Why the new Digital Personal Data Protection Act faces a constitutional challenge in the Supreme Court

Three separate PIL petitions have been filed in the Supreme Court challenging the constitutionality of the Digital Personal Data Protection Act, 2023 (DPDP Act). While the statute was enacted to safeguard digital privacy of individuals, the petitioners argue that the Act — and the Rules notified under it — paradoxically undermines the fundamental Right to Information (RTI), handicaps investigative journalism, and expands state surveillance powers. The petitions have been filed by the National Campaign for Peoples’ Right to Information (NCPRI), a civil society network instrumental in the enactment of the RTI Act; Venkatesh Nayak, a transparency advocate; and The Reporters’ Collective Trust, a group of investigative journalists. The Supreme Court on Monday admitted the pleas, issuing notice to the Centre and listed them for hearing by a Constitution Bench of five judges in March. However, it declined to place an interim stay on the Act. What are the objections to the statute listed in the petitions? We explain. ## Privacy vs transparency A central point made by all three petitioners concerns the amendment to the RTI Act, 2005. Section 44(3) of the DPDP Act alters Section 8(1)(j) of the RTI Act, which governs the disclosure of personal information held by public authorities. Before this amendment, public officials could deny personal information requested under the Act only if it had no relationship to any public activity or interest, or if it caused an “unwarranted invasion of the privacy of the individual”. The unamended Section 8(1)(j) also contained a public interest exception, which allowed the public information officer (PIO) to disclose even personal information if they were satisfied that the “larger public interest justifies the disclosure”. The substituted Section 8(1)(j) now simply exempts “information which relates to personal information”. The NCPRI petition states that this amendment “extinguishes” the statutory power of PIOs to weigh public interest against privacy. The Reporters’ Collective points out that investigations into corruption often rely on records like asset disclosures, tender documents and file notations, which inevitably contain personal data. By removing the public interest override, the petitioners argue that the law now allows public authorities to withhold information that is deemed “personal” even if it has a significant connection to public activity. The NCPRI petition contends that this converts a “carefully calibrated privacy exemption into an absolute bar”, thereby shielding corrupt officials. Nayak’s petition calls this a “death knell for participatory democracy” and “ruinous to ideas of open governance”. All three petitions invoke the Supreme Court’s landmark Puttaswamy judgment of 2017, which mandates that any restriction on fundamental rights must satisfy the “proportionality test”. This requires the state to prove that its law has a legitimate aim, employs the “least restrictive measure” possible to achieve that aim, and includes procedural safeguards against abuse. The petitioners argue the DPDP Act fails this threshold in restricting the fundamental RTI. The NCPRI contends that by replacing the RTI Act’s “public interest override” with a “blanket ban” on disclosing personal information, the state failed to adopt the least restrictive method available. The NCPRI petition also asserts that the amendment to the RTI Act is “manifestly arbitrary” as it creates a class of information that is totally opaque, regardless of the public interest involved. Impact on journalism The Reporters’ Collective petition highlights an adverse effect on the freedom of the press. Under the DPDP Act, journalists collecting data on individuals — for instance, while investigating a fraudulent scheme or reporting on government beneficiaries — may be classified as “data fiduciaries”. This classification, under the Act, imposes onerous obligations such as giving notice to and obtaining consent from the very individuals being investigated. The petition argues that this requirement is “infeasible” and “counter-productive” for the purpose of investigative journalism. If the person to whom the data relates does not give consent, Section 12 of the Act mandates that their data be erased by the data fiduciary. The petition argues this would “[make] post-facto validation of a news report or article impossible”. The petition also warns of a “chilling effect” due to the high penalties (rising up to Rs 250 crore) prescribed under the Act. The threat of such “unaffordable penalties”, the petition argues, will dissuade journalists from reporting on matters of public interest involving personal data. State power and surveillance Both Nayak and the Reporters’ Collective challenge Section 36 of the Act, which empowers the Union government to call for information from any data fiduciary. The Reporters’ Collective petition argues that this provision facilitates “unreasonable digital searches” without procedural safeguards and that it is “vague, overbroad and arbitrary”, allowing the government to acquire personal data without the consent of the individual and without independent authorisation. It adds that without an exemption for journalistic purposes, Section 36 could force media organisations to hand over data that reveals the identity of anonymous sources, thereby deterring potential informants. Nayak contends that “there is no appeal or review available against the order of the Central Government under Section 36 of DPDP Act”. This, he warns, “lends the provision amenable to arbitrary and excessive abuse, with a Central Government monopoly over private data, which could in turn influence policy decisions and electoral choices”. Independence of Data Protection Board Nayak and the Reporters’ Collective also allege that the Data Protection Board of India — the body tasked with enforcing the Act and imposing penalties — lacks independence. Under the newly notified Rules for implementing the Act, the search-cum-selection committee for appointing the board’s chairperson and members consists entirely of government secretaries and experts nominated by the government. Nayak’s petition argues that this “complete executive dominance” in the appointment process violates the doctrine of separation of powers in light of the board performing quasi-judicial functions. The Reporters’ Collective petition, echoing this, states that since the State is the largest collector of data, a board appointed solely by the executive “raises concerns of executive control and questions regarding its independence and impartiality”.