When "Personal" Became a Password : How India's Data Protection Law Quietly Rewired the Right to Know
Introduction : In the vast details of India's Data Protection Bill, 2023, which many people realize has nothing to do with data breaches or penalties, one clause could end up playing a significant role in democratic governance in India. Section 44 (3) does not mention data breaches, but it mentions paperwork, which means that it changes the sentence in a twenty-year-old transparency law and consequently has probably eliminated one of the most powerful and helpful tools available for citizens of India.
In order to grasp exactly why the change is causing trouble for many activists and journalists as well as more than a hundred Members of Parliament, one has to go back in time to 2005 and remember the one unassuming sentence.
The Right That Started With a Sentence
In 2005, the passing of the Right to Information Act had a radical impact on a nation accustomed to opacity in its bureaucratic workings since this piece of legislation changed the basis of information access in India. Instead of ordinary citizens making appeals for access to information, authorities would now be required to justify not providing this information. Government knowledge, customs and outputs, thus, have become publicly accessible, unless of course this access is restricted by legislation.
There are exceptions to this general rule in Section 8 of this Act, such as state security, Cabinet meetings, commercial secrets, and most importantly, personal information. The latter term, used in subsection (j) of Section 8 of the Act is the trickiest of all since personal information involves not only home addresses and personal health information but also the name of the person who kept the file, the information the legislator provided, as well as the name of the contractor who won the tender for the project that was most convenient for the ruling party.
The creators of the RTI Act anticipated the likelihood that such situations would arise and took steps to prevent such occurrences through certain provisions in the Act. Personal information cannot be made public unless it relates to any "public action or interest," or unless a Public Information Officer is convinced that the public interest outweighs issues of individual privacy. In short: privacy is essential but not a determining factor in issuing any response to an application.
The argument is based on serious legal reasoning. It maintains that transparency and privacy are not mutually exclusive possibilities; rather, they should be balanced sufficiently to produce reasonable conclusions on each specific case.
The Supreme Court Agreed - Once
The real capability of balancing was displayed in 2019 when the case “CPIO, Supreme Court of India v. Subhash Chandra Agarwal” appeared. The RTI activist asked for correspondence on the alleged interference in the judiciary, information about the appointment process of three judges, and, well known, asset declarations made by judges of the Supreme Court of India.
In the case of transparency, the Supreme Court could simply declare all the information personal. However, the Court introduced a unique test consisting of three steps: to determine whether the information is personal, to identify the involved parties, and to decide about the necessity of the provided information.
As for the asset declarations of judges, the Court decided that this is the information of public interest that prevails over any private interests of judges. This decision was historically important as it proved that the highest legal authority of India has recognized that the expectation of privacy involved in a public service must be lower than generally in private life for an official person and it has to be reflected in the transparency legislation.
For four years, this was the accepted logic. Then came Section 44(3).
The Rewrite
Hidden in the "consequential amendments" section of the DPDP Act - the type of clause that lawmakers pass with hardly any discussion just to sound like technical tidying up - is an updated definition of Section 8(1)(j). The language attributing terms to the public and the public interest has vanished. What remains is brutally honest: personal information is no longer covered.
Read that again, because brevity is the key here. The old clause was an “if-then” statement providing an exit door. The new law is a fortress. There is no way for the PIO to ask the question "does the public interest compel this?" because the revised statute does not bother to ask that question.
This is not just a technical change. This is a fundamental shift in legal architecture when a “balancing test” has been exchanged for a “blanket rule” . Balancing tests are messy – they lead to disputes, appeals, and inconsistent decisions. However, they are sensitive to context: they can differentiate between a medical record of an individual and the decision-making process of an official. A blanket rule is neat and predictable – but blind.
The critics did not ignore the development. Over 120 lawmakers wrote a joint letter that called for repealing Section 44(3). They warned that introducing both a general exception and a vague definition of the term “private information” gave public authorities the ability to deny any RTI applications almost at will. Over 30 civil society groups backed by 130 opposition Members of Parliament came together to declare that this is a serious threat to the RTI Act. RTI veterans, such as Aruna Roy and Nikhil Dey, who fought for the introduction of the law decades ago, expressed similar ideas but in a more straightforward manner.
Why Journalists Should Be Worried
One of the core elements of investigative journalism is the ability to connect a decision to the person who made it. When journalists investigate a land transaction, for instance, they must connect the transaction to the government official who approved it. In the same way, any government contract must be connected to the real owners of the contracting firm. Similarly, the amount of illicit money in a project must be linked to the middlemen who profited from it. But all of this can only happen when an investigative journalist knows the names of the individuals involved in the wrongdoings.
