• Some sections of the Digital Personal Data Protection Act (DPDP Act) of 2023 have sparked significant debates, especially regarding its effects on the Right to Information (RTI) Act, 2005.
  • A central issue is Section 44(3) of the DPDP Act, which has raised concerns about how it might limit public access to information and affect transparency.

ABOUT DPDP ACT, 2023

  • Background: The Supreme Court, in its 2017 decision in the Justice K.S. Puttaswamy vs. Union of India case, declared the right to privacy a fundamental right under the Indian Constitution. Building on this, India introduced the DPDP Act in 2023 to protect personal data in the digital age.
  • Purpose: The DPDP Act aims to regulate the processing of digital personal data while balancing privacy rights with the need for lawful data processing.
  • Overlap with RTI Act: However, some provisions of the DPDP Act overlap with the RTI Act, raising concerns about limiting access to public information that is essential for accountability and transparency.

KEY FEATURES OF DPDP ACT, 2023

  • Applicability:
    • The DPDP Act applies to all digital and non-digital personal data processed within India, and to data collected outside India if the data involves offering goods or services in India.
    • Data of Indian citizens processed abroad is also covered by the DPDP Act.
  • Informed Consent:
    • Personal data can only be processed with the consent of the individual (Data Principal).
    • Consent can be withdrawn at any time, and processing must be for lawful purposes only.
  • Data Protection Board of India (DPBI):
    • The DPBI is a body established by the central government.
    • It is responsible for monitoring compliance with the law, imposing penalties for violations, handling complaints, and resolving disputes related to data breaches.
  • Rights and Duties of Data Principals:
    • Individuals (Data Principals) have the right to:
      • Request information on the processing of their data.
      • Correct or erase their data.
      • File grievances in case of violations of their data rights.
      • Nominate a person to exercise their rights in the event of death or incapacity.
    • Obligations of Data Fiduciaries:
      • Data Fiduciaries (like businesses or government bodies handling personal data) are required to:
        • Ensure data accuracy and implement reasonable security measures.
        • Notify the DPBI and affected individuals in case of data breaches.
        • Erase personal data once its purpose is fulfilled or when retention is no longer necessary for legal purposes.
      • Significant Data Fiduciaries (SDFs):
        • The government may classify certain data fiduciaries as "Significant Data Fiduciaries" (SDFs) based on the volume, sensitivity, and impact of the data they handle.
        • SDFs must follow stricter rules, including appointing a Data Protection Officer and conducting regular audits.

SECTION 44(3) OF DPDP ACT, 2023

  • Amendment to RTI Act: Section 44(3) of the DPDP Act modifies Section 8(1)(j) of the RTI Act, which deals with the disclosure of personal information under the Right to Information framework.
    • Original Section 8(1)(j): Under the RTI Act, personal information could only be withheld if it was unrelated to the public interest or would cause unwarranted privacy invasion, unless the larger public interest justified its disclosure.
    • Amended Section 8(1)(j) (after the DPDP Act): The modification removes the "larger public interest" clause and broadly exempts all personal information from disclosure under RTI, even if disclosing it could serve the public interest.

KEY CONCERNS

  • Reduction in Public Accountability: Section 44(3) could restrict citizens' ability to access important information about public servants, which is crucial for ensuring transparency, reducing corruption, and maintaining public trust.
  • Overuse of Privacy Protection Argument: The broad exemptions for personal data could be used to shield critical information from public scrutiny, even when it’s relevant for public interest, such as in cases of corruption or public misconduct.
  • Impact on Democracy: The changes to the RTI Act threaten to weaken the ability of citizens to engage in informed decision-making and hold the government accountable, both of which are foundational to a functioning democracy.
RIGHT TO INFORMATION ACT, 2005 The RTI Act was enacted to allow citizens to request information from government bodies and promote transparency in governance.
  • Key Features:
    • Covers all public authorities, including central, state, and local governments, except for certain exempted organizations (e.g., security agencies).
    • Public Information Officers (PIOs): PIOs must respond to RTI requests within 30 days.
    • Exemptions: Some information, like national security data or personal privacy, is exempt from disclosure.
    • Appeals: If an RTI request is denied, citizens can appeal to the Central/State Information Commissions.
    • Penalties: Public officials can be fined for failing to provide information without valid reasons.

PROPOSED SOLUTIONS

  • Public Consultation:
    • A broader public consultation process is needed to discuss how Section 44(3) affects the RTI Act.
    • This will ensure diverse perspectives are considered, including those of legal experts, RTI activists, and civil society groups.
  • Strengthening Oversight Mechanisms:
    • Strong oversight mechanisms are necessary to prevent the misuse of personal data exemptions and to ensure public access to information is not unduly restricted.
  • Clear Guidelines for Information Disclosure:
    • Clear and comprehensive guidelines should be developed for when public interest outweighs privacy concerns.
    • International standards, like those in the EU’s General Data Protection Regulation (GDPR), offer useful examples for balancing these competing interests.
  • Periodic Review of DPDP Act:
    • A periodic review of the DPDP Act’s impact on the RTI Act should be conducted. This will ensure that any amendments or changes to the law do not unjustifiably limit public access to essential information.
  • Promoting Digital Literacy and Awareness:
    • Public education campaigns are needed to raise awareness about citizen rights under both the RTI and DPDP Acts.
    • Other countries, like Australia, have implemented similar campaigns to help citizens understand their rights under privacy and freedom of information laws.