The Sunday Guardian: Opinion: Sunday, 1st
November 2026.
As the Supreme Court takes up the DPDP Act, the world’s data protection laws show how democracies have tried to reconcile two rights that both matter
.jpeg)
Last week I wrote about
the constitutional tightrope of competing rights: how they are harmonised, and
where their boundaries lie. This is another case in point. A journalist
essentially works like an investigator, she checks a name against a land record,
matches a director’s identification number across two companies, reads a court
filing, calls a neighbour, writes it all down.
Painstakingly uncovering linkages, actors, actions across documents, data and personal accounts of sources. In the vocabulary of modern data protection law, each of those acts is the “processing of personal data”. The person who does it is a “controller” or a “fiduciary”, and the person written about is a “data subject” or a “data principal”, with rights that the law takes seriously.
Two goods sit in that one notebook: a citizen’s claim to privacy and the public’s claim to information. Both are constitutionally recognised in India, and neither cancels the other. How a legal system draws the line between them is one of the more delicate questions of the digital age.
In India, that question is now before the Supreme Court. On October 27, the court issued notice to the Centre on a petition by the Digital News Publishers Association, which represents 21 digital publishers. The petition challenges several provisions of the Digital Personal Data Protection Act, 2023, and the 2025 Rules.
The petitioners’ central contention is that the framework has no specific exemption for journalistic activity. Their counsel argued that this could affect news gathering and the confidentiality of sources. The court declined interim relief before hearing the Union, whose response is awaited, and listed the matter for November 17. The petition joins an earlier batch from The Reporters’ Collective, the National Campaign for People’s Right to Information and RTI activist Venkatesh Nayak.
Those focus largely on the Act’s amendment to Section 8(1) (j) of the Right to Information Act, and the court has observed that they raise complex and constitutionally sensitive questions. The government, for its part, has maintained that press freedom will be protected. The constitutional questions are for the court, and this piece does not presume to answer them.
What may be useful, while the court deliberates, is a wider view, because India is hardly the first democracy to face this problem. Every major data protection regime of the past two decades has had to decide what to do with journalism. Their answers form a spectrum: wide exclusions at one end, narrowly conditioned exemptions at the other, and a great deal of careful drafting in between.
The European Union’s General Data Protection Regulation is often assumed to exempt journalists. It does not, quite. Article 85 instead obliges each member state to reconcile data protection with freedom of expression in its own law. The result is a patchwork: the Nordic countries are broadly generous, others more restrictive. The Court of Justice of the European Union has supplied an interpretive spine.
In Satamedia (2008), and again in Buivids (2019), a case about a man who filmed police officers and posted the video on YouTube, it held that journalism is defined by purpose, the disclosure of information and ideas to the public, rather than by whether the person is a professional or works for a media house. The court also held that the exemption is not absolute. It applies only so far as it is necessary.
The United Kingdom’s 2018 Act turns this into a working test. Processing must be with a view to publication. The controller must reasonably provision on journalists’ sources. Indonesia’s 2022 law, by contrast, has no such exemption, and press groups there have raised concerns. A comparative map, in short, shows a range of choices rather than a single template. The record also counsels caution in both directions.
Where an exemption is thin, or a regulator reads it narrowly, data protection procedures can become a tool for the powerful. A widely discussed Hungarian decision of 2020 penalised Forbes Hungary for not individually notifying a family included in its rich list, though the data came from public company records. A later decision of the same authority on a similar list was seen by observers as giving more weight to press freedom. Regulators, too, learn. believe that publication is in the public interest.
And complying with a given obligation must be incompatible with the journalistic purpose. Throughout, the controller must have regard to recognised codes of practice. The exemption is real but conditional, and newsrooms there have learned that it must be reasoned and documented, not merely asserted. Others travel further. Brazil excludes processing carried out exclusively for journalistic purposes from the scope of its law altogether.
South Africa does the same, but only to the extent needed to reconcile privacy with freedom of expression in the public interest, and it ties that judgment to codes of conduct. Australia takes an institutional route. Media organisations are exempt when acting in the course of journalism, provided they are publicly committed to privacy standards, and the exemption does not cover their advertising or subscription business.
Canada’s private-sector law excludes data collected for journalistic purposes. Kenya, Nigeria, Thailand and the Philippines have each written some version of the carve-out, with their own conditions, and the Philippines adds a specific in J&K. Whether this was sheer incompetence or a subtle sleight of the hand to allow the terrorists to gain the upper hand and separate J&K from India is open to question. Whatever the case may be, one thing is certain—there was no concerted attempt by the Farooq Abdullah government to protect the Kashmir Pandits.
