Concerns Around Section 44(3) of the DPDP Act

Some provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) have sparked significant debate, particularly concerning its impact on the Right to Information (RTI) Act, 2005. 

• A crucial point of contention is Section 44(3) of the DPDP Act, prompting concerns regarding its implications for transparency and public access to information.

About The Digital Personal Data Protection Act 2023

• Background: The Supreme Court recognized the right to privacy as a fundamental right under the Indian Constitution in the landmark case of Justice K.S. Puttaswamy vs. Union of India 2017. 
  • In 2023, India enacted the Digital Personal Data Protection Act to safeguard personal data. 
• The DPDP Act aims to regulate digital personal data processing, balancing individual privacy rights with the lawful processing needs. 
• However, the Act’s overlap with the existing RTI Act raises questions about access to public information.

Section 44(3) of the DPDP Act

• This section 44(3) amends Section 8(1)(j) of the RTI Act, narrowing the scope of what information can be disclosed. 
• The original provision allows withholding personal information unless public interest justifies its release. 
• Under the DPDP Act’s modification, the clause becomes more restrictive, potentially shielding more personal data from public scrutiny.

Implications for the RTI Act

• The RTI Act is a cornerstone of transparency, enabling citizens to access information. 
• The amendment under Section 44(3) of the DPDP Act could limit this access by broadening exemptions for personal information disclosure. 
• The change threatens to undermine the RTI Act’s effectiveness by allowing essential information about public servants, such as asset disclosures, to remain confidential.
• Concerns: Section 44(3) of the DPDP Act diminishes public accountability and blocks information crucial for informed citizenry and democracy.
  • Concerns focus particularly on how these changes might be used to limit access to vital information under the guise of privacy protection.

Way Forward

• Comprehensive Public Consultation: Engage a broader audience through public consultations to discuss the implications of Section 44(3) on the RTI Act. 
  • Invite stakeholders, including legal experts, RTI activists, and civil society members, to gather diverse perspectives and develop a balanced approach.
• Strengthening Oversight Mechanisms: Establish robust oversight mechanisms to ensure that the exemption for personal information is not misused.
  • The United Kingdom’s Information Commissioner’s Office (ICO) oversees compliance with data protection laws, ensuring organizations uphold privacy requirements.
• Clear Guidelines for Information Disclosure: Develop and disseminate detailed guidelines that outline the criteria for determining public interest and transparency vs. privacy protection.
  • General Data Protection Regulation (GDPR) of the EU provides specific guidelines regarding the lawful basis for data processing and criteria for assessing public interest. 
• Periodic Review and Amendments: Implement a periodic review of the DPDP Act’s impact on the RTI Act, with provisions for amendments if the law is found to unjustifiably limit public access to information.
• Promoting Digital Literacy and Awareness: Enhance public awareness and understanding of citizen rights under both the RTI Act and DPDP Act.
  • In Australia, the Information Commissioner runs educational campaigns  to help citizens understand their rights under the Privacy Act and the Freedom of Information Act.

Conclusion

The tension between privacy rights and the public’s right to information is at the heart of the debate on the DPDP Act. The changes proposed in Section 44(3) underscore the need for careful balancing of these rights to ensure neither is unduly compromised. There is a need for ongoing dialogue and scrutiny from stakeholders which will be crucial to address these concerns and preserve the spirit of transparency that the RTI Act embodies.