How a four-word clause in India's data protection law may have silenced the RTI

By A Representative 

A public interest litigation has been filed in the Supreme Court of India challenging the constitutional validity of several provisions of the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, with the petitioner arguing that these laws have dealt a severe blow to citizens' fundamental right to information and have effectively gutted the Right to Information Act of its most essential safeguards.

The petition, filed by Venkatesh Nayak, human rights and transparency advocator with the help of well known apex court lawyer Vrinda Grover, under Article 32 of the Constitution, seeks a declaration that Section 44(3) and Sections 17(1)(c), 17(2), 33(1), and 36 of the DPDP Act, as well as Rules 17 and 23(2) of the DPDP Rules, 2025, are ultra vires the Constitution of India.

At the heart of the petition is a challenge to Section 44(3) of the DPDP Act, which came into effect on November 13, 2025, vide GSR 843(E). This provision amended Section 8(1)(j) of the Right to Information Act, 2005, substituting what was a nuanced, three-pronged exemption with a blunt, four-word clause that now simply states that there is no obligation to disclose "information which relates to personal information." The petitioner contends that this amendment has erased all the balancing safeguards that were built into the original RTI framework, stripping away the test of public activity, the test of unwarranted invasion of privacy, and crucially, the mandatory public interest override that previously allowed authorities to direct disclosure whenever larger public interest so demanded. What remains, the petition argues, is an unchecked blanket bar on the disclosure of personal information, with no mechanism to weigh it against the public's right to know.

The right to information and the right to know, the petition underscores, are not statutory privileges but fundamental rights flowing from Articles 19(1)(a) and 21 of the Constitution, recognized as such by the Supreme Court in landmark judgments including PUCL vs Union of India (2003) 4 SCC 399, Union of India vs Association for Democratic Reforms (2002) 5 SCC 294, and Reliance Petrochemicals vs Proprietors of Indian Express Newspapers (1988) 4 SCC 592. The RTI Act of 2005 had given statutory expression to these rights, and its Section 4(1)(b) had obligated public authorities to proactively disclose information. The exemptions carved out under Section 8(1) were always intended to be narrow and carefully limited, with the burden of justifying any denial resting squarely on the Public Information Officer.

The petitioner argues that when the amended Section 8(1)(j) is read alongside the broad definition of "personal data" in Section 2(t) read with Section 3(a)(ii) of the DPDP Act, the combined effect is to bring within the ambit of the exemption virtually any information that even remotely relates to the identity of a person. This, the petition contends, would allow the executive to deny information about public functionaries performing public duties merely by invoking the personal nature of that information, making the right to information entirely illusory in practice.

The petition identifies multiple constitutional infirmities in the amendment. It argues that the new provision constitutes an unreasonable restriction on free speech and expression under Article 19(1)(a), noting that privacy is not even a listed ground for restriction under Article 19(2). It further contends that the State cannot claim the fundamental right to privacy, and that the provision violates Article 14 by treating the privacy interests of public functionaries on the same footing as those of ordinary citizens. The petitioner also asserts that the amendment fails the five-pronged constitutional proportionality test, grants unguided and arbitrary discretion to the executive, and inverts the established jurisprudence on the interplay between privacy and the right to information, as laid down in PUCL vs Union of India and reiterated in KS Puttaswamy vs Union of India (2019) 1 SCC 1.

Beyond the RTI amendment, the petition also challenges the manner in which the Data Protection Board of India is to be constituted. Rules 17(1) and 17(2) of the DPDP Rules provide for Search-cum-Selection Committees to recommend the Chairperson and other members of the Board, but the petitioner submits that the composition of these committees reflects excessive executive dominance. Since the Board exercises quasi-judicial functions, allowing the executive to effectively control its composition violates, the petition argues, the constitutional doctrine of separation of powers.

Turning to provisions yet to come into force, the petitioner challenges Sections 17(1)(c) and 17(2) of the DPDP Act, which permit the exemption of entire classes of data fiduciaries or data processing activities from the Act's provisions, either in part or in full. The petition submits that these exemptions, without accompanying safeguards or any mechanism for independent review, effectively enable a surveillance regime, failing the necessary safeguards prong of the constitutional proportionality test. Section 36, which allows the Central Government to call for any information from Data Fiduciaries without any statutory guidance limiting the scope or purpose of such demands, is challenged as manifestly arbitrary and violative of Article 14.

The petition also targets Section 33(1), which deals with penalties for data breaches. The provision conditions the imposition of penalties on a finding that a breach was "significant," without defining what would constitute significance. The petitioner argues that this vagueness confers unbridled discretion on the Data Protection Board and brings the provision squarely within the constitutional vice of arbitrariness under Article 14.

Sections 17(1)(c), 17(2), 33(1), 36, and Rule 23(2) of the DPDP Rules, while notified alongside Section 44(3) on November 13, 2025, are scheduled to come into force only eighteen months after their notification. Nonetheless, the petitioner has chosen to challenge them at this stage, arguing that their impending commencement makes it imperative to seek preventive judicial intervention.

In its concluding submissions, the petition frames the stakes in sweeping terms, describing the DPDP amendment to the RTI Act as a death knell for participatory democracy and a threat to two decades of transparency norms that have governed the life of public authorities in India. The petition urges the Supreme Court to declare the challenged provisions unconstitutional before what it calls a fallacious legislative attempt to uphold privacy results in an era of dark opacity for Indian governance. The petition is yet to be listed for hearing before the Court.