Article 14: Article: Thursday, 26 February 2026.
This month, veteran information activist Venkatesh Nayak challenged provisions of the Data Protection Act, 2023, and the 2025 Rules in the Supreme Court, raising concerns about an amendment that was included without proper debate or explanation, which could cripple the Right to Information Act by creating a blanket exemption in the name of right to privacy. In effect, the government is using the right to privacy, meant to protect citizens’ data, especially from corporations, to shield information that should be disclosed in the public interest and to protect public officials from scrutiny.
This month, Venkatesh
Nayak, an information activist for more than two decades, moved the Supreme
Court, challenging key provisions of the Digital Personal Data Protection Act
(DPDP), 2023 and its 2025 Rules, arguing that they mark a “death knell for participatory
democracy”, a far-reaching shift away from open governance and toward opacity.
Nayak, director of the Commonwealth Human Rights Initiative India office, who headed the access to information program since 2005, is particularly concerned about section 44(3) of the DPDP Act, which amended section 8(1)(j) of the Right to Information Act (RTI), 2005, which would have a sweeping and near-blanket exemption for “personal information”.
This would turn the 20 years of jurisprudence on the right to information and turn the transparency framework on its head, prioritising privacy over the public’s right.
The petition says the amendment has effectively stripped away the original three-part safeguard that balanced privacy with transparency in the RTI Act: the tests of public activity, unwarranted invasion of privacy, and the mandatory public interest override to facilitate disclosure.
“It allows the executive to deny information to citizens by citing the personal nature of the information, even for public functionaries entrusted with public duties,” the petition said.
“It is a death knell for participatory democracy, and ruinous to ideas of open governance, which must guide the Indian polity in consonance with the Constitutionally recognised fundamental right of the citizen to know and be informed,” it said.
The petition said “no public consultation or legislative debate was conducted on the impact of the amendment to provisions of the RTI Act, 2005, as the amendment was not separately tabled in Parliament with specific attention on the RTI Act.”
Beyond the RTI amendment, the petition challenges provisions—sections 71 (1) (c), 17(2) and 33 (1) and 36, and rule 23 (2)—that grant sweeping exemptions to state agencies for data collection and processing, warning that they enable disproportionate surveillance without meaningful oversight.
The petition raises concerns about constituting a government-dominated search cum selection committee with quasi-judicial powers under rule 17, as violating the separation of powers, given that the central government and agents are likely to be significant litigators.
At its core, the issue is about balancing two fundamental rights: the right to privacy, which the DPDP Act seeks to protect, and the right to information, which enables citizens to hold power to account.
This conflict is made even more acute in a digital economy where large corporations collect and process vast amounts of personal data.
The challenge is not against strong privacy protections, especially given the scale of corporate extraction of people’s data, but rather the state's increasingly blanket invocation of privacy to deny information, even when it relates to public functions and accountability.
Meanwhile, the government has been gathering more and more data on citizens through official records and surveillance while releasing broad statistics on welfare schemes that make it seem transparent.
But when it comes to key areas like electoral data or information that could hold public officials accountable, getting information has only become more difficult.
In this interview, we talk to Nayak about why he thinks the public’s right to know should come first in matters of public interest, even when privacy is claimed, how little public consultation there is around significant legal changes, and how this legal battle could shape the future of transparency in India.
“On the one hand, what has been happening since 2014 is that the government is increasingly interested in collecting information about citizens, either through legitimate means or through surveillance that is completely opaque,” said Nayak.
“At the same time, they are also curtailing the citizens' right to know what the government is doing,” he said. “They want the citizenry to be increasingly transparent with them, but the state’s obligation to be transparent is diminishing year after year.”
What is the DPDP Act? What is the amendment?
The Digital Personal Protection Act has been in the making for several years now. The first attempt was made by the Department of Personnel and Training and MEITY (ministry of electronics and information technology) under the UPA (Congress Party-led United Progressive Alliance) government, due to significant pressure from Western business entities to protect their personal data when they came to India to do business. And then, with the expansion of e-commerce, the collection of data by private agencies increased astronomically year after year. Before the launch of Uber and Ola, we would simply call up a taxi service or hail a three-wheeler from the road. There was no one who would collect data about who you are, from which place to which place you travelled, how many times you used a taxi and where exactly you were at every second when you were travelling.
