Some provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) have sparked significant debate, particularly concerning its impact on the Right to Information (RTI) Act, 2005.
- A crucial point of contention is Section 44(3) of the DPDP Act, prompting concerns regarding its implications for transparency and public access to information.
About The Digital Personal Data Protection Act 2023
- Background: The Supreme Court recognized the right to privacy as a fundamental right under the Indian Constitution in the landmark case of Justice K.S. Puttaswamy vs. Union of India 2017.
- In 2023, India enacted the Digital Personal Data Protection Act to safeguard personal data.
- The DPDP Act aims to regulate digital personal data processing, balancing individual privacy rights with the lawful processing needs.
- However, the Act’s overlap with the existing RTI Act raises questions about access to public information.
Features of Digital Personal Data Protection Act 2023
- Applicability: The processing of digital personal data within India applies to data collected in both digital and non-digital forms, or data that is digitized subsequently.
- Processing personal data outside India is applicable if it involves offering goods or services within India.
- Informed Consent: Personal data may only be processed for lawful purposes with the consent of the Data Principal, who can withdraw consent at any time.
- Data Protection Board of India (DPBI): The Central government establishes the DPBI with key functions including monitoring compliance, imposing penalties, directing data fiduciaries in case of data breaches, and hearing grievances.
- Rights and Duties of Data Principal: Data principals have the right to obtain information about processing, seek correction and erasure of personal data, grievance redressal, and the right to nominate a person to exercise rights in case of death or incapacity.
- Obligations of Data Fiduciaries: Data fiduciaries must ensure accuracy and completeness of data, implement reasonable security safeguards, inform DPBI and affected persons in case of a breach, and erase personal data when the purpose is met and retention is not necessary for legal purposes.
- Significant Data Fiduciaries (SDF): The Central Government may notify any data fiduciary as SDF based on factors like volume and sensitivity of data processed, risk to the rights of the data principal, potential impact on India’s sovereignty and integrity, security of the State, risk to electoral democracy, and public order.
- SDFs have additional obligations, including appointing a data protection officer and an independent data auditor, and undertaking impact assessments.
|
Section 44(3) of the DPDP Act
- This section 44(3) amends Section 8(1)(j) of the RTI Act, narrowing the scope of what information can be disclosed.
- The original provision allows withholding personal information unless public interest justifies its release.
- Under the DPDP Act’s modification, the clause becomes more restrictive, potentially shielding more personal data from public scrutiny.
Implications for the RTI Act
- The RTI Act is a cornerstone of transparency, enabling citizens to access information.
- The amendment under Section 44(3) of the DPDP Act could limit this access by broadening exemptions for personal information disclosure.
- The change threatens to undermine the RTI Act’s effectiveness by allowing essential information about public servants, such as asset disclosures, to remain confidential.
- Concerns: Section 44(3) of the DPDP Act diminishes public accountability and blocks information crucial for informed citizenry and democracy.
- Concerns focus particularly on how these changes might be used to limit access to vital information under the guise of privacy protection.
Right to Information (RTI) Act, 2005
- The Right to Information (RTI) Act, 2005 empowers citizens to seek information from public authorities, promoting transparency and accountability in governance.
- It was enacted on 12 October 2005 and came into full effect on 13 October 2005.
- The RTI Act strengthens democracy by ensuring access to government records, reducing corruption, and enhancing public participation in decision-making.
- Applicability: Covers all government bodies, including central, state, and local authorities, except for some exempted organizations (e.g., security agencies).
- Public Information Officers (PIOs): Designated officials must provide information within 30 days.
- Exemptions: Certain categories of information (e.g., national security, personal privacy) are exempted.
- Appeal Process: Citizens can appeal if information is denied or delayed, up to the Central/State Information Commissions.
- Penalty for Non-compliance: Officials can be fined for failing to provide information without valid reasons.
|
Way Forward
- Comprehensive Public Consultation: Engage a broader audience through public consultations to discuss the implications of Section 44(3) on the RTI Act.
- Invite stakeholders, including legal experts, RTI activists, and civil society members, to gather diverse perspectives and develop a balanced approach.
- Strengthening Oversight Mechanisms: Establish robust oversight mechanisms to ensure that the exemption for personal information is not misused.
- The United Kingdom’s Information Commissioner’s Office (ICO) oversees compliance with data protection laws, ensuring organizations uphold privacy requirements.
- Clear Guidelines for Information Disclosure: Develop and disseminate detailed guidelines that outline the criteria for determining public interest and transparency vs. privacy protection.
- General Data Protection Regulation (GDPR) of the EU provides specific guidelines regarding the lawful basis for data processing and criteria for assessing public interest.
- Periodic Review and Amendments: Implement a periodic review of the DPDP Act’s impact on the RTI Act, with provisions for amendments if the law is found to unjustifiably limit public access to information.
- Promoting Digital Literacy and Awareness: Enhance public awareness and understanding of citizen rights under both the RTI Act and DPDP Act.
- In Australia, the Information Commissioner runs educational campaigns to help citizens understand their rights under the Privacy Act and the Freedom of Information Act.
Conclusion
The tension between privacy rights and the public’s right to information is at the heart of the debate on the DPDP Act. The changes proposed in Section 44(3) underscore the need for careful balancing of these rights to ensure neither is unduly compromised. There is a need for ongoing dialogue and scrutiny from stakeholders which will be crucial to address these concerns and preserve the spirit of transparency that the RTI Act embodies.
To get PDF version, Please click on "Print PDF" button.
PWOnlyIAS
