Supreme Court Reference on DPDP Act and the Right to Information
The Supreme Court of India has agreed to refer a batch of petitions to a Constitution Bench to examine whether Section 44(3) of the Digital Personal Data Protection (DPDP) Act, 2023 weakens citizens' right to information. The core issue revolves around balancing the fundamental right to privacy against democratic transparency and governmental accountability.
Introduction
Context & Background
Key Points
- •The Core Constitutional Issue: Petitioners argue that Section 44(3) of the DPDP Act creates a blanket prohibition on the disclosure of "personal information" under the RTI Act, effectively using privacy laws to dismantle the right to know.
- •Violation of Fundamental Rights: It is alleged that the DPDP Act violates Article 19(1)(a) by imposing an unreasonable restriction on free speech and the right to information, and Article 14 by equating the privacy of public officials with that of private citizens.
- •Scope of the Constitution Bench: The Bench is expected to clarify the legal meaning of "personal information" in public law, define the constitutional relationship between privacy and transparency, and set permissible limits on data protection.
- •Unguided Discretion: The new framework allegedly grants unguided discretion to the State to deny information, extending the fundamental right to privacy to the government itself, which critics claim is constitutionally impermissible.
- •Justice BN Srikrishna Committee: The foundation of India's data protection regime, this committee was constituted to examine global data protection standards and recommend a comprehensive legal framework for India.
Key Features of the DPDP Act, 2023
| Feature | Description | Bookmark |
|---|---|---|
| Consent-Based Regime | Personal data can be processed only with explicit, informed, and withdrawable consent of the data principal. | |
| Rights of Data Principals | Recognises individual rights such as access to personal data, correction, erasure, and grievance redressal. | |
| Enhanced Child Protection | Mandates parental consent and prohibits data-processing practices that may cause harm to children. | |
| Significant Data Fiduciaries | Empowers the government to classify entities as SDFs, subjecting them to stricter obligations like data audits. | |
| Government Exemptions | Allows limited exemptions for the State for national security, public order, and research purposes. | |
| Cross-Border Data Flow | Permits international transfer of personal data to notified countries with prescribed safeguards. |
Key Provisions of the DPDP Rules, 2025
| Provision Area | Rules & Obligations | Bookmark |
|---|---|---|
| Responsible Data Use | Fiduciaries must implement safeguards. Breaches must be reported to the Data Protection Board within 72 hours. | |
| Consent Managers | Designated entities will assist fiduciaries in collecting user consent in a specified format. | |
| Data Retention/Deletion | Unused data must be deleted. A 48-hour advance notice must be provided to users before deletion. | |
| Parental Consent | Platforms must obtain verifiable parental consent via government-issued identity proof for children. |
Related Entities
Impact & Significance
- •Transparency Deficit: By restricting access to "personal information," investigative journalism, civil society oversight, and citizens' ability to track government misconduct or public asset declarations may be severely curtailed.
- •Strengthened Digital Privacy: Conversely, ordinary citizens gain unprecedented control over their digital footprint, with rights to correction, erasure, and mandatory data deletion upon platform inactivity.
- •State Discretion: The legal shift potentially empowers government entities with broad discretionary power to reject RTI queries by classifying public administrative data as "personal."
Challenges & Criticism
- •The Elimination of Public Interest Override: Critics argue that removing the legal caveat that previously allowed personal data to be disclosed for "larger public interest" fundamentally destroys the core spirit of the RTI Act.
- •Equating Public and Private Lives: Legal scholars argue it is constitutionally flawed to offer the same level of privacy protection to a public official executing state duties as is given to an ordinary private citizen.
- •Administrative Opacity: There is significant concern that Section 44(3) will be weaponized by corrupt officials to shield themselves from public scrutiny, using "privacy" as a legal loophole to deny transparency requests.
Future Outlook
- •Redefining 'Personal Information': The Constitution Bench's ruling will provide a definitive, binding interpretation of what constitutes personal information, particularly regarding public officials and government records.
- •Operationalizing the Data Protection Board: As mandated by the DPDP Rules 2025, the establishment of the Data Protection Board of India will soon enforce the 72-hour breach reporting rule and oversee compliance.
- •Future of Transparency Laws: The verdict will shape the future trajectory of the RTI Act, dictating whether India leans toward a secrecy-first or transparency-first administrative regime.
UPSC Relevance
- • GS-2 (Polity & Governance): Transparency and accountability, Right to Information (RTI), e-governance, and legislative frameworks.
- • GS-2 (Constitution): Fundamental Rights (Article 19(1)(a) vs Article 21 Right to Privacy), functioning of the Judiciary and Constitution Benches.
- • GS-4 (Ethics): Probity in governance, information sharing, and transparency in government.
- • Essay Topics: The conflict between digital privacy and democratic transparency.
Sample Questions
Prelims
With reference to the Digital Personal Data Protection (DPDP) framework in India, consider the following statements: 1. The DPDP Act, 2023 provides absolute exemptions to the government from all data protection obligations. 2. Under the DPDP Rules, 2025, data fiduciaries must report a data breach to the Data Protection Board within 72 hours. 3. The Justice BN Srikrishna Committee laid the foundational framework for India's data protection regime. Which of the statements given above is/are correct?
1. 1 and 2 only
2. 2 and 3 only
3. 1 and 3 only
4. 1, 2 and 3
Answer: Option 2
Explanation: Statement 1 is incorrect because the DPDP Act, 2023 allows only *limited* exemptions for the State in the interests of national security, public order, and research, not absolute exemptions. Statements 2 and 3 are correct as per the DPDP Rules 2025 and the history of the legislation.
Mains
“The Digital Personal Data Protection (DPDP) Act, 2023, while securing informational privacy, risks diluting the transparency envisioned by the Right to Information (RTI) Act, 2005.” Discuss the constitutional arguments surrounding this debate in light of the recent Supreme Court reference.
Introduction: Briefly introduce the DPDP Act, 2023, and its Section 44(3) amendment to the RTI Act, 2005. Mention the Supreme Court's recent decision to refer the matter to a Constitution Bench.
Body:
• The Conflict: Explain how Section 44(3) amends the RTI Act to create a blanket ban on the disclosure of 'personal information', removing the previous 'public interest override'.
• Constitutional Arguments (Against DPDP Amendment): Violations of Article 19(1)(a) (Right to Know) and Article 14 (equating public servants' privacy with private citizens). Argue that it grants unguided discretion to the State.
• Need for Data Protection: Highlight the Justice BN Srikrishna Committee's rationale—protecting citizens from data breaches, ensuring verifiable parental consent, and maintaining international cross-border data flow standards.
Conclusion: Conclude by emphasizing the need for the Constitution Bench to establish a harmonious construction between the two statutes, ensuring that the shield of privacy does not become a cloak for administrative opacity.