of the clash between these two foundational democratic rights, the Supreme Court has agreed to establish a clear legal boundary separating genuine private data from data that holds public importance.

Key Points

•Amendment to the RTI Framework: Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, effectively removing the 'larger public interest' test. Public authorities can now refuse disclosure of personal information without weighing its public benefit.
•Supreme Court Observations: The Chief Justice stressed the need to maintain an equilibrium between the right to privacy and the right to information, ensuring that data of public officials is appropriately categorized to prevent shielding corruption.
•Exemptions for the Government: The Act grants broad exemptions to notified government agencies for processing personal data on grounds such as national security, sovereignty, and public order, raising concerns over unmonitored state surveillance.
•Protection of Children's Data: The law classifies anyone under 18 as a child, mandating verifiable parental consent for data processing and strictly prohibiting targeted advertising or behavioral monitoring of minors.
•Rights & Duties of Data Principals: Individuals can seek data correction, erasure, and grievance redressal. However, providing false information or filing frivolous complaints attracts penalties up to ₹10,000.

Key Features of the DPDP Act, 2023

Provision	Description	Exemptions/Notes
Applicability	Digital personal data processed in India (or outside if offering goods/services to India).	Does not apply to personal/domestic use or publicly available data.
Consent Framework	Processing requires specific, informed consent; verifiable parental consent for minors.	Waived for legitimate uses like government services or medical emergencies.
Data Fiduciaries	Must ensure data accuracy, security, and erase data after purpose fulfillment.	Significant Data Fiduciaries (SDFs) face strict compliance and independent audits.
Data Protection Board (DPBI)	Monitors compliance, addresses grievances, and imposes financial penalties.	Appeals are filed before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Phased Implementation under DPDP Rules, 2025

Key Milestone	Timeline	Impact
DPBI Setup	Immediate	Institutional provisions establishing the Data Protection Board take effect.
Consent Managers	November 2026	Regulatory framework for Consent Managers becomes operational.
Complete Compliance	May 2027	Deadline for complete operational compliance across all rules and phased rollouts.

Related Entities

Data Protection Board of India (DPBI)
Regulatory Body

Established to monitor compliance, address grievances, respond to data breaches, and impose penalties for DPDP Act violations.

Data Fiduciary
Entity Category

Any organization or entity that determines the purpose and means of processing an individual's personal data.

TDSAT
Appellate Authority

The Telecom Disputes Settlement and Appellate Tribunal acts as the appellate body for decisions made by the DPBI.

Impact & Significance

•Erosion of Transparency: The removal of the 'larger public interest' exception means personal information is broadly exempt from RTI disclosures, undoing decades of transparency gains.
•Impact on Press Freedom: Journalists face immense hurdles in accessing critical, accountability-driven information regarding individuals holding public office, crippling the media's watchdog role.
•Lack of Direct Compensation: Under the penalty-focused framework, fines collected for data misuse are deposited directly into the Consolidated Fund of India, leaving affected individuals without direct financial redress.
•Asymmetry of Power: Citizens and private entities face stringent regulations and severe financial penalties, while the government enjoys sweeping exemptions, granting the State disproportionate power over personal data.

Challenges & Criticism

•Postponed Safeguards: Fundamental privacy protections and user rights are deferred until May 2027, drastically diluting the immediacy of privacy guarantees.
•Questionable Regulatory Autonomy: Positioning the Data Protection Board directly under the Ministry of Electronics and IT raises credible concerns over its functional independence.
•Limited Accountability Mechanisms: The law severely lacks robust provisions for independent security audits, proactive disclosures, and data protection impact assessments.
•Ambiguity in Data Transfers: The adoption of a permissive 'negative list' approach for cross-border data transfers creates acute uncertainties surrounding data sovereignty and international surveillance.

Future Outlook

•Ensure Regulatory Independence: Grant full functional autonomy to the Data Protection Board (DPBI) to enhance its credibility and ensure impartial enforcement away from government influence.
•Rebalance RTI and Privacy: Reinstate the 'larger public interest' criterion within the RTI framework to preserve administrative transparency while protecting genuine personal data.
•Fast-Track Implementation: Operationalize user rights, consent frameworks, and grievance redressal mechanisms immediately, rather than delaying them until the May 2027 deadline.
•Strengthen Data Transfer Norms: Shift from a permissive 'negative list' to adequacy-based standards to tightly regulate cross-border data flows and protect national sovereignty.
•Institutionalize Accountability: Mandate independent audits, data protection impact assessments, and privacy-by-design principles natively for all high-risk data fiduciaries.

UPSC Relevance

UPSC

• GS-II (Polity & Governance): Fundamental Rights (Privacy under Art 21 vs Info under Art 19), e-Governance, and Statutory/Regulatory Bodies.
• GS-III (Internal Security & Technology): Cyber security, data protection frameworks, and cross-border digital sovereignty.
• Essay Topics: 'Data is the new oil: Balancing Privacy and Innovation', 'Transparency vs Privacy in a Digital Democracy'.

Sample Questions

Prelims

Consider the following statements regarding the Digital Personal Data Protection (DPDP) Act, 2023: 1. It applies exclusively to digital personal data collected and processed within the geographic territory of India. 2. Appeals against the orders of the Data Protection Board of India lie directly with the Supreme Court. 3. It amends the Right to Information Act, 2005, removing the 'larger public interest' exception for disclosing personal information.

(a)1 and 2 only
(b)3 only
(c)1 and 3 only
(d)1, 2 and 3

Mains

“The Digital Personal Data Protection Act, 2023 tilts the balance in favour of data privacy at the cost of administrative transparency.” Critically analyze this statement in the context of recent amendments to the Right to Information Act, 2005.

Introduction: Introduce the DPDP Act 2023 as India's first comprehensive data protection law. Mention the SC's ongoing examination of the conflict between personal privacy and the RTI Act.

Body:

• Shift towards Privacy: Discuss Section 44(3) amending Section 8(1)(j) of the RTI Act, which removes the 'larger public interest' caveat. Note the Supreme Court's concerns about shielding public officials.

• Asymmetry and Exemptions: Highlight Section 17 exemptions for state agencies based on sovereignty and public order, creating an asymmetry of accountability between citizens and the state.

• Challenges & Way Forward: Mention delayed safeguards, the lack of DPBI independence, and suggest reinstating the public interest test to harmonize privacy with the right to know.

Conclusion: Conclude that while informational privacy is a fundamental right (Puttaswamy judgment), it must not become a veil to obscure government accountability, necessitating a carefully calibrated legal approach.