Naavi.org

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

We have tried to point out inconsistencies in the petitions of the “Scrap-DPDPA Brigade” through many of our previous articles.

The net point we are making is

Objection Section 44(3) is not relevant since

a) Every PIO is should not forced to take a judical view under DPDPA whether Privacy interests are involved or not in releasing an information

b) PIO is encouraged to take the safety first option of rejecting release if prima facie personal information is involved so that the disgruntled applicant can invoke either the Grievance redressal mechansim under ITA 2000/DPDPA or RTI Act.

We have addressed some part of the objections related to exemptions under Section 17 which we shall explore further now.

DPDPA has to be considered as a law which is different from GDPR. Its approach to Personal Data Protection is different from that of GDPR. Similarly, DPDPA 2023 cannot be directly linked to the Puttaswamy Judgement on “Privacy is a Fundamental Right”. DPDPA 2023 is about personal data protection by organizations at the instance of the data principal. Protection of Privacy or being compliant to Privacy Principles under GDPR are incidental.

The petitioners have failed to look at DPDPA 2023 as an independent legislation and are trying to interpret it under different lense of either a Privacy Activist or a GDPR follower. These are giving raise to some disagreements. The Supreme Court has to understand this difference before giving any value to the arguments of the petitoners.

We shall try to address some of these issues here.

First of all, we need to take note of the following charecter of DPDPA 2023

1. DPDPA 2023 has not seggregated Personal Data into Sensitive Personal Data and Non Sensitive personal Data
2. DPDPA 2023 has designated Data Controllers under GDPR as Data Fiduciaries providing them additional fiduciary responsibilities to take decisions in the interest of the Data Principals beyond the Consent.
3. DPDPA 2023 has chosen “Consent” as the only legal basis for processing  of personal data since “Right of Choice” of the data principal is paramount to protect his “Personal Data Protection Rights”.
4. It is the Data Principal who decides why he wants his personal data to be processed in a particular manner. It could be to protect his privacy or it could be to protect his Security or it could be to protect any other Right of his choice.
5. The cross border restrictions are based on “Types of Data” and “Types of Data Fiduciaries” and not “Adequecy or SCC”
6. The exemptions are also defined on the basis of “The purpose of processing more than the class of Data Fiduciaries”.

These are fundamental differences in the approach of DPDPA to Personal Data protection and should be borne in mind when discussing whether DPDPA 2023 is constitutional or not.

We cannot judge DPDPA 2023 as unconstitutional by what it fails to do. We have to rather look at what it proposes to do and determine whether it violates any constitutional principles. 

Arguing that DPDPA is not constituional because it does not protect “Privacy” the way the petitioners think it should is fallacious.

Petitioners have  raised objections specifically on Sections 17(1)(c), 17(2).

When we look at Section 17,we can observe that it is divided into five sub sections namely 17(1), 17(2), 17(3), 17(4) and 17(5).

Section 17(5)

Setion 17(5) is a section empowering the Government to provide any exemption within the next 5 years. By the end of 5 years, Section 17 will crystallize. Till then Section 17 is malleable and can be tuned as required. Hence even if some of the provisions of the current Section 17 is not acceptable, there is a self correcting ability within the Act and there is no need to scrap DPDPA.

Section 17(3)

Section 17(3) is a section that empowers the Government to declare any data fiduciary (including start ups and perhaps even digital publications) to be  exempted from the provisions of Section 5 (Notice before collection), Section 8(3) (Completeness, Accuracy and consistency), Section 8(7) (Erasure on withdrawal of consent, Competion of purpose), Sections 10(Obligations of a Significant Data Fiducairy) and Section 11 (Right to Access).

Exemption under Section 17(3) is by specific notification  and should be justified with th critria of Volume and Nature of personal data processed.  This would be documented  and be available for judical scrutiny.

Section 17(4)

Exemption under Section 17(4) applies to State or instrumentalities of the State. It is applicable to Section 8(7) (Erasure on withdrawal of consent, Competion of purpose), 12(3) (Erasure of personal data as a Right). It is subject to a further condition that the processing does not involve making of a decision that affects the data principal and is not related to updation or correction of data.

