Privacy vs Right To Information: India’s Data Protection Law Can Reshape Digital And Investigative Journalism

The Digital News Publishers Association (DNPA), representing the digital arms of 21 major news organisations, moved the Supreme Court challenging provisions of the Digital Personal Data Protection (DPDP) Act, 2023, arguing that the law could constrain investigative journalism, expose confidential sources and complicate the preservation of published reports.

On Tuesday, a bench comprising Chief Justice of India (CJI) Surya Kant and Justices Joymalya Bagchi and V Mohana issued notice to the Centre on the petition and its application for an interim stay, but declined to grant an immediate stay without hearing the government. The matter is scheduled to be heard next on November 17.

“This is perhaps the first comprehensive petition by what we call legacy media. There has been some debate over citizen journalists. We are the traditional, conventional legacy media,” said Senior Advocate Madhavi Divan during the hearing, as per a report by Bar and Bench.

“We have raised the argument concerning exemptions as well. Otherwise, newsrooms will shut down if we have to ask for permission. It is a complete regime of pre-censorship. We have to ask your permission if we report on you. How can that ever be? What is news otherwise? If we report something wrong, incorrect or inaccurate, we must face the consequences,” she added.

The DNPA includes digital news operations of organisations such as The Indian Express, The Hindu, India Today, the Times Group, Zee, NDTV and Network18. The latter two are part of the Adani and Reliance groups, respectively. Independent investigative journalist Yukta Mudgal is also a petitioner.

Can Consent Rules Constrain Reporting?

The petition challenges Sections 7, 17(2), 18, 19, 27, 29, 36, 37 and 44(3) of the Act, alongside Rules 16, 17 and 23 of the DPDP Rules, 2025, as per a report by LiveLaw. At the heart of the dispute is the absence of a specific exemption for journalism.

The Act generally requires personal data to be processed for a lawful purpose on the basis of consent or certain legitimate uses. Its notice and consent provisions require individuals to be informed about how their data will be processed. Section 8(7) also requires erasure when consent is withdrawn or the specified purpose is no longer served, unless retention is required by law.

For investigative reporters, obtaining consent before examining an individual’s records or informing a subject about data use could undermine inquiries into alleged wrongdoing. A subsequent erasure request could also raise questions about how long a news organisation can retain material supporting a published investigation.

According to Probir Roy Chowdhury, Partner at JSA Advocates & Solicitors, the absence of a journalism-specific exemption creates uncertainty because reporting often involves processing personal data without the subject’s consent. He noted that the Personal Data Protection Bill, 2019, had proposed an exemption for journalistic purposes subject to a code of ethics, but this was not retained in the 2022 draft or the final Act.

Any exemption should be narrowly framed around public-interest reporting, with safeguards such as a recognised code of ethics and independent oversight. Obligations that could defeat journalism, including advance notice, consent or pre-publication access, could be treated differently without removing data-security responsibilities, Chowdhury argued.

He also cautioned that data-access or erasure requests and regulatory complaints could be used to identify newsroom information or delay publication.

The Act does exclude certain personal data made publicly available by the data principal or someone legally obliged to make it public. But this is not a blanket exemption for all information available in the public domain.

DPDP Act’s Section 17(2)(b) separately provides a conditional exemption for research, archiving and statistical purposes, subject to prescribed standards and restrictions on using the data to make decisions specific to an individual.

The absence of a blanket exemption for journalism is not unusual globally, as countries have adopted different approaches to balancing data privacy with press freedom, said Arya Tripathy, Partner at Cyril Amarchand Mangaldas (CAM). The UK, for instance, provides a conditional exemption for journalistic, artistic and literary purposes where there is an intention to publish information in the public interest, she said.

India’s DPDP Act has no comparable journalism-specific exemption. Any such exemption in India, according to Tripathy, would need clearly defined safeguards to ensure it protects genuine public-interest reporting without being misused for commercial promotion or marketing.

These could include checks on the accuracy of information and an assessment of the potential harm arising from its publication, she added.

Can Govt Powers Expose Confidential Sources?

The petition also questions Section 36, which empowers the Centre to require information from the Data Protection Board, data fiduciaries or intermediaries, read with Rule 23 and the Seventh Schedule. The publishers argue that insufficient safeguards could put confidential sources and newsroom material at risk.

Section 37 allows the Centre, subject to specified conditions and procedures, to direct the blocking of access to information. The petition also raises concerns about the Board’s composition and the executive’s role in appointing its chairperson and members.

But protecting sources and preventing data-protection processes from being used to frustrate legitimate investigations are central to the case for a tailored exemption, Chowdhury said. The challenge, however, is to design safeguards that protect reporting without creating a free pass for misuse of personal data.

Does RTI Amendment Weaken The Right To Know?

The dispute extends beyond newsrooms as Section 44(3) of the DPDP Act amended Section 8(1)(j) of the Right to Information (RTI) Act. The earlier provision permitted withholding personal information where disclosure had no relationship to public activity or interest, or would cause an unwarranted invasion of privacy, unless a public information officer or appellate authority considered the larger public interest sufficient to justify disclosure.

It also protected information that could not be denied to Parliament or a state legislature from being denied to an individual. The amended clause instead exempts “information which relates to personal information”. The change removes the earlier wording that expressly required a public-interest and privacy-harm assessment.

The deletion, said Kaushik Moitra, Partner at Bharucha & Partners, could widen the grounds for refusing access to personal information relevant to public accountability. Section 8(2) of the RTI Act remains in place, allowing disclosure where the public interest in disclosure outweighs harm to protected interests.

However, Moitra noted that the provision says public authorities “may” allow access, leaving room for uncertainty in its application.

An appropriate assessment should consider the connection between the information and the exercise of public power, the contribution disclosure would make to accountability, and the specific privacy harm likely to result, said Moitra. An allegation of misconduct should not automatically justify disclosure of every personal record, but neither should the absence of a proven offence prevent access to information necessary to scrutinise an official decision, he added.

The amendment also removed important qualifiers that previously required authorities to consider public activity, unwarranted privacy intrusion and the larger public interest, according to Advocate Samarth Luthra, a practising lawyer at the Delhi High Court. He said that the continued presence of Section 8(2) does not fully replace an explicit test within the personal-information exemption.

The two laws address different questions as the DPDP Act specifies when its data-protection obligations apply, while the RTI Act governs access to information held by public authorities. The exclusion for certain publicly available personal data under the DPDP Act does not, on its own, determine whether information must be disclosed under the RTI Act.

Moitra called for a clearer public-interest test when authorities assess RTI requests involving personal information, while Luthra argued for reasoned decisions and effective appellate remedies to prevent the exemption from being applied too broadly.

Even though Union Minister of Information and Technology Ashwini Vaishnaw on Wednesday said that the DPDP Act does not infringe the press freedom, the Supreme Court’s decision could have implications beyond digital newsrooms, particularly for how personal data is used in reporting, how long published material can be retained and how authorities assess requests for information in the public interest.

As the matter is scheduled to be heard next on November 17, the case will test how far data-protection safeguards can extend without impeding investigative journalism or narrowing access to information relevant to public accountability.