The old days.
The old days. Now, the complete opposite is happening with these apps. They are collecting a lot of data about us, and we don’t even know about it. Another example is that I’m flipping through websites on Google, and within seconds, I see advertisements for a commodity or service I may have looked at, which then land in my email inbox. If I look for a chocolate cake to send to a friend on their birthday—and this is my personal experience— there will be advertisements for chocolate cake on the news curated for me through Google. This is the private sector surveilling people's surfing habits. A necessity was recognised way back in the UPA government: there had to be a way to protect people’s privacy. However, privacy is a broader concept. The Planning Commission, the predecessor of the Niti Ayog, set up a committee under the chairmanship of Justice AP Shah to examine the need to bring a law to protect personal data privacy, including data that is or is not digitised. They said there is a need for a data protection law, which is one dimension of the right to personal privacy.
Privacy can mean many things. Since the 1960s, constitutional jurisprudence on personal privacy has extended to the non-interference by state authorities in one’s personal affairs. The police cannot simply walk into your house on the claim that they want to check whether a law is being violated, nor can they intercept your personal correspondence or dig into your bank transactions. There has to be lawful authority and a proper procedure followed.
What is the major concern?
Leaving aside some of the key provisions that are hugely problematic in the DPDP Act itself, what it does in its current form is to put a blanket ban on citizens' right to access personal information about anyone else. The right to access information about anyone else was not available in an unrestricted manner under the original RTI Act. There is an exception under 8 (1) (j), which states that disclosure of information may be refused if it has no public interest, is not related to any public activity, or may cause an unwarranted invasion of the individual's privacy. However, if the public information officer believed that this information was fit for disclosure in the public interest, he had a statutory duty to disclose it. In addition to that, there was a proviso that said information which cannot be denied to Parliament shall not be denied to citizens. Now, all of these safeguards are gone because of the amendments, and the denial of personal information is the default option.
There is a lot of information that can be made public even without people filing RTIs under section 4 (1) (b). One clause states that all information about government subsidy programs and their beneficiaries should be publicly available. Another says, people who are given permits, authorisations, concessions, all of that would be put in the public domain voluntarily, gun licenses, licenses to run, cinema halls, restaurants, or even be concessions in paying income tax, would be put in the public domain voluntarily. Many business people receive concessions. These are important proactive information disclosure elements.
Because of the amendment, a line has been added—information relating to personal information; there is no obligation to disclose any of this information. That is the amended form of the RTI Act through the DPDP Act.
The parity between citizens and elected public officials has also been removed. The earlier test, whether information sought by an RTI applicant can be disclosed to Parliament or the State legislatures, has been removed. The irony is that the people who elected them passed this amendment, telling the very citizens who elected them that they don’t have the right to access the same information they themselves do when it concerns personal information.
In the judges' assets case, Subhash Chandra Agrawal versus the Supreme Court of India (2009), a five-judge constitutional bench said that protection for personal information available to private individuals is not of the same level as that for public servants, MPs, MLAs, and police officers. They cannot claim the same standard of protection under privacy law as private citizens. If a police officer has been authorised to use a jeep for official work, the public has the right to know how the jeep was used, unless another exemption applies, for example, the information could impede an investigation. However, if the police officer used the jeep to pick up his wife and children and go to the market, that is information of public interest because the jeep is not intended for the officer's personal use. How much money have you invested in mutual funds, and how much premium are you or I paying for life insurance cover is personal information that cannot be disclosed, but if you or I decide to contest elections and decide to be a representative of the people, then all that information has to be disclosed on an affidavit because, in 2003, the Supreme Court said, the voter has the right to know all this information.
What is the big worry?
Because there are sweeping powers of the government to deny every personal information—in addition to the amendments being made in the RTI Act section 44(3)—they can exempt entire swathes of information which are already in the public domain and prevent them from being disclosed or they can actually call for information about you or I, and say we needed them for security purposes, and they don’t have any obligation of performing those very basic duties of informing us what information has been called for by us, how long will they use it, how long will they keep it, how will it be stored, how will they ensure no one else can access that information.