Thus 17(3) and 17(4) and 17(5) does not result in any major harm to the data principal and is subject to judicial scrutiny when invoked.

This leaves Section 17(1) and 17(2) to discuss.

Section 17(1)

Section 17(1) is restricted to exemption of Chapter II (Obligations of a Data Fiduciary) other than 8(1) (Responsibility for a Data Processor) and 8(5) (Protection of Personal data). It is not restricted to Government bodies only but extends to Private sector also based on specific purposes such as

a) For enforcement of legal rights

b) Processing by Courts or other judicial entities

c) Prevention, detection, investigation or prosecution of any offence or contravention of any law

d) Data of foreigners processed in India

e)For processing during mergers and acquisitions after approval of Court

f) For processing by Financial Institutions after default

In these 6 subsections, the objections are being raised only on 17(1)(c) which is related to law enforcement duties. If the petitioners think Police should take prior consent  for processing the personal data of a criminal or a suspected criminal, they are living in a world of fantacy. Their speculation that it can be used for wide spread surveillance  of citizens is not based  on any facts. It is a pure speculation and imaginary. If such a situation arises checks and Balances need to be set up by the Law enforcement agency itself.

While DPDPA does not exempt “Security” of data, other laws including Section 72 of ITA 2000, and Section 316 of Bharatiya Nyaya Samhita, include responsibilities that the law enforcement person should secure the data collected for prevention or detection of crime.

Hence there is a reasonable check and balance associated with  the power and there is no reason to endanger the community by preventing the law enforcement from dicharging their duty to secure the nation. The Right to Security of a Citizen is also a fundamental right and a sacred duty of the Government.

If the objections raised on  Section 17(1)(c) is upheld it becomes a Right of a Criminal to hide under privacy excuses.

The same petitioners what Privacy not be a constraint for release of information under RTI but have objections for collection of such information by the law enforcement for prevention of crimes. This is the typical Urban Naxalite mentality that tries to protect dishonest criminals at the expense of honest citizens.

Acceptance of the objection of the Rights of Law enforcement will weaken the security framework of the country and preserving it is well within the Article 19(2) of the Constitution.

Section 17(2)

Lastly we shall explore Section 17(2). This contains two subsections 17(2)(a) and 17(2)(b) both  need to be discussed in depth.

Section 17(2)(a)

Section 17(2)(a) applies only to “Notified” instrumentalities of the  State  and can only be used

“In the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these,“

This sub section reflect the reasonable exceptions under Article 19(2)  for Article 21 (from which right to privacy is derived).

It is interesting however to see that Article 19(2) states

Nothing … shall …prevent the State from making any law, in so far as such law imposes reasonable restrictions on the exercise of the right conferred ….. in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with Foreign States, public order, decency or morality or in relation to contempt of court, defamation or incitement to an offence

Let us compare the two underlined portions.

It is observed that DPDPA has curtailed the exemptions that were feasible under Article 19(2) substantially. For example, DPDPA has removed exception such as “Decency”, “Morality” and  “Contempt of Court”. Even in respect of “Cognizable offences”, DPDPA restricts the exemptions only to such cognizable offences that relate to “interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order” and not to all cognizable offences.

Hence we cannot find any fault with the Government of having  misused the provisions of Artile 19(2) and has shown extreme restraint in structruing Section 17(2)(a).

I donot see how the petitioners find this as giing “Sweeping powers of surveillance” etc except in their imagination.

Section 17(2)(b)

This sub section addresses the necessity for “Resarch”, “Archiving” and “Statistical Purposes” and has to be seen with the conditions attached to the exemption and the standards of security prescribed under the Rules 16(with Second schedule).

This also has relevance to the arguments of the Reporter’s Collective Trust that exemption has not been provided to the “Journalists” as a category of data fiduciaries.

