Mains Analysis: DPDP Act vs RTI – can privacy law shut the window on public accountability?

30 October 2026 · English Polity & Governance

இந்தப் பகுப்பாய்வைத் தமிழில் படிக்க →

Topics: Governance · GS-II · UPSC Mains Analysis

Context

On 27 October 2026, a Supreme Court bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice V. Mohana issued notice to the Union government on a petition by the Digital News Publishers Association (DNPA) – the digital wings of 21 news organisations – and an independent journalist, challenging several provisions of the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025. The petition says the law has no exemption for journalism and that Section 44(3), which rewrites the personal-information exemption in the Right to Information (RTI) Act, 2005, bars disclosure without any public-interest test. The Court declined to stay the provisions without hearing the Centre and made the matter returnable on 17 November 2026. It joins a batch of RTI-related challenges already before the Court. The core question for governance: can a law meant to protect citizens' data also be used to shield public functionaries from scrutiny?

Background: the law and the litigation

• DPDP Act, 2023 (Act No. 22 of 2023, dated 11 August 2023): India's first general personal-data law, following the Supreme Court's K.S. Puttaswamy judgment (24 August 2017, nine judges) that made privacy a fundamental right under Article 21.
• DPDP Rules, 2025: notified on 13 November 2025 (announced by PIB on 14 November) with a phased start. The Board-related provisions and Section 44(3) came into force at once; consent-manager provisions follow after 12 months (November 2026); most duties of Data Fiduciaries after 18 months (May 2027).
• What Section 44(3) does: it replaces clause (j) of Section 8(1) of the RTI Act with just six words – "information which relates to personal information". The old clause exempted personal information only when it had no relationship to any public activity or interest, or would cause an unwarranted invasion of privacy, and allowed disclosure if the larger public interest justified it. The proviso – information that cannot be denied to Parliament or a State Legislature cannot be denied to any person – was also removed, as petitioners and opposition MPs point out.
• Litigation timeline: 16 February 2026 – notice on petitions by RTI activist Venkatesh Nayak, The Reporters' Collective with journalist Nitin Sethi, and the National Campaign for People's Right to Information (NCPRI); no stay; the matter referred to a larger bench. 13 April 2026 – notice on a plea by the Mazdoor Kisan Shakti Sangathan (MKSS), which also sought protection for data on public portals such as Rajasthan's Jan Soochna Portal. 7 August 2026 – the Court sought the Centre's reply; the Solicitor General said it would be filed in two to three weeks; no interim stay. 27 October 2026 – the DNPA petition.

Core analysis: old clause vs new clause

Aspect	RTI Section 8(1)(j) before	After Section 44(3) of the DPDP Act
Scope of exemption	Only personal information unrelated to public activity, or causing unwarranted invasion of privacy	All information that "relates to personal information"
Public-interest override	Built in: PIO/appellate authority could disclose if larger public interest justified it	Removed from clause (j); only the general, discretionary Section 8(2) remains
Parliament proviso	What cannot be denied to a legislature cannot be denied to a citizen	Removed (as reported by petitioners and MPs)
Typical effect	Assets, service records, appointments of officials were often disclosed after a balancing test	Officers can refuse simply by saying the information is "personal"
Judicial standard	Balancing developed in Girish Deshpande (2012) and CPIO, Supreme Court v. Subhash Chandra Agarwal (2019)	Blanket rule – petitioners say it fails the Puttaswamy proportionality test