He fiddled (like Nero) as Kashmiri Pandits continued to be slaughtered day after day, culminating to January 19, 1990, when overnight, hundreds of Kashmiri Pandit families, women, elders and children with nothing more than the clothes on their backs abandoned their homes they or their families had lived in for decades or centuries and fled the Valley using any means of transport they could find.
By dawn hundreds of towns and villages had been emptied of the KP population. For a man who presided over the ethnic cleansing of Kashmiri Pandits from Kashmir, it is a little rich to claim that Muslims are being persecuted in India based on a few questionable and isolated events. Equally, where an exemption is too broad, privacy becomes the casualty. The people journalists write about are people, and the right affirmed in Puttaswamy belongs to them as fully as to anyone else.
A wide exemption keyed to identity rather than purpose could be claimed by anyone with a website and a grievance, and there are commercial actors who would happily dress data harvesting in a press card. This is why the more careful regimes protect the act of journalism, condition it on public interest and proportionality, and bind it to codes of conduct, so that the benefit is earned by accepting a discipline.
The question is not privacy versus the press. It is how to give each its due when they meet in the same notebook. Seen this way, the international experience offers less a verdict than a vocabulary: purpose and entity, exclusion and exemption, public interest, necessity, proportionality, codes and sources. Whatever the court decides, and whatever course policy takes afterwards, these are the terms in which the debate will have to be conducted.
Newsrooms, meanwhile, may find it prudent to do what their counterparts elsewhere have done regardless of what the law finally says. That means writing down their own standards for handling personal data, documenting the public interest behind sensitive stories, and treating the privacy of the people they cover as part of their own ethics rather than an external imposition. The matter returns to court on November 17, and questions of this weight are rarely settled in a single hearing.
What is already clear is that the balance struck here will shape how a great many people, reporters and the reported alike, understand the meaning of their rights in a digital republic. The digital age is not merely testing our rights; …it is rewriting the jurisprudence that defines them.
(Brijesh Singh is a senior IPS officer and an author (@ brijeshbsingh on X). His latest book on ancient India, “The Cloud Chariot” (Penguin) is out on stands. Views are personal.)
As the Supreme Court takes up the DPDP Act, the world’s data protection laws show how democracies have tried to reconcile two rights that both matter
.jpeg){kind=small}
Painstakingly uncovering linkages, actors, actions across documents, data and personal accounts of sources. In the vocabulary of modern data protection law, each of those acts is the “processing of personal data”. The person who does it is a “controller” or a “fiduciary”, and the person written about is a “data subject” or a “data principal”, with rights that the law takes seriously.
Two goods sit in that one notebook: a citizen’s claim to privacy and the public’s claim to information. Both are constitutionally recognised in India, and neither cancels the other. How a legal system draws the line between them is one of the more delicate questions of the digital age.
In India, that question is now before the Supreme Court. On October 27, the court issued notice to the Centre on a petition by the Digital News Publishers Association, which represents 21 digital publishers. The petition challenges several provisions of the Digital Personal Data Protection Act, 2023, and the 2025 Rules.
The petitioners’ central contention is that the framework has no specific exemption for journalistic activity. Their counsel argued that this could affect news gathering and the confidentiality of sources. The court declined interim relief before hearing the Union, whose response is awaited, and listed the matter for November 17. The petition joins an earlier batch from The Reporters’ Collective, the National Campaign for People’s Right to Information and RTI activist Venkatesh Nayak.
Those focus largely on the Act’s amendment to Section 8(1) (j) of the Right to Information Act, and the court has observed that they raise complex and constitutionally sensitive questions. The government, for its part, has maintained that press freedom will be protected. The constitutional questions are for the court, and this piece does not presume to answer them.
What may be useful, while the court deliberates, is a wider view, because India is hardly the first democracy to face this problem. Every major data protection regime of the past two decades has had to decide what to do with journalism. Their answers form a spectrum: wide exclusions at one end, narrowly conditioned exemptions at the other, and a great deal of careful drafting in between.
The European Union’s General Data Protection Regulation is often assumed to exempt journalists. It does not, quite. Article 85 instead obliges each member state to reconcile data protection with freedom of expression in its own law. The result is a patchwork: the Nordic countries are broadly generous, others more restrictive. The Court of Justice of the European Union has supplied an interpretive spine.