Firstly we shall see the “Purpose” for which this exemption can be used. This subsection can be used for three aspects namely “Research”, “Archival” and “Statistical Analysis”. But it can be used only where there is no “Decision maling” about the data principal involved. When a research is conducted, the output in the form of a report is generated. It can be used for general understanding of the market and not specifically to take a decision about the individual whose data is being processed.

As an example, when a hospital takes the diagnostic data about a patient, and uses it for diagnosis and delivery of its health services, the  research done for the purpose is for taking a decision about the data  principal. It is not exempt from DPDPA provisions.

The same data may be used to generate a research report about a decease and used for industry analysis not specifically for being used for the data principal. That research can even be done on de-identified or pseudonymised or anonymised data of patients.

Statistical analysis can also be done on anoymised information.

Such processing is exempted from the provisions of the Act.

The Rule 16 reiterates the purpose of archiving and also the  need for security etc.

There does  not seem to be any objection for such Health related research or Financial research where there is no decision making and data is used subject to the  security standards prescribed.

Role of a Journalist and his Research

The  petition of the Reporter’s Collective Trust strongly objects to the category of “Journalists”  not being specifically mentioned in the Act. It ignores the  fact that  even Research for Medical or Financial evaluation is also not specifically mentioned. Use for research by any type of organization whether it is public  or private is covered under Section 17(2)(b). It even covers research by Reporter’s Collective  Trust itself. I hope they have no objection for it.

The case of RTI activist  also  comes under comparable objectives. An RTI activist may conduct a research involving personal data provided it is not required to be used for any decision making against the individual, including filing an objection for a benefit granted by the Government under a scheme or for alleging corruption against the official. If the RTI activist needs to do a research on how a Government scheme is functioning, he can request and work with pseudonymised information or even anonyised information. In such an instance the objections raised under Section 44(3) also become meaning less since the PIO can release data without the personal identity. I am sure that the Government can make arrangements to remove the identity in a set of data to be released subject to cost and time involved.

If a Journalist wants to use any information for a journalistic research, the Act does not bar him from claiming the exemption as long as he can justify that the requirement is for a “Research”. The special case of an “Investigative report” which later becomes a “Disputed defamation” exercise is to be handled as a “Risk for the Investigative journalist”. If he collects data on his own through research without specific consent or legal basis and uses it for developing a report which does not contain any identity of a person, then the report would be considered as not infringing privacy of any person and as long as the personally identified information collected for the research is held confidencial and secure by the journalist, there should be no issue of non compliance of DPDPA and the fines.

It is true that GDPR may make a specific mention of “Journalist” for exemption purpose. At the same time GDPR also speaks of Churches for exemption. India has chosen not to specifically exempt either Journalists not doctors nor advocates nor chartered accountants nor temples, nor chruches  normosques, nor educational institutions nor  madrasses, as an exempted category as of now. The law has specified if the purpose is research, archival, statistical analysis, provison of benefits to the population etc then some exemptions may be available either  under Section 17 or under legitimate use under Section 7.

Indian law is fair and does not discriminate different  kinds of data fiduciaries for this purpose. It only tries to classify some data fiduciaries as “Significant Data Fiduciaries” and imposes additional obligations.

Just as journalists tomorrow objections can be raised by SMEs or Micro enterprises or One man Business entities why they are not provided exemptions etc. The demand by Reporter’s Collective is to introduce a “Discrimination” in the name of “Journalism” which is not warranted.

Further in the modern world of digital journalism, every individual who writes a blog or posts a Youtube video or a Tiktok reel, is a journalist. Why should a journalist registered with the Reporters’s Collective alone be provided a special status? The Intermediary guidelines under ITA 2000 does not spare an  individual blogger from punishment if he violates a law. Hence the concept of “Who is a Journalist” in the digial media era has changed and there is no need to provide a special status to the journalists.

The days when Journalists were considered as the “Fourth Pillar of Democracy” is long lost. Today every journalist is either an employee of a journal or a contractual employee of some publication or George Sorros or a Political party. Hence there is absolutely no reason why “Journalists” should be considered as a special category of Data Fiduciaries and given some exemptions.