The two sides of the argument

• Government's case: the IT Minister said in April 2025 that the change is in line with the privacy principles of Puttaswamy. A PIB explainer on the Rules (November 2025) says Section 8(2) of the RTI Act still allows disclosure where public interest outweighs the harm. Personal data of citizens held by the State – health, bank, Aadhaar-linked data – does need protection from careless disclosure.
• Petitioners' case: Section 8(2) is optional ("may allow"), not a duty, and it is not a balancing test that a PIO is required to apply. Removing the in-built test makes secrecy the default. Puttaswamy itself said privacy is not absolute; and in the Electoral Bonds case (ADR v. Union of India, 2024) the Court held that voters' right to know can prevail over privacy claims of political donors.
• Journalism: the DNPA argues that consent, notice and erasure duties, with no media exemption, could require consent from the very people being investigated. Earlier drafts had a journalism exemption; the 2023 Act keeps one for research, archiving and statistics (Section 17(2)(b)) but not for news.
• State powers: petitioners also question Section 17(2)(a) (exemption for notified State bodies), Section 36 (Centre can call for information) and Section 37 (blocking on reference from the Board), and a Data Protection Board whose members are appointed by the Centre (Section 19).

Why it matters: the dimensions

• Accountability: social audits of MGNREGA, ration and pension lists, and asset declarations depend on names and personal details being public. Without them, "leakage" cannot be traced to a person.
• Constitutional: both privacy (Article 21) and the right to know (Article 19(1)(a)) are fundamental rights; the case will decide how the Court balances two rights, not a right against a mere policy.
• Federal and institutional: Central and State Information Commissions decide lakhs of appeals; a blanket exemption changes their role from balancing to rubber-stamping refusals.
• Digital governance: as more welfare data moves online, the same data can serve citizens (proactive disclosure portals) or harm them (profiling, leaks). Rules must separate the two.

Challenges

• Drafting by amendment: a transparency law was changed through the last section of a data law, without a separate public debate on the RTI Act.
• Chilling effect: PIOs, unsure of penalties under data law, may refuse even disclosable information; portals may mask data already public.
• Weak independent oversight: the Data Protection Board is executive-appointed; Information Commissions have faced vacancies and backlogs.
• No clear line: neither law defines when an official's "personal" information becomes "public" information linked to public duty.
• Slow litigation: the challenge is pending since early 2026 while Section 44(3) operates without a stay.

Way forward

1. Restore a statutory balancing test: re-insert the public-interest override in clause (j), with a harm test – the 2018 Justice B.N. Srikrishna draft had kept a balancing test of this kind.
2. Define public-duty information: by law or rules, list what is always disclosable – assets of officials and legislators, appointments, beneficiary lists, contract details – and what stays private (health, family, financial details of citizens).
3. Journalism and public-interest exemption: a narrow, defined exemption with safeguards, as earlier drafts had.
4. Strengthen oversight: fill Information Commission posts on time; make the Data Protection Board more independent, with a judicial member.
5. Protect proactive disclosure: keep Section 4 RTI portals such as Jan Soochna open; mask only sensitive fields, not whole records.

Mains practice question

Answer framework: Introduction – Puttaswamy (2017) and the RTI Act as two pillars · Body – (a) old vs new clause (j), loss of the public-interest override and proviso; (b) government's view: Puttaswamy, Section 8(2); (c) critique: accountability, journalism, proportionality, ADR (2024); (d) pending Supreme Court challenge · Way forward – statutory balancing test, public-duty information list, independent oversight · Conclusion – faculty-view line.

Prelims pointers

• DPDP Act, 2023 – Act No. 22 of 2023; maximum penalty up to Rs 250 crore (failure of security safeguards).
• Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, 2005; Section 44(2) amends the IT Act, 2000.
• Section 3(c)(ii) – the Act does not apply to personal data made public by the person or by anyone under a legal duty.
• Data Protection Board of India – Chairperson and Members appointed by the Central Government (Section 19).
• K.S. Puttaswamy v. Union of India – 24 August 2017, nine-judge bench; privacy a fundamental right.

Sources: Digital Personal Data Protection Act, 2023 (India Code); PIB explainer on the DPDP Rules, 2025 (November 2025); reports on the Supreme Court hearings of 16 February, 13 April, 7 August and 27 October 2026 (LiveLaw, Verdictum, Lawbeat, Outlook, Deccan Chronicle, Supreme Court Observer); PTI reports on the opposition memorandum and the Minister's response (April 2025); reports on the 2018 Srikrishna draft Bill. Original analysis by Shanmugam IAS Academy.

SI/POLICE Achievers