Media body challenges data privacy law in SC
Privacy is a Fundamental Right, and so is free speech. What happens when a privacy law starts pinching the press? The Digital News Publishers Association (DNPA) has gone to the Supreme Court against parts of the Digital Personal Data Protection (DPDP) Act, 2023 and its 2025 Rules. Read it for Article 21 and the Puttaswamy case, the key words of the data law, and the change it makes to the RTI Act.
- Petitioner
- Digital News Publishers Association
- Law
- DPDP Act, 2023 and 2025 Rules
- Bench
- Three judges, led by CJI Surya Kant
- RTI change
- Section 44(3) amends Section 8(1)(j)
UPSC has already asked about this. Read the story with these questions in mind.
- Mains 2026 · GS2Right to privacy relating to self-identity is very dear to every human being and well protected under Article 21 of the Constitution. In this…See model answer →
- Mains 2024 · GS2Right to privacy is intrinsic to life and personal liberty and is inherently protected under Article 21 of the constitution. Explain. In this reference…See model answer →
The DPDP Act challenge: what happened?
A reporter is writing about a corrupt officer. Under the new data law, the officer’s name and details are ‘personal data’. Must the reporter first tell him and take his consent before writing? That, in short, is the worry of India’s digital news publishers.
- A three-judge Bench led by Chief Justice Surya Kant is taking up activists’ petitions against the law on Tuesday; the DNPA’s plea is listed with them.
- Core charge: the law gives no exemption for journalism as a separate kind of data use. The plea relies on Article 14 (equality), Article 19(1)(a) (free speech) and the privacy judgment.
- Who is caught: journalists, ground reporters, citizens, whistleblowers and RTI activists, who now face rules on notice and prior consent, forced deletion of data and ‘verifiable consent’.
- Section 36, read with Rule 23 and the Seventh Schedule, lets the Centre demand any information from a data fiduciary (a company or body that holds data) with no judge’s check, no proportionality test and no notice. The plea fears it could expose a journalist’s sources.
- Section 44(3) changes Section 8(1)(j) of the RTI Act, 2005, putting all “personal information” beyond disclosure.
What is the DPDP Act, in simple words?
The Digital Personal Data Protection Act, 2023 is India’s law on how personal data (any information that can identify you, like your name, phone number or address) is collected and used. Its Rules were notified in 2025.
Three words matter. The data principal is the person the data is about, that is, you. The data fiduciary is the company or body that decides why and how your data is used. The Data Protection Board of India hears complaints and can fine those who break the law.
The law grew out of the Puttaswamy case (2017), where nine Supreme Court judges held that privacy is a Fundamental Right under Article 21. Any limit on it must pass three tests: it must be backed by law, serve a legitimate aim and be proportionate, which means no heavier than needed.
Privacy versus press freedom: where each stands
| Point | Privacy | Press freedom |
|---|---|---|
| Source in Constitution | Article 21 (life and personal liberty) | Article 19(1)(a) (speech and expression) |
| Limits allowed | Law + legitimate aim + proportionality (Puttaswamy) | Only the grounds in Article 19(2), like public order or defamation |
| What the DPDP Act does | Strong consent rules for everyone | No separate space for journalism |
| Europe’s GDPR | Strong privacy rules | Article 85 asks countries to make room for journalism |
Which laws and Articles apply?
- Article 21 read with Part III: right to privacy (Puttaswamy, 2017).
- Article 19(1)(a) and 19(2): free speech and its reasonable restrictions.
- DPDP Act, 2023: Section 36 (Centre can call for information), Section 44(3) (amends RTI).
- RTI Act, 2005, Section 8(1)(j): personal information exemption, earlier with a public-interest override.
Why does the DPDP Act challenge matter?
| Angle | What to note |
|---|---|
| Two rights clash | The law settles privacy versus press wholly in favour of consent. |
| State power | Section 36 protects people from companies but lets the State, the biggest data holder, ask for data without a judge. |
| RTI weakened | Dropping the public-interest test moves RTI from ‘disclose unless harmful’ to ‘withhold if personal’. |
| Sources | If sources can be exposed, whistleblowers may stop talking. |
What are the problems with the DPDP Act challenge?
- No journalism exemption, unlike the EU’s GDPR.
- Section 36 has no prior approval by a judge or an independent body.
- The RTI change can hide officials’ records behind ‘personal information’.
- The Data Protection Board’s members are chosen by the government, raising questions of independence.
What should be done next on the DPDP Act challenge?
- Add a journalism exemption tied to a code of ethics and Press Council norms.
- Make every Section 36 demand go through an independent or judicial check, with written reasons.
- Restore the public-interest test in Section 8(1)(j) of the RTI Act.
- Keep the Data Protection Board independent of the executive.
What can Prelims ask on the DPDP Act challenge?
- Privacy: Article 21 and Part III freedoms (UPSC 2018, 2024).
- Puttaswamy (2017): nine-judge Bench; privacy is a Fundamental Right.
- Data principal = the person; data fiduciary = the body deciding how data is used.
- GDPR: adopted by the European Union (UPSC 2019).
- Right to marry a person of one’s choice: Article 21 (UPSC 2019).
How to write about the DPDP Act challenge in Mains
Practice question (15 marks, 250 words): The Digital Personal Data Protection Act, 2023 protects privacy but may weaken press freedom and the right to information. Critically examine.
- Intro: the DNPA petition and the Supreme Court hearing.
- What the Act gets right: consent, a Data Protection Board, the Puttaswamy promise.
- Concerns: no journalism exemption, Section 36, the RTI amendment.
- Balance: a journalism carve-out, judicial checks, the public-interest test.
- Conclusion: privacy and a free press must both survive.
Ready lines for your answer
- Section 36 power is “capable of being turned to the identification and targeting of journalistic sources and is thus constitutionally infirm” (DNPA petition).
- A journalism exemption, prior judicial approval for State demands and the public-interest test in RTI can balance privacy with press freedom.
Quotable data pointSection 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, 2005.
Exam angle
Prelims: Article 21, Puttaswamy, data principal/fiduciary, Data Protection Board, GDPR. · Mains GS-II/III: DPDP Act, RTI, press freedom (Mains 2024 asked the Act's features).
Practice MCQs
Original practice questions (not PYQs).
Under the Digital Personal Data Protection Act, 2023, the person to whom personal data relates is called the:
Answer (c) & explanation
The data principal is the individual; the data fiduciary decides the purpose and means of processing.
Section 8(1)(j) of the Right to Information Act, 2005, which the DPDP Act, 2023 amends, deals with:
Answer (b) & explanation
Section 8(1)(j) exempts personal information; Section 44(3) of the DPDP Act removes its public-interest override, putting all personal information beyond disclosure.
Questions students ask about this
Why has the DNPA challenged the DPDP Act?
It says the law has no exemption for journalism, lets the government demand data without a judge's check, and weakens the RTI Act.
What is a data fiduciary?
The person, company or body that decides why and how someone's personal data is processed.
Which Article protects the right to privacy?
Article 21, read with other freedoms in Part III, as held in the Puttaswamy case (2017).
How does the DPDP Act change the RTI Act?
Section 44(3) amends Section 8(1)(j), so all personal information can be withheld, without the earlier public-interest test.