For example Naavi is himself a prolific writer and a jounalist and Naavi.org itself is a publication. We have een submitted request for registration under the MeitY scheme of self regulation of digital media. However naavi.org may not have a registration with the Presss Council or the Reporter’s  collective and may not get invitations for Government events or IPL matches.

I therefore consider that the petition of Reporter’s collective claiming extra privileges under DPDPA is not  relevant and must be  dismissed.

Let  us see if what we have expressed here reaches the ears of the Supreme Court or atleast the Meity or the Attorney General. Let us not allow the petitioners to use their selective presentations to mislead the Court.

In summary, I request the Supreme Court to judge DPDPA by what it does and not what it does not do but what petitioners wish  it would do. Let DPDPA stand by its own Karma and not what any RTI activist or a journalist claiming to represent the  public wishes.

Naavi

P.S: I would be  happy to receive any comments… or even counter arguements.

(Joining link: Time 7.30 pm IST)

EU GDPR is now in the 10th year of its existence and an  online conference / workshop entitled “GDPR and its Reflection After 10 Years” has been organized on 3rd March 2026. The  event is co-organized by the Czech Association for Protection of Personal Data (https://www.ochranaudaju.cz/en/who-we-are/), and by the European Federation of Data Protection Officers (https://www.efdpo.eu). A panel discusssion will be  conducted at 7.30 pm IST.

During the discussion the following aspects are likely to be discussed.

• What impact has GDPR had on privacy legislation and application practice in your jurisdiction, if any? Were any changes to your legislation adopted in reaction to the GDPR, what were they and was it a significant change to your laws and practice?
• How were these changes perceived by the public and by businesses?
• What real practical impact did such changes / GDPR have in your country? In your opinion, did they really lead to increased protection of privacy of individuals and their control of data?
• Does GDPR / local legislation compliance represent a competition advantage for businesses – overall and when doing business with EU partners?
• Specific aspects: Georgia an accession country, Switzerland traditionally strong privacy protection, India strong focus on tech and state digitalization
• After ten years, which elements of privacy legislation have from  your point of view proven most effective — and which create disproportionate complexity/administrative burden?
• How has GDPR influenced U.S. privacy developments, particularly state legislation, and federal discussions?
• Do U.S. companies see GDPR as a burden or as a competitive advantage?
• What is their apporach to GDPR compliance – is it real or more on paper?
• Is a comprehensive federal privacy law realistic in the medium term?
• The EU is considering simplification through so called the Digital Omnibus initiative. Are there any simplifications proposals regarding  privacy legislation in progress in your country?
• Application of GDPR/privacy legislation in connection with AI (including training of AI models – what is the prevailing view in your jurisdiction)? What is your personal opinion?
• What should privacy regulation look like by 2035?

Looking forward to an interesting discussion.

Naavi

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

Above picture is representative and has been created using Nanobanana AI tool

The petitions from the Scrap DPDPA Brigade in Supreme Court refers to DPDPA 2023 and the Rules as not being in conformity with  the famous K S Puttaswamy Judgement of the Supreme Court of 24th August 2017.  (KSP judgement)

The essence of the decision in the case of KSP was that

“Privacy is a fundamental Right under the constitution and is part of  Article 21 of the Constitution subject to the reasonable restrictions under Article 19(2). “

The bench however did not define Privacy nor gave any restrictive boundaries to the Right to privacy whether it is restricted to Information Privacy. It however extensively noted the risks related in information privacy. In its directions, it stopped at stating that the Right is part of the fundamental Rights and parts of M P Sharma judgment and Kharaksingh judgement  are over ruled.

The KSP judgement  did not further gave any order to the Government to pass any statutory law to protect the Privacy Rights of Indian population. Hence the statement of the petitioners in the Reorter’s Collective Trust that “DPDPA Act and Rules are in complete conravention of the law laid down in the KSP judgement” is incorrect.

Before this judgement was out, the Government had already formed the Justice Srikrishna Committee which went on to give its report in 2018 which after several iterations became DPDPA 2023.