These are called the individual's data protection rights, which the DPDP Act establishes a system for, and you have the right to know who has collected what data about you. I can file a request with Amazon for the information they have about me, and they cannot deny it. They are bound to disclose, but the government does not have to. They can say we are using it for security purposes, so we don’t have to give you any clarification.
These are all provisions which we have challenged through this petition because the fundamental right to know has been established over more than four decades of jurisprudence, RTI jurisprudence has been established over the last 20 years, and that is as important a fundamental right as personal data protection.
What are the other problems?
There is also a big uncertainty about how the protections under the DPDP Act will apply to data that is not digitised. This law applies only to data collected in digital form or to data that was previously available in analogue form but has been subsequently digitised. But what the amendment does is take away the citizen’s right to access even non-digitised data by making a blanket exemption under section 8 (1) (j) of the RTI Act.
The data protection board, which is designed to be government-dominated, performs quasi-judicial functions. However, the government will often be an interested party in the disputes. When a body such as a data protection board performs quasi-judicial functions, there must be some measure of autonomy from the government in selecting its members. That is also something we have challenged. It goes against the principles of ensuring the autonomy for these kinds of bodies that perform quasi-judicial functions.
How did such a major change come about to the RTI without pushback or opposition?
That is another point we have mentioned in our petition. There was no separate consultation on the amendment to the RTI Act. It was simply fitted into the DPDP Bill. That Bill, to the best of my knowledge, did not go before any Parliamentary committee or House select committee. The single point of why there was a need for amending section 8 (1) (j) and removing that proviso was not explained in the note on the clause-by-clause explanation of the Bill. Cabinet notes related to this amendment were denied to various RTI applicants. Nevertheless, there was significant public and visible opposition articulated by civil society actors, NGOs, academics, and journalists. The Opposition tried to raise some of these issues during the debate on the Bill, but the government, in its wisdom, steadfastly refused to undertake any widespread public consultation on why the RTI Act had to be amended in this manner.
The funny part was that when they put the initial draft of the Bill in the public domain, it was so sketchy. It was just a few pages long. The entire scheme of the DPDP Act was not put up for public consultation. When they put the draft rules out for consultation, they included a rider stating that any views or comments from the public on the draft rules would also be treated as confidential. So, what kind of recommendations were made by whom is also not publicly known.
This goes against the methodology of the basis of public consultation in other countries we have entered into free trade agreements now, like the UK, the EU, and the USA. When there is 20 years of jurisprudence available in terms of balancing, transparency, and protecting personal privacy, why is it that an amendment had to be made in such a manner that personal privacy becomes a blanket ban on disclosure? There is simply no explanation.
Give an example of how this would change things?
Until about the Covid period, the media was very happy reporting on the PM Kisan Yojna. There were some local news reports coming out that said there are farmers who are technically ineligible who are getting benefits. After reading those news reports, I filed an RTI seeking the number of instances across the states in which farmers have been found ineligible. I did not ask for names. The PM Kisan dedicated website publishes the names of beneficiaries. Now you need to put out the names of people who have been found ineligible. Not only did they give me data showing that more than 1,300 crores had been distributed to ineligible farmers, and district-wise breakups, but the appellate authority also directed the NIC, which maintained the website for PM Kisan beneficiaries, that the names of ineligible beneficiaries had to be given village-wise. I know of at least one instance in West Bengal where an RTI activist used the information to file complaints with the district agricultural officer, demanding that the names of ineligible beneficiaries should be removed.
Under the DPDP Act, the government has discretion to withhold the names of beneficiaries or their bank account details. They will provide only dashboard data: so many instalments amounting to 1000s of crores of rupees have been disbursed, and there are so many crore farmers. Nothing beyond that.
Give an example that the middle class will care about?
There is this huge issue about reservation quotas and their misuse. A large number of cases that reach the High Courts and even the Supreme Court involve the practice of fudging of caste certificates. In the initial years of RTI jurisprudence, caste certificates were not made public. In recent years, a judgment from Madhya Pradesh requires that this information be made public because there are many instances of misuse, and people who should not have been given the benefit of the reservation quota take it. If you don’t have caste certificates in the public domain, then how can one challenge the appointment of a person who should not have been appointed on a quota basis?
Give another example.
