I have argued for three years that the DPDP Act must be workable before it is perfect. This week's challenge by news publishers forces a correction I should have made earlier: the Act carries no journalism exemption, and s.44(3) has deleted the public-interest override in the RTI Act. I propose reading in a journalism exemption on the Srikrishna-draft model with a public-interest test, restoring the RTI override, and placing the burden of proving "personal" versus "public-interest" data on the fiduciary, with reasoned classification orders published by the Data Protection Board.
I have spent three years arguing that the Digital Personal Data Protection Act, 2023 is workable, and that its Rules should be judged by whether ordinary organisations can actually follow them. I am not going to pretend this week's news leaves that position untouched. It does not. Reading two editorials that appeared on the same morning, I found myself agreeing with a criticism I had been slow to make.
The Hindu, on 30 October 2026, put the hole plainly:
The absence of a specific exemption for journalistic activity could subject reporters investigating official misconduct or corruption to the obligations of a "data fiduciary", requiring them to notify and seek consent from the very individuals they are investigating.
That is the whole problem in one sentence. The Digital News Publishers Association, representing 21 publishers and broadcasters, has taken it to the Supreme Court. The Court has issued notice and the government is to reply by 17 November (NewsBytes, 29 October 2026). The Telegraph's editorial the same morning was blunter still: a person who has done wrong will never consent to its disclosure.
The record is hard to defend. The 2018, 2019 and 2021 drafts each carried an exemption for journalism. The 2023 Act dropped it, while keeping an exemption in s.17 for research and statistical purposes. If a statistician is protected, a reporter is owed at least as much (Civilsdaily, 30 October 2026).
Section 44(3) compounds it. It amended s.8(1)(j) of the RTI Act, 2005 and removed the public-interest qualification for disclosing personal information. In May 2025 I wrote about civil society's demand for a rollback of exactly this change, in a post I titled simply RTI Act. In March this year, in What Counts As Personal Data, I set out the tests the Court might use to separate personal from public-interest information: identifiability, context, proportionality. What I did not say loudly enough is that the burden of applying those tests cannot sit on the journalist.
So, three things I would ask Parliament and the Court to do:
- Read in a journalism exemption on the Srikrishna-draft model, tied to a public-interest test, protecting the activity of newsgathering and not the identity of the employer.
- Restore the public-interest override in s.8(1)(j) of the RTI Act.
- Place the burden of proving that a piece of data is "personal" rather than "public-interest" on the fiduciary, not on the person asking. And let the Data Protection Board publish reasoned classification orders, so that what counts as personal data is settled by precedent rather than by the fear of a ₹250 crore penalty.
The clock has not stopped. The compliance framework is expected to go live in May 2027 (ET Prime, 30 October 2026), so a correction taken now is still cheap. This Act needs one clause read back in, one clause taken out, and an honest new habit at the Board.
Shri Vaishnaw, you have indicated you will meet editors. If you do, please carry the burden question into that room. It is the part that decides whether this law protects citizens, or protects the people citizens are trying to examine.
With regards,
Hemen Parekh
www.Iam-Immortal.ai / www.IndiaAGI.ai / www.YourContentCreator.in
30 Oct 2026
No comments:
Post a Comment