DPDPA 2023 was under no obligation to define “What is Privacy” and “How the Government Protects Privacy”. Hence the Government chose to restrict the law as “Law for protecting the personal data” and went on to define personal data.

Privacy in India is therefore protected by the Constitution directly and DPDPA 2023 facilitates the Data Principal to protect his privacy by protecting his personal data with the deterrance mentioned in DPDPA 2023.

The Government also adopted a strategy different from GDPR and laws of other countries by designating the entity determining the purpose and means of processing of personal data as a “Data Fiduciary” placing on them the onus of understanding what the data principal wants and carry out  his permissions. Hence Consent was the backbone of the law.

Since Article 19(2) prescribed the reaasonable exceptions, Government also recognized “Legitimate Uses” under Section 7 and Exemptions under Section 17. Both Sections 7 and 17 are applicable to both the Government and the Private Sector. Some of the exemptions are partial exemptions. Legitimate use is conditional.

The only blanket exemption is related to some of the aspects of the Article 19(2).  Even here, all exemptions available under Article 19(2) have been invoked. Government has been very conservative.  Also 17(2) is applicable to only such instrumentalities of State which are notified. Unless an entity is notified, the exemptions are not applicable even for the approved purposes such as the interests of soereignity and integrity of India etc

To call this provision as “Attempt for Mass Surveillance”,, “Excessive”, “Disproportionate” etc… is false.

The Call for scrapping of DPDPA is atrocious. DPDPA tries to make Data Fiduciaries responsible and not indulge in indiscriminate harvesting of personal data, use it for spamming, profiling etc. The industry is interested in monetizing the  personal data of individuals without a fair compensation to the data principals.

DPDPA is expected to put an end to the obnoxious practice of Corproates stealing personal data without proper consent and enriching by their use. While DPDPA may not fully prevent the woes of the public from being targetted with Spams, Use of darak patterns to manipulate purchase decisions, use of techniques to change the freedom of mental decision making through mind bending communciation strategies, it has given a hope to public that things may move in that direction.

The penalties at levels of Rs 250 crores are one of the higehst in India but are no where near the international norms at 4% of global turnover to 10% of national trurnover etc. The penalty structure under DPDPA does not mandate either Rs 50 crores or Rs 250 crores. It leaves the discretion to DPB to determine the  penalty taking into account the capacity of the data fiduciary to pay. There is also a voluntary undertaking provision where penalty can be waived.

Without properly reading the law the petitioners make unsubstantiated statements including that  journalists cannot pay the fine of Rs 250 crores and  hence the law is unconstitutional.

This is an attempt to misrepresent the law.

The petitioners seem to place “Journalists” as if they are above law. Journalism has a public purpose and today most of the journalists are not the committed journalists of the yesteryear. They are underinfluence of money bags and politicians. Hence giving an unfettered freedom to them is a danger to the society.

Remember, Even Hindenberg can claim to be a “Research organization” as much as any other journalist.

Journalists who are also lawyers are persons who normally use RTI information for purposes other than public good. Even the NGOs they represent are often funded by international orgnaisations and protect the interests of their foreign  bosses more than Indian public.

We therefore seriously question the credibility of the petitioners who ought to declare their sources of revenue.

Bar Association also has to ensure that members of the Bar donot claim to be “Registered Journalists” and  claim the benefits of the so called “Freedom of Speech” etc. This is a disguised attack on the society.

The NGOs headed by lawyers who say they are representing public interest should not be allowed by the Supreme Court to file PIL without proper scrutiny.

I wish the Supreme Court prevents the gross abuse of the PIL privilege used as a weapon against progress.

Lawyers are considered as officers of the Court but we wonder  if they are more officers of vested interests  often guided by commercial or politial considerations using the Court as a play ground for meeting their objectives outside the Court.

Otherwise it does not make sense for any of the petitioners to ask for scrapping of DPDPA just to  ask for some exemptions for the profession of their clients.

