Digital Personal Data Protection (DPDP) Act Challenge (Completely Explained)

Context

Three Public Interest Litigations have been filed before the Supreme Court challenging the constitutionality of the Digital Personal Data Protection Act, 2023. The petitioners argue that while the Act seeks to protect privacy, it weakens transparency safeguards under the RTI framework, restricts press freedom, and expands executive surveillance powers. The matter has been referred to a five-judge Constitution Bench without an interim stay.

Q1. What is the Digital Personal Data Protection (DPDP) Act, 2023?

1. A comprehensive framework for protection of digital personal data.
2. Based on consent-driven data processing.
3. Applies to data fiduciaries and data processors.
4. Establishes a Data Protection Board of India for enforcement.
5. Seeks to operationalise the right to privacy recognised under Article 21.

Q2. What constitutional background governs data privacy in India?

1. The right to privacy recognised as a fundamental right in:
   Justice K S Puttaswamy v Union of India.
2. The judgment laid down the proportionality test:
   1. Legitimate state aim
   2. Rational nexus
   3. Least restrictive means
   4. Procedural safeguards
3. Any restriction on fundamental rights must satisfy this framework.

Q3. Why is the amendment to the RTI Act central to the challenge?

1. Section 44(3) of the DPDP Act amends Section 8(1)(j) of the
   Right to Information Act, 2005.
2. What was the earlier RTI position?
   1. Personal information could be withheld only if:
      1. No relation to public activity, OR
      2. Caused unwarranted invasion of privacy.
   2. Crucially, disclosure allowed if larger public interest justified it.
3. What does the amendment do?
   1. Broadly exempts “information which relates to personal information.”
   2. Removes public interest override.

Q4. How does this amendment affect transparency and anti-corruption efforts?

1. Removes balancing power of Public Information Officers.
2. May block access to:
   1. Asset declarations
   2. Tender records
   3. Official file notings
3. Converts a conditional exemption into a near-absolute bar.
4. Petitioners argue it shields public officials from scrutiny.

Q5. Does the amendment satisfy the proportionality test?

Petitioners argue it fails because:

1. Blanket exemption lacks tailoring.
2. Does not adopt least restrictive means.
3. Eliminates public-interest safeguard entirely.
4. Creates an opaque category immune to balancing.

Thus, claimed to be “manifestly arbitrary.”

Q6. How could the DPDP Act affect investigative journalism?

1. Why may journalists be treated as data fiduciaries?
   1. Collect personal data during investigations.
   2. Could be subject to consent and notice obligations.
2. Why is consent problematic in journalism?
   1. Investigative reporting often targets wrongdoing.
   2. Seeking consent from the subject defeats the purpose.
   3. May compromise source confidentiality.

Q7. What concerns arise from consent withdrawal and data erasure provisions?

1. Section 12 mandates deletion if consent is withdrawn.
2. May:
   1. Disrupt fact-checking continuity.
   2. Limit archival preservation.
   3. Undermine investigative documentation.
3. Journalistic credibility may be affected.

Q8. Does the penalty structure create a chilling effect?

1. Financial penalties up to ₹250 crore.
2. Risk aversion among media organisations.
3. Potential deterrence from reporting sensitive matters.
4. Petitioners claim adverse impact on Article 19(1)(a).

Q9. What concerns exist regarding Section 36 and state powers?

1. Empowers the Union Government to demand information from data fiduciaries.
2. No explicit prior judicial authorisation required.
3. No statutory appeal mechanism provided.
4. Broad, undefined scope.
5. Critics argue this creates surveillance risks and executive overreach.

Q10. How does Section 36 relate to separation of powers concerns?

1. Absence of independent oversight mechanism.
2. Executives may obtain data without transparent safeguards.
3. Media organisations could be compelled to reveal confidential information.
4. Potential impact on democratic accountability.

Q11. Why is the independence of the Data Protection Board questioned?

1. Appointments handled by a government-controlled committee.
2. No judicial or independent institutional participation mandated.
3. Board performs quasi-judicial functions:
   1. Adjudication
   2. Penalty imposition
4. Executive dominance may affect impartiality.

Concern:

1. The state is the largest data collector.
2. Regulatory oversight may lack neutrality.

Q12. What are the governance benefits of the DPDP Act?

1. Provides statutory privacy framework.
2. Sets accountability standards for private sector data use.
3. Establishes penalty and grievance redress mechanisms.
4. Aligns India with global data-protection trends.

Q13. What are the major constitutional concerns?

1. Weakening of RTI transparency architecture.
2. Impact on press freedom.
3. Executive concentration of power.
4. Inadequate institutional independence.
5. Insufficient procedural safeguards.

Q14. What safeguards and reforms may address these concerns?

1. Restore public-interest override in RTI exemption.
2. Provide explicit journalistic exemptions.
3. Introduce judicial oversight for government data access.
4. Establish an independent appointment mechanism for the Data Protection Board.
5. Ensure appellate review against executive data orders.

Conclusion

The constitutional challenge to the DPDP Act represents a critical test of the balance between privacy and transparency. While the law aims to protect digital rights, concerns regarding RTI dilution, press freedom, and executive oversight raise structural questions under the proportionality doctrine. The Constitution Bench’s interpretation will shape India’s long-term data governance framework and democratic accountability architecture.