One more thing: one of the High Courts has recently said that, in the context of alimony, husbands and wives in divorce litigation will not be denied information about each other's earlier assets and earnings. Earlier, this information was denied as personal information of the estranged spouse. But in recent years, the jurisprudence has changed due to a need for transparency, as neither party will come forward and be completely truthful. They file RTIs for it. Technically, under the DPDP Act, the authorities will say we don’t have a duty to give this because it is all personal information. Under RTI, they will cite the amended 8(1)(j) and say this is personal information and there is no duty to disclose.
Another example?
There are so many hit-and-run cases that happen. There is a victim who has been struggling to get justice in court, has not had a helpful lawyer and has not been able to get full details of the ownership of the vehicle. Until yesterday, the victim could get the information under RTI. Today, technically, under the DPDP, the government can issue a circular saying private ownership cannot be disclosed.
But isn’t that a police matter? The police will find ownership details.
Today, if you do a word search for RTI Act for Manupatra (legal research website), just High Court judgements, the proportion of judgments where just RTI has been used—civil, criminal, matrimonial, environment, recruitment—to the cases where the RTI itself is a subject matter of dispute is 10 to 1. Every ten cases where the RTI has been used to get information in the context of some other litigation, there is one case where the dispute is whether I should get access under RTI or not. That is the frequency with which RTI has been used in litigation. It has helped courts a great deal in deciding matters that they would otherwise have had to issue directions for production. It reduces the wastage of the court’s time spent on summoning documents required for settling the dispute.
What is the government’s point of view on the amendment? How have they justified it?
They have made the focus of the debate in Parliament on these large corporations that collect large gigabytes of data on individuals, and they say this kind of Act is necessary to give the individual control over the data which such corporations collect. When questioned about the amendment to the RTI Act, even the attorney general has said there is no conflict caused by this amended form. The amendment through the DPDP Act does not curtail the right to know under the RTI Act. That is the bland reasoning that they give. The justification for all this is simply not publicly available.
What is the balance of protecting us from corporations and having access to information?
The balance is established by the DPDP Act, where you have the right recognised to seek information from corporations that collect it. Now, the struggle is that the state, which is run by public functionaries, cannot be allowed to claim the right to privacy for the public functions they perform. Today, there are entire sections of the DPDP Act and entire categories of information about government agencies that are available in digital or digitised form, which can be exempted without any reasoning. The State cannot claim any right to privacy for itself. The right to privacy is available only to natural persons. It is not available to government departments, police, government hospitals, private companies, churches, temples, schools, or colleges.
We are talking about this amendment within the broader context of a growing lack of transparency and efforts to ring that about since 2014. Could you talk about that context?
The larger context is this that while the government has created, not just the central government, even state governments, have created umpteen websites to put out statistical data—dashboard level transparency—but when it comes to information required for holding a public functionary or a government servant accountable for their actions, that information is not made public. Take this very case. What are the reasons behind amending 8 (1) (j) in the current manner? What has been amended is what we know. But why it has been amended has never been explained adequately by the government. They only say that the scope of the RTI Act and the scope of citizens' rights to information have not been curtailed.
Tomorrow, if the government says that information related to beneficiaries of various government schemes is being misused, it will not be made public under the DPDP Act to any third party. I cannot use the RTI Act either to get it. What is happening is that, bit by bit, first within the RTI Act and in its implementation, the government is putting a whole lot of information into black boxes, and now through the DPDP Act, they are trying to expand that sphere of confidentiality in the name of protecting people’s right to know about their own information from these private entities.
It is a downslide as far as the transparency regime is concerned. On the one hand, what has been happening since 2014 is that the government is increasingly interested in collecting information about citizens, either through legitimate means or through surveillance that is completely opaque. At the same time, they are also curtailing the citizens' right to know what the government is doing. They want the citizenry to be increasingly transparent with them, but the state’s obligation to be transparent is diminishing year after year.
It also feels like the government is extracting information about us, but curtailing our access to it.
Now they will also say private entities can withhold information. They talk about data localisation, but they also talk about data fiduciaries subject to certain conditions to take data across borders. From here, they can shift to America, and there is no duty to tell the data principal why, when, how and for how long information about that person is being given away.
But the DPDP Act at least protects us from that.