The petitions  filed should therefore not  be considered as PILs. They are petitions filed on behalf of the clients like an association of journalists or an association of RTI activists.

The real public advocacy champions are not capable of matching the expenditure required to fight their passions in the Supreme Court and have to  often remain in the background. The Court should recognize this and bring such organizations forward and listen to their advice.

The concers related to Section 44(3) or 17(2)(b) are easily addressable in the rules and have already been addressed. The petitioners donot want to see through the provisions with an open mind and are ascribing motives to every word in the Act and the Rules without justification.

It is our desire that the honourable Supreme Court does not allow such pseudo public interest champions misleading the Court through their oratory and professional standing.

Naavi

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

The petitioners who are challenging DPDPA in Supreme Court have  one specific demand  that they should be provided exemption from the provisions of DPDPA.

If we go through the petition of the Reporter’s Collective, it provides an elaborate argument why the Act should be scrapped because it does not provide exemption to journalists.

The petition however acknowledges that there is exemption for “Research” but it concludes that this does not apply to Journalistic resarch. the petition also acknowledges that the Government  has powers to  exempt any class of data fiduciaries or data from any of the provisions of the Act under Section 17(5) but contends that this cannot be applied to journalists. Hence the only remedy they suggestis  to declare the Act and the Rules as Void. The petitioner has not provided any suggestions on how their concern can be remedied without scrapping the law itself.

The demand is arbitrary and indicates a malicious intention to stop the progressive legislation.

The petitioners try to project GDPR as a reference to state that exemptions for Journalists are adopted in EU. This is an incomplete statement which is meant to mislead the Court.

Article 85 of  GDPR,   states as follows

Article 85: Processing and freedom of expression and information

1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
3. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.

We should note that GDPR only empowers the member states to follow their own laws related to journalists. As of date, it appears that only the following States have specific laws made in this regard.

• • Austria

  • Belgium

  • Bulgaria

  • Cyprus

  • Czech Republic

This means that there are other 22 States of the EU which have not followed Article 85 of GDPR.

In most countries exemptions are provided on a case to case basis and with certain eligibility criteria such as “Registered Journalists”.

Are the petitioners ready for the Government or DPBmber to introduce a “Registration System”? for Journalists to be exempted from DPDPA?

It would not be a bad idea to introduce a registration system for all “Digital Journalists” who want to be provided a recognition with an exemption from DPDPA.

We remember that Mr Kapil Sibal himself when he was the Minister in the Government of India had suggested that all bloggers should be registered with the Government.

Some time back the MeitY had introduced self regulation of digital media and had proposed online registration of digital publishers.

This system can now be pursued and registered Digital Publishers including Youtube bloggers can be given an option to register as “Ethical Digital Journalists” who will abide by certain rules and can also avail the exemptions fron certain provisions of DPDPA for their journalistic research and publication.

What is required is to add an explanation to the Section  Rule 16 of DPDPA Rules-Nov 13, (Second schedule)  or add an additional rule for Section 17(2)(b) and make it applicable only to registered journalists.

Section 17(2)(b) which states:

The provisions of this Act shall not apply in respect of the processing of personal data—necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.

Since a journalist does not take any decision about the data principal, his research confined to journalism is already exempted under this section. Whether the research is a fact finding research or an investigative research or a RTI research, as long  as the intention is limited to “Research” this section is a sufficient protection to journalism.

Hence there is no reason to tamper with the law any further.

Naavi

Refer:

(Please refer to the views of Naavi in 2004 on registration of Blog owners)

Kapil Sibal’s views in 2011

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

The petition of Mr Venkatesh Nayak against DPDPA was restrained in praying only for Section 44(3) removal and a few other sections, which we have discussed in detail in the previous series of articles.

In comparison, the petition of  the Reporter’s Collective Trust and Mr Nitin Sethi is conspicuous with its summary demand for declaring the whole of DPDPA 2023 and the whole of the Rules as void.