In Satamedia (2008), and again in Buivids (2019), a case about a man who filmed police officers and posted the video on YouTube, it held that journalism is defined by purpose, the disclosure of information and ideas to the public, rather than by whether the person is a professional or works for a media house. The court also held that the exemption is not absolute. It applies only so far as it is necessary.
The United Kingdom’s 2018 Act turns this into a working test. Processing must be with a view to publication. The controller must reasonably provision on journalists’ sources. Indonesia’s 2022 law, by contrast, has no such exemption, and press groups there have raised concerns. A comparative map, in short, shows a range of choices rather than a single template. The record also counsels caution in both directions.
Where an exemption is thin, or a regulator reads it narrowly, data protection procedures can become a tool for the powerful. A widely discussed Hungarian decision of 2020 penalised Forbes Hungary for not individually notifying a family included in its rich list, though the data came from public company records. A later decision of the same authority on a similar list was seen by observers as giving more weight to press freedom. Regulators, too, learn. believe that publication is in the public interest.
And complying with a given obligation must be incompatible with the journalistic purpose. Throughout, the controller must have regard to recognised codes of practice. The exemption is real but conditional, and newsrooms there have learned that it must be reasoned and documented, not merely asserted. Others travel further. Brazil excludes processing carried out exclusively for journalistic purposes from the scope of its law altogether.
South Africa does the same, but only to the extent needed to reconcile privacy with freedom of expression in the public interest, and it ties that judgment to codes of conduct. Australia takes an institutional route. Media organisations are exempt when acting in the course of journalism, provided they are publicly committed to privacy standards, and the exemption does not cover their advertising or subscription business.
Canada’s private-sector law excludes data collected for journalistic purposes. Kenya, Nigeria, Thailand and the Philippines have each written some version of the carve-out, with their own conditions, and the Philippines adds a specific in J&K. Whether this was sheer incompetence or a subtle sleight of the hand to allow the terrorists to gain the upper hand and separate J&K from India is open to question. Whatever the case may be, one thing is certain—there was no concerted attempt by the Farooq Abdullah government to protect the Kashmir Pandits.
He fiddled (like Nero) as Kashmiri Pandits continued to be slaughtered day after day, culminating to January 19, 1990, when overnight, hundreds of Kashmiri Pandit families, women, elders and children with nothing more than the clothes on their backs abandoned their homes they or their families had lived in for decades or centuries and fled the Valley using any means of transport they could find.
By dawn hundreds of towns and villages had been emptied of the KP population. For a man who presided over the ethnic cleansing of Kashmiri Pandits from Kashmir, it is a little rich to claim that Muslims are being persecuted in India based on a few questionable and isolated events. Equally, where an exemption is too broad, privacy becomes the casualty. The people journalists write about are people, and the right affirmed in Puttaswamy belongs to them as fully as to anyone else.
A wide exemption keyed to identity rather than purpose could be claimed by anyone with a website and a grievance, and there are commercial actors who would happily dress data harvesting in a press card. This is why the more careful regimes protect the act of journalism, condition it on public interest and proportionality, and bind it to codes of conduct, so that the benefit is earned by accepting a discipline.
The question is not privacy versus the press. It is how to give each its due when they meet in the same notebook. Seen this way, the international experience offers less a verdict than a vocabulary: purpose and entity, exclusion and exemption, public interest, necessity, proportionality, codes and sources. Whatever the court decides, and whatever course policy takes afterwards, these are the terms in which the debate will have to be conducted.
Newsrooms, meanwhile, may find it prudent to do what their counterparts elsewhere have done regardless of what the law finally says. That means writing down their own standards for handling personal data, documenting the public interest behind sensitive stories, and treating the privacy of the people they cover as part of their own ethics rather than an external imposition. The matter returns to court on November 17, and questions of this weight are rarely settled in a single hearing.
What is already clear is that the balance struck here will shape how a great many people, reporters and the reported alike, understand the meaning of their rights in a digital republic. The digital age is not merely testing our rights; …it is rewriting the jurisprudence that defines them.
(Brijesh Singh is a senior IPS officer and an author (@ brijeshbsingh on X). His latest book on ancient India, “The Cloud Chariot” (Penguin) is out on stands. Views are personal.)
.png)
.JPG)
.JPG)
