A Data Law That Could Shield The Powerful
Editor-in-Chief of indiacommentary.com. Current Affairs analyst and political commentator. Author of Cyber Scams in India, Digital Arrest, The Money Trap and The Human Hack
View all posts by this Author
By Sunil Garodia
First publised on 2026-10-28 02:40:54
About the Author
Editor-in-Chief of indiacommentary.com. Current Affairs analyst and political commentator. Author of Cyber Scams in India, Digital Arrest, The Money Trap and The Human Hack
View all posts by this Author
The Supreme Court must ensure that India's privacy framework protects personal information without weakening investigative journalism and the public's right to know.
Twenty-one news publishers have challenged the Digital Personal Data Protection Act, 2023, in the Supreme Court, arguing that its provisions could impede investigative journalism, expose confidential sources and weaken the Right to Information framework. The petition, filed on October 6 by the Digital News Publishers Association (DNPA), raises a fundamental constitutional question: can a law designed to protect personal privacy make it harder to investigate the exercise of public power?
The Court has already begun examining the wider constitutional issues. On August 7, 2026, a Bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana heard challenges to the DPDP framework. Justice Bagchi questioned whether the distinction between digital personal information and other information had an intelligible differentia, whether the two central laws could operate harmoniously, and whether the amendment to the RTI Act amounted to an indirect override of its existing framework. The Bench also considered whether a blanket prohibition on disclosure could satisfy constitutional requirements of proportionality.
The government has a legitimate objective. Citizens need protection against the misuse, unauthorised disclosure and commercial exploitation of their personal data. But a law designed for that purpose must distinguish between the exploitation of personal information and its legitimate use in reporting matters of public interest. Privacy deserves protection. It cannot automatically become a shield against public scrutiny.
The publishers argue that the DPDP Act and its accompanying rules fail to provide an adequate exemption for journalistic activity. Their concern is straightforward. An investigative reporter examining suspected corruption cannot ordinarily notify the person under investigation, seek consent to examine relevant information and then depend on that person's continuing consent to publish the findings. Such requirements could alert the subject to the investigation before the reporter has established the facts.
A public official alerted to an inquiry might destroy evidence, influence witnesses or conceal transactions. The possibility of subsequent demands for erasure could also place publishers under pressure to withdraw legitimate reporting.
This does not mean journalism should enjoy unrestricted access to personal information. The publication of intimate details that have no bearing on a matter of public interest deserves no special protection simply because a newspaper prints them. The distinction is between gratuitous intrusion into private life and the use of personal information necessary to establish facts about corruption, public expenditure, electoral malpractice or the conduct of public officials.
The law should recognise that distinction explicitly.
The RTI amendment raises a more immediate problem.
Section 44(3) of the DPDP Act amends Section 8(1)(j) of the Right to Information Act, 2005. The earlier provision included a public-interest override that could permit disclosure of personal information in appropriate circumstances, subject to statutory safeguards. The amended provision broadly exempts information relating to personal information, dropping that express balancing mechanism.
The consequences could be considerable. Information about a public official's qualifications, the allocation of public benefits or the handling of public funds may contain personal details while remaining directly relevant to public accountability. The fact that information is personal does not, by itself, establish that it must be withheld.
The timing makes this distinction especially important. The RTI amendment came into force immediately, while the principal obligations governing personal-data processing are scheduled to take effect on May 13, 2027, eighteen months after the commencement notification published in the Gazette dated November 13, 2025. The transparency consequences are therefore already in operation, even as the broader compliance obligations remain deferred.
The Supreme Court has an established framework for resolving the conflict between privacy and transparency. In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), it recognised privacy as a fundamental right and subjected restrictions on that right to constitutional scrutiny, including proportionality. The question is not merely whether the government has a legitimate objective. It is whether the means adopted are appropriately connected to that objective and whether the restrictions imposed are justified.
The 2019 judgment in CPIO, Supreme Court of India v. Subhash Chandra Agarwal is also relevant. It examined the relationship between privacy and transparency under the RTI Act and recognised the need to balance competing interests rather than treat either as absolute. That approach offers a more principled answer than an automatic presumption that information must be disclosed or withheld merely because it is personal.
The case for a specific safeguard for journalism must rest on the constitutional protection of freedom of expression under Article 19(1)(a), and on the practical requirements of legitimate public-interest reporting, rather than on a claim that journalists are automatically entitled to privileged access to personal information.
The confidentiality of journalistic sources presents another challenge.
Section 36 empowers the Central government to call for information from a data fiduciary or intermediary for specified purposes. The publishers fear that this power, without adequate safeguards, could expose journalistic sources.
Consider a reporter investigating suspected irregularities in a government contract. An employee supplies internal records on the condition that their identity remains confidential. If a government authority can seek identifying information held by a publisher without sufficiently independent scrutiny, the source could be exposed. Other potential whistleblowers might then decide that the risks of disclosure are too great.
A government request for information is not automatically unlawful, and source confidentiality cannot be an absolute bar to every legitimate investigation. The question is whether the power is sufficiently limited, whether its exercise is necessary and proportionate, and whether safeguards prevent its use to identify or intimidate sources engaged in public-interest disclosures.
The remedy need not be complicated. Parliament should provide a narrowly defined exemption for bona fide journalistic processing undertaken in the public interest, with safeguards against gratuitous invasions of privacy. Requests likely to expose confidential sources should ordinarily require independent judicial authorisation, subject to narrowly defined exceptions for genuine emergencies. This would preserve the government's ability to investigate unlawful conduct without making confidential reporting needlessly hazardous.
Nor should the identity of the petitioners decide the merits of the case. The coalition includes prominent commercial media organisations with their own corporate interests. Those interests deserve scrutiny, just as the interests of the government deserve scrutiny. But a constitutional question cannot be dismissed because the organisations raising it are large, influential or commercially motivated. The Court must assess the law's provisions and their effects.
The government should be given the opportunity to justify the framework rather than be presumed to intend to curb journalism. Its task is to demonstrate why the chosen restrictions are necessary and how the law adequately protects competing constitutional interests. Where the consequences could include the loss of confidential sources or the withholding of information about public affairs, broad assurances are no substitute for enforceable safeguards.
The test of a good data-protection law is not merely whether it prevents personal information from being misused. It is whether it does so without making the discovery of wrongdoing more difficult.
A privacy law should protect citizens from the misuse of their data, not make it harder for citizens to discover the misuse of public power.