The demand is ridiculously excessive and indicates no intention of real concern  on public interest but reflects only the anti Government agenda to stop whatever good can happen. It is difficult to understand how petitioners call themselves as supporters of Privacy when they are trying  to dismantle the very law meant to protect privacy.

We all know that no law is perfect. Some times laws need to be explained through the rules and even  amended in a short time. In a complicated law like DPDPA which  seeks to balance multiple rights under the constitution, differences are inevitable and we should learn  to manage them rather than try to scuttle the law  itself.

Wisemen  warn “Don’t Cutoff your nose if you have Cold”.  Unfortunatey the petitioners who want the act to be  scrapped because of some disaagreements have not heard of this proverb.

This petition has highlighted the following concerns/view points that can be contested..

1. Right to Information is  a fundamental right under Article 19(1)(a) as per earlier Supreme Court judgements.
2. Right to information is essential for carying out the  function of a Journalist and the Act does not provide exemption for journalists.
3. Amendment in Section 44(3) has no legitimate aim under Article 19(2)
4. Proposed amendment interfers with the social audits that a journalist wants to conduct
5. DPDPA applies only to digital information where as RTI applies to all kinds of records and hence DPDPA provision is unreasonable.
6. Disclosure under Section 8(2) of RTI act is discretionary and 8(1)(j) offers a better standard.
7. K S puttaswamy  judgement should not apply to public purpose activities including journalism.
8. Exemption for research under Section 17(2)(b) is not applicable to journalistic reports
9. Section 12 mandates immediate deletion on withdrawal of consent, evidence of a journalistic report may be not available for post facto validation.
10. Whole of the Act and the Rules are void for “Vagueness”.
11. Though Section 17(5) provides for a provision for exemption, Central Government does not have powers to exempt for journalistic purpose.
12. Government calling for information from a data fiduciary is violative of the constitution and gives raise to “Potential for Abuse”.
13. Even when a disclosure of personal information is prejuddicial to the sovereignty and integrity of India, it cannot be prevented from being released under RTI.
14. Section 36 enables “Unreasonable data searches” and hence against the Puttaswamy judgement
15. Because the Central Government has a range of less inrusive alternatives including obtaining independent authorization from a Court, there is no need for Section 36.
16. Data Protection Board lacks independence
17. DPB functioning as a digital office is exclusionary.
18. Penalties from Rs 50 crores to Rs 250 crores are exaggeratry.

We appreciate the ingenuity of the petitioners in picking out very many points out of the act and the rules to be objected to,  there are umpteen contradictions within the petition. In some cases they swear by the Puttaswamy judgement and in somce cases they want it to be violated.

The net impression is that this petitioner does not tolerate the existence of the Government itself and does not want  the Government to have any powers of Governance. They respect Puttaswamy judgment but want the Act to be  scrapped. The argument are highly speculative and does not merit even basic consideration.

The only point they make is “Journalism should have some exemptions”. They admit that the act has the power of exemption but still claim that Government does not have the power. The petitioners are confused about what they want and express it  with clarity.

This petition deserves to be rejected with a directive to correct and resubmit making it more specific, avoiding self contradictions.

We will continue our discussions on some of  the individual points and highlight the contradictions.

Naavi

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

Let us now continue on our discussion on the petition of Mr Venkatesh Nayak on Sections 17(1) (c) and 17(2) as well as  33(1) and 36 which are sought to be scrapped.

The petition says that Sections 17(1)(c) and 17(2)(a) and 17(2)(b) empowers “Disproportionate surveillance” by granting sweeping exemptions both to State and Non-State instrumentalities”  without any objective scrutiny or statutory responsibility, under garb of crime preventin. It also alleges that the collection can be indiscriminate and can be used for policing using predictive algorithms. The lack of safeguards is allegedely failing the proportionality test. The petitioner states that there is no legitimate reason to exempt state actors from being bound by statutory obligations under the DPDPA. even for research and statistical purposes.

Let us recall what the two sections state.

Section 17(1)(c):  The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where—personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India;

Section 17(2)

The provisions of this Act shall not apply in respect of the processing of personal data—

(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and

(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.

