Privacy, public interest and RTI: Why DPDP Act is before Constitution Bench

Supreme Court

On February 17 (Tuesday), the Supreme Court admitted three Public Interest Litigations (PILs) challenging the constitutionality of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025.

A Bench led by Chief Justice of India (CJI) Surya Kant, along with Justices Joymalya Bagchi and Vipul M Pancholi, issued notice to the Union government and referred the matter to a Constitution Bench of five judges to hear it in March.

However, when an interim stay was sought, the Court was categorical. “No question of stay,” CJI Kant said. “Through interim order, we will not introduce a regime which Parliament has thought of...”

Calling the issue “complex but interesting,” the Court acknowledged that it involves competing constitutional claims. “It is a complex and sensitive issue and interesting because it touches upon fundamental rights on both sides,” the Bench observed. At another point, the CJI remarked, “We have to iron out the creases and lay down what is personal information.” He also noted, “There's an element of sensitivity...both sides will have arguable points...sometimes the bench is so conscious of such things...”

The petitions have been filed by the National Campaign for Peoples’ Right to Information (NCPRI), transparency advocate Venkatesh Nayak, and The Reporters’ Collective Trust along with journalist Nitin Sethi. Senior Advocate Abhishek Manu Singhvi appeared with Advocates Prashant Bhushan and Vrinda Grover for the petitioners.

Privacy versus transparency

At the heart of the challenge lies Section 44(3) of the DPDP Act, which alters Section 8(1)(j) of the Right to Information Act, 2005. Previously, personal information could be denied only if it bore no relation to public activity or interest, or if disclosure would amount to an “unwarranted invasion of the privacy of the individual.” Even then, the provision contained a public interest safeguard allowing disclosure where “the larger public interest justifies the disclosure.”

The amended version now exempts “information which relates to personal information,” without explicitly retaining the earlier public interest balancing mechanism.

The NCPRI contends that this change “extinguishes” the statutory discretion of Public Information Officers to balance transparency against privacy. It argues that what was once a calibrated exemption has now become a total prohibition. According to the petition, the amendment converts a “carefully calibrated privacy exemption into an absolute bar,” potentially shielding wrongdoing. It further describes the amendment as “manifestly arbitrary,” alleging that it creates an entirely opaque category of information irrespective of public interest.

Venkatesh Nayak’s plea calls the shift a “death knell for participatory democracy” and “ruinous to ideas of open governance.”

The Reporters’ Collective highlights that probes into corruption frequently rely on asset declarations, tender records, and file notings -- documents that often contain personal data. By removing the public interest override, petitioners argue, authorities may now refuse disclosure merely because the material is personal, even when it relates to public duties.

All three petitions rely on the 2017 Puttaswamy judgment, which laid down that any restriction on fundamental rights must meet the proportionality standard. That standard requires the State to demonstrate a legitimate objective, adopt the least restrictive method to achieve it, and incorporate procedural safeguards. The petitioners argue that replacing a nuanced balancing clause with a blanket exclusion fails this constitutional threshold.

Freedom of the press and journalistic concerns

Another major plank of the challenge relates to the effect of the law on investigative journalism. Under the DPDP Act, journalists who collect personal data in the course of reporting may fall within the definition of “data fiduciaries.” This classification carries obligations such as issuing notice to individuals and obtaining their consent.

The Reporters’ Collective argues that this requirement is “infeasible” and “counter-productive” when reporting on matters such as fraudulent schemes or beneficiaries of government programmes. If consent is refused, Section 12 mandates erasure of the data. The petition claims this would “[make] post-facto validation of a news report or article impossible.”

It also raises concerns over the penalties under the Act, which can go up to Rs 250 crore. The plea argues that the possibility of such “unaffordable penalties” could deter journalists from publishing stories that involve personal data but serve the public interest.

Advocate Vrinda Grover, appearing for Nayak, criticised the legislative approach during the hearing, saying that “instead of using a chisel, they have used a sledgehammer.”

Prashant Bhushan, representing NCPRI, argued that the earlier framework contained a built-in equilibrium. He referred to the Subhash Chandra Agarwal case to suggest that the prior position struck a workable balance. The Bench noted, however, that the Subhash Chandra Agarwal ruling did not directly examine Section 8(1)(j).

Government access to data and surveillance fears

The petitions also question Section 36 of the DPDP Act. This provision allows the Union government to call for information from any data fiduciary. The Reporters’ Collective describes this as enabling “unreasonable digital searches” without adequate safeguards, calling the power “vague, overbroad and arbitrary.”

It argues that the government could access personal data without independent authorisation or consent. Without specific protection for journalistic material, media organisations could be compelled to share data revealing anonymous sources, potentially discouraging whistleblowers.

Nayak contends that “there is no appeal or review available against the order of the Central Government under Section 36 of DPDP Act.” He warns that this “lends the provision amenable to arbitrary and excessive abuse, with a Central Government monopoly over private data, which could in turn influence policy decisions and electoral choices.”

These provisions, along with Rule 23 of the 2025 Rules, are alleged to infringe Articles 14, 19 and 21. Petitioners argue that individuals may not even be informed when their data is shared with authorities, affecting freedom of expression.

Independence of the Data Protection Board

The structure of the Data Protection Board of India has also been challenged. Under the Rules notified in 2025, the search-cum-selection committee for appointing the chairperson and members consists entirely of government secretaries and government-nominated experts.

Nayak argues that this “complete executive dominance” in appointments undermines separation of powers, particularly since the Board exercises quasi-judicial functions. The Reporters’ Collective echoes this concern, stating that because the State is the largest collector of data, a board appointed solely by the executive “raises concerns of executive control and questions regarding its independence and impartiality.”

The constitutional questions ahead

The Court has made it clear that it will not suspend the amended framework at this stage. “We will decide at the earliest...matter will be placed before a larger bench as decided by the CJI,” the Bench said.

As the matter moves to a Constitution Bench in March, the central issue remains the balance between privacy and the public’s right to know. The outcome will determine how India reconciles transparency under Article 19(1)(a) with privacy protections recognised under Article 21, and whether the DPDP Act, 2023 withstands constitutional scrutiny.