DIGITAL PERSONAL DATA PROTECTION v. RIGHT TO INFORMATION

INTRODUCTION

India’s first data privacy law, The Digital Personal Data Protection Act, 2023 came in to affect in the year 2023. The main objective of this particular act is to protect individual privacy rights while setting strict rules as how companies process digital data. The foundation for the DPDPA was laid down in the landmark K.S. Puttaswamy case[1], wherein a unanimous nine – judge bench of the Hon’ble Supreme Court of India ruled that the Right to Privacy is a constitutional right under the Art. 21and Part III of The Indian Constitution.

Whereas the Right To Information Act, 2005 was brought into force under the Art. 19(1) of The Indian Constitution. The Raj Narain case[2] in 1975 laid down the foundation for the RTI Act. The primary goal is to empower citizens, promote accountability in Government operations to tackle corruption. One Act was enforced to under Constitutional Right to Information and another Act was enforced to prove Right to Privacy is protected under Constitution.

STATUTORY CONFLICT

PRE – AMENDMENT

Section 8(1)(j) of the RTI Act, as originally enacted, exempted personal information from disclosure only if two conditions were met: the information had no connection to any public activity or interest, and its disclosure would result in an unwarranted invasion of privacy. Even when both conditions applied, the proviso allowed disclosure if the Central or State Public Information Officer or the appellate authority determined that the larger public interest justified it. This structure was intentionally flexible. It generally presumed against disclosing purely private information but allowed exceptions when disclosure promoted accountability.

SUBSTITUTED PROVISION

Section 44(3) removes both limbs of the original test and the public interest proviso, exempting instead any “information which relates to personal information.” The consequence, as critics across the political spectrum have observed, is that a Public Information Officer need no longer ask whether disclosure serves a larger public interest, or even whether the information bears any relation to public activity at all — the mere characterisation of information as “personal” now suffices to withhold it.

Members of Parliament from several parties formally sought the provision’s repeal, warning that it would permit authorities to withhold information such as disciplinary records of public servants, details of asset disclosures, and beneficiary data for welfare schemes — categories of information whose disclosure the pre-amendment regime had specifically been designed to permit where the public interest so demanded.[3] The Ministry’s defence — that Section 3 of the DPDP Act separately exempts information required to be disclosed “under any law for the time being in force” — has been contested precisely because Section 44(3) itself alters what the RTI Act now requires to be disclosed; the argument is, in effect, circular.

THE DOCTRINAL BASELINE: CPIO v. SUBHASH CHANDRA AGRWAL

In CIPO v. Subhash Chandra Agarwal[4], the Hon’ble Supreme Court with it’s nine – judge bench articulated a structured proportionality exercise for weighing the Right to Information against the Right to Privacy of third parties, particularly public officials. The Court held that disclosure of the personal information concerning public servants could be compelled where it bore a reasonable nexus to discharge of public duties and that the public interest override was not a residual afterthought but an operative part of the balancing test itself.

The doctrinal significance of this decision is that it treated privacy and transparency as competing interests to be reconciled through case-specific inquiry, rather than as categorically opposed values that required a legislative choice of one over the other — the same proportionality logic that Puttaswamy had introduced into Art. 21 generally a few years earlier. It is challenging to square this paradigm with the categorical exception of Section 44(3), which answers by legislative fiat what the Court had stated must be determined by adjudicative balance.

PENDING CONSITITUTIONAL CHALLENGE

On February 02, 2026, a writ petition under Art. 32 challenged Sec. 44(3) along with related provisions of the DPDP Act and Rules, arguing that the amendment creates a blanket ban on disclosure of personal information and thereby violates Art. 14, 19(1)(a) and 21 of the Constitution.[5] The Petitioner’s main argument was that Sec 44(3) nullifies the proportionality test recognised in the Subhash Chandra Agarwal case, replacing it with a blanket bar that allows the executive to withhold information solely by characterising it as personal, regardless of its bearing on public accountability. On February 16, 2026 a three – judge bench declined to grant the interim stay but referred the matter to larger bench. In the meantime, The DPDPA Rules, 2025 have begun a phased operationalisation of the Act[6].

CONSTITUTIONAL VULNERABILITY

Art. 19(1)(a) and Right to Know.

The right to information and right to know[7] has long been read into Art. 19(1)(a) as a necessary incident of free speech and expression. A categorial exemption for anything “relating to” personal information sweeps far more broadly than necessary to protect genuine privacy interests, and in doing so, restricts speech-adjacent conduct (informed public debate) without the narrow tailoring Art. 19(2) demands of restrictions on that right.

Absence of Proportionality Safeguard

Under established doctrine, a restriction on a basic right must be weighed against necessity and proportionality, and it must go no farther than necessary to achieve its declared goal. Section 44(3) fails this test on its face because it completely eliminates the public interest override rather than narrowing it. This is not because the provision strikes an unfavorable balance, but rather because it refuses to strike a balance at all, replacing what the Constitution calls a calibrated inquiry with a bright-line rule.

Manifest Arbitrariness

The amendment also invites challenge on manifest arbitrariness grounds. The Subhash Chandra Agarwal framework and the pre-amendment proviso both considered this difference to be crucial, but it makes no distinction between the personal information of private persons and the personal information of public workers working in their official position. It is challenging to justify treating a private citizen’s medical history and a bureaucrat’s disciplinary record in the same way for exemption reasons.

RECOMMENDATIONS

First, a public interest override in Section 8(1)(j) should be reinstated by Parliament. This override should be calibrated more precisely than the pre-amendment text to differentiate between private individuals’ personal information and information about public servants’ official conduct, which should be disclosed at a lower threshold.

Second, and independently of the constitutional challenge, the Central Information Commission and State Information Commissions should be empowered to issue binding guidance on the categories of information — asset disclosures, disciplinary proceedings, welfare beneficiary data used for audit purposes — that fall outside the scope of the amended exemption as a matter of statutory interpretation, pending legislative correction.

Third, given that the DPDP Rules are already being operationalised in phases while the constitutional challenge remains pending before a larger bench, the Court may consider severing Section 44(3) for interim purposes, restoring the pre-amendment Section 8(1)(j) until the larger bench rules, to avoid a period in which information is irreversibly withheld under a provision that may ultimately be struck down.

CONCLUSION

Section 44(3) highlights a broader pattern in present-day data protection legislation: privacy, formerly established as a safeguard against unrestrained state and private monitoring, is now repurposed as a cloak for governmental opacity. The amendment does not require public authorities to balance privacy and accountability; rather, it relieves them from doing so at all. Whatever the DPDP Act’s significant accomplishments as India’s first comprehensive data protection legislation, Section 44(3) sits awkwardly beside them, and the current referral to a bigger bench of the Supreme Court provides the first genuine opportunity to remedy it.

REFERENCE(S):

[1] Justice K.S. Puttaswamy (RETD.) And Another v. Union of India – AIR 2018 SC (SUPP) 1841

[2] State of UP v. Raj Narain – 1975 AIR 865

[3]Letter from Jairam Ramesh, Member of Parliament, to Ashwini Vaishnaw, Union Minister for Electronics and Information Technology (Mar. 23, 2025).

[4] Central Public Information Officer v. Subhash Chandra Agarwal – 2019 (16) SCALE 40

[5] Venkatesh Nayak v. Union of India – W.P (C) No. 177/2026

[6] The Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology, Gazette Notification dated Nov. 13, 2025

[7] S.P Gupta v. Union of India – 1981, Supp SCC 87