Prior to the change in law, if a journalist applied for RTI and was refused, they could still invoke the argument based on public interest. Thanks to the “Subhash Chandra Agarwal” case, the journalist could even go to court if the matter could not be resolved amicably. Unfortunately, this option has now disappeared from the law. The PIO can easily refuse to provide any information on the grounds of the word "personal".
The practical effect of certain modifications to the law does not equate to an outright crackdown on information. The result is that it creates friction in many ways. The end result is a much higher number of rejections received, appeals made, and investigations conducted that were previously likely to produce tangible results. It can thus be stated that, almost never do chilling effects appear to resemble actual censorship and, instead, they resemble mere weariness. This is exactly how the petitioners of the ongoing Supreme Court proceedings concerning the changes in the law see it as well.
The Whistleblower Blind Spot
Whistleblowing is the softer casualty in all that’s going on, but it’s not one that garners a lot of attention. India has its own whistleblower legislation “the Whistle Blowers Protection Act 2014” but it’s widely accepted as being ineffective. The proposed amendments to it, which will render it even less effective, remain unprocessed for years.
This is where RTI comes into play. For ages, RTI has played the role of an unofficial whistleblower. People privy to the insider information or those affected by some wrongdoing who do not trust the formal whistleblower mechanism have utilized RTI to document their suspicions. The simplification of what can be disclosed as personal information does not only make journalism harder. It also removes one of the very few available means of whistleblowing for the people at the time when the legal measures aimed at protecting them are yet to be implemented.
To Be Fair: Privacy Advocates Have a Point Too
It would be misrepresentation to simply describe it as pure villainy. The pre-amendment system had considerable problems. Certain PIOs considered ‘no larger public good’ as a convenient excuse, denying requests related to issues of public interest. At the same time, genuine private information—such as someone’s medical records or an address of a junior employee—was sometimes leaked under false pretenses of public interest justification. This is because the old law’s text was ambiguous in nature.
It would also be necessary to point out a structural tension that should be taken into consideration. In accordance with the previous law, the PIO must follow the balancing test in deciding whether the claim is grounded. At the same time, though, he/she is obliged to adhere to the requirements of the DPDP Act as a fiduciary of data.
The disagreement is not whether privacy matters — everyone accepts it does, particularly since the Supreme Court designated it a fundamental right in 2017. The disagreement is over how to protect it. Should privacy be protected with a scalpel, which means removing information deemed sensitive from case to case? Or should it be done with a hammer, which means exempting an entire class of information without examining specific cases? Most other democracies like UK’s Freedom of Information Act and US’s Freedom of Information Act have maintained the scalpel approach, applying balancing tests with regards to personal information of public office holders while performing their duties. The recent amendment made by India follows the opposite approach.
What Happens Next
The battle isn't yet over. A series of petitions contesting the modification - stating that the amendment is tantamount to using the right to privacy against the right to information - are now in the hands of a five-judge Constitution Bench of the Supreme Court. This is a huge step forward as it indicates the Court's own view of the situation as a real battle between two basic rights and not merely a legislative issue. Essentially, it means that the question regarding whether this amendment was an overreach or not is still being answered.
In the meantime, though, India is now functioning under a law regarding transparency that has a missing hole where the balancing test used to be - and growing number of journalists, politicians, and other people are arguing that it is not a coincidence related to the issue, but a deliberate act that will influence the possibilities for ordinary people to watch their leaders.
Author: Kalash Jain in case of any queries please contact/write back to us via email to content@khuranaandkhurana.com or at Khurana & Khurana, Advocates and IP Attorney
References
The Right to Information Act 2005, s 8(1)(j) (as amended by the Digital Personal Data Protection Act 2023, s 44(3)).
The Digital Personal Data Protection Act 2023, s 44(3).
The Right to Information Act 2005, ss 8(2), 10, 11.
K.S. Puttaswamy v Union of India (2017) 10 SCC 1.
CPIO, Supreme Court of India v Subhash Chandra Agarwal (2020) 5 SCC 481 (decided 13 November 2019).
The Constitution of India, arts 19(1)(a), 21.
The Whistle Blowers Protection Act 2014.
Freedom of Information Act 2000 (UK).
Freedom of Information Act 1967, 5 USC § 552, Exemption 6 (US).
Comments