It appears that the learned counsels have either not read the sections diligently or  trying to mislead the Court with wrong statements.

Section 17(1)

Firstly, Section 17 (1) does not provide “Sweeping powers”. The powers are restricted to exemptions under Chapter II which relate to consent and other obligataions,  Chapter III which relates to Right and Section which relates to Cross border transfer. Even under Chapter II Sections proviions of  8(1) and Sectio 8(5) are not exempted.

Section 8(1) relates to the appointment of a data processor and Section 8(5) relates to protection of personal data.

The petitioner’s concern  that the data collected for law enforcement would be algorithmically analysed to create biases etc is a pure figment of imagination particularly without the processing being done by private sector data processors or joint data fiduciaries.

Further the purpose related to prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India is directly pointing to constitutional exceptions under Article 19(2) which even Justice Puttaswamy Judgement has recognized.  Limited exemptions related to exceptions under Constitutions cannot be called “Sweeping exemptions”. If the petitioner is serious, we can also state that they are making sweeping statements to mislead the Court and implying speculative fears which does not exist.

We should also note that the same exemptions of Chapter II except Section 8(1) and 8(5), Chapter III and Section 16 is also available to many other instances by the private sector including notified startups, during mergers and acquisitions and during recovery of bad debts by financial institutions. Does the petitioner also allege that these private sector agencies also enjoy sweeping powers of surveillance?

It appears that the petitioners have failed to understand the exemptions properly.

Section 17(2)

Now let us turn our attention to Section 17(2) which states

The provisions of this Act shall not apply in respect of the processing of personal data—

(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and

(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.

Have the petitioners observed that for this exemption, the instrumentalities of the State also have to be “Notified”. It does not include all and sundry instruments of state. Further, such instrumentalities of state should be processing data in the interest  of sovereignty and integrity of India etc..which are exceptions under Article 19(2).

Where is the exemption to “Non State Instrumentalities” as mentioned in Ground Y of thepetition (page 30) and where is any definition of a “Non State Instrumentality”?

The objection under Ground Y desrves a summary rejection.

For the purpose of research,archiving or statistical purpose, the exemption is limited to instances where the data is  not used to take any decisions specific to a data principal. Further such data has to be  processed subject to standards that have been prescribed under Rule 5 -second schedule.

Hence under both Sections 17(1) and 17(2) there are enough safeguards to prevent misuse of data collected under these exemptions.

Why Law Enforcement Agencies need a free hand 

I would like to further reiterate, that the statement in page 31 of Venkatesh nayak petition para AA that “There is no legitimate reason to exempt the state actors ” for security purposes is a complete nonsense. It is the duty of a Government to secure the citizens and Right to Security  is a fundamental right of citizens that the Government must protect. There is no right to criminals to use Privacy as an excuse to hide their  activities and for the petitioners to support such criminals by raising objections to laws that help mitigate crime risk to the society.

Hence the grounds for considering Sections 17(1) and 17(2) as unconstitutional is not tenable.

Section 33(1)

Sectin 33(1) states

“If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.”

We donot know what the petitioners want if there is non compliance. Is it wrong for the law to specify a penalty?

Petitioners  harp on the use  of the word “Significant Data Breach”. This actually restricts the powers of the Board that for insignifiant data breaches, Board should not use the penalty provisions indiscriminately.

Naavi.org has suggested methods including the “Valuation of Data” as a measure of the harm caused and  the decision if any is appealable.

Hence the objection deserves summary rejection .

Section 36

Section 36 states

” The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for”

Again the petitioners simply speculate that the section is arbitrary. The Central Government is the administrator of the law and would require many types of information both from the Board as well as the Data Fiduciaries.  Claiming that this is “Arbitrary”, “Excessive”, “amenable for abuse”  etc is a play of words that has no relevance to the real concerns of the public.”

In summary the petition lacks genuine grounds for challenging either Section 44(3) or Section 17(1) or 1792) or 33 or 36.

Let us watch further developments in this  regard.

Naavi