All of that will become known during implementation. It is still very much in its nascent stages. So, what is happening in the private sector viz z viz citizens’ rights, how many people are filling up consent forms, how many data fiduciaries have set up the kind of mechanisms of protecting data while processing it, very little is known. But what we are increasingly seeing is that, even before the DPDP rules were put in place, in places like Gujarat, PIOs (public information officers) had already begun implementing 8(1)(j) in its amended form.
The RTI was a big win for civil society and the public, but we are now in a completely different digital era, so how do we deal with the challenges of privacy while protecting the vision of the RTI?
The vision of the RTI was to empower citizens to stand on the same footing as public functionaries by creating a regime of transparency that leads to accountability. There is an empowerment element in the DPDP Act also which is called the right to informational self determination but the funny part is that while the RTI was subject to widespread consultation during the formulation stage because it was to empower the citizen, but this latest law which is also supposed to empower not just citizens but any person, but any person whose personal data is processed by a data fiduciary, there was hardly any public consultation of the kind which the RTI Bill generated, and any little consultation they did was also put into locked in hard disks. How can you empower the citizen by saying that the basis for making the law through which they seek empowerment will not be publicly disclosed?
How will RTI and DPDP work together?
The New Zealand ombudsmen body not only decides what information should be given under its own RTI law, but also acts as the grievance redressal authority, as far as data protection issues are also concerned. Here, you have a kind of diarchy in terms of information. For RTI, there are information commissions in each state and one for the central government. For DPDP, you will have a highly centralised and government-dominated dispute resolution mechanism, the data protection board, which will be at the central level. Benches could be set up in different states but under the central umbrella. When it comes to an issue of dispute regarding access to information, whose authority will prevail—is it the information commission’s or that of the data protection board?
Say if I need to know my spouse’s earnings in a divorce case. I will go to the information commission, but now, under the new amendment, they will say we can’t give personal information, and then refer it to the DPDP board?
Not even that bridge is there between the two laws. Here, the information commission will look at the amendment and say “blanket ban, we can’t give you this information”. And you can’t go to the data protection board to get information on your spouse because only your estranged spouse can seek information about themselves.
Scenario number 2: If there is a very progressive information commissioner who says public interest overrides and directs disclosure of personal information. Tomorrow, the person whose information was disclosed can go to the data protection board and say that my consent was not taken. Those bridging provisions between the two laws are missing.
It will be a mess.
Exactly. You cannot have two adjudicating bodies, as it creates a significant conflict.
How could this impact your work?
Every year, I file between 50 and 60 RTIs. Since 2018-2019, much of my time and work have been taken up by the lack of transparency in the electoral field. There is a whole lot of data, beyond who won and who lost, that is not publicly available. And if that information is not publicly available, we will never be able to take the baby steps to put an end to the nefarious influence of money and muscle on electoral outcomes.
Even before the DPDP Act was implemented, the Election Commission was denying access to information. My worry is that the DPDP Act and its amendment will be used to deny even the basic information we would normally receive.
Earlier, I had filed for the 2024 Lok Sabha election in Karnataka, requesting the names of officers appointed to monitor for voter intimidation at the polling station level. I got that information after paying the requisite fee. Now, under the DPDP Act, I will probably not get it, as it contains the names and mobile numbers of these officers. This is just one example. That is when I realised this is too harmful to the RTI regime.
On balance, how do you think the RTI has fared in India? What is the legacy?
It has been successful in creating demand for information in a visible way. But implementation, even during the UPA regime, was not easy. They were the first to propose amendments in the very first year of implementation. Resistance was always there, but resistance was tempered by information commissions. But now, what is happening is that the vacancies are rarely filled until the Supreme Court directs in response to public interest litigations. Then, the kind of people who have been appointed to information commissions, with very few honourable exceptions, most of them are pro confidentiality. Crucial information needed to secure accountability of government officials is increasingly being denied. Somebody’s widow pension has been stopped; they will give that information, but they won’t tell who is responsible for stopping it. Under the DPDP Act, that will become the default position.
But people are still fighting. There are a whole lot of intellectual elites who used to be RTI users, who are now happy writing obituaries to the RTI Act. But at the same time, the number of RTI applications that get filed with the central government, during Covid, went down by about 3% but after that, it has always been rising. It has not decreased. So the interest in the RTI, despite all the sob stories about how we did not get this information, is also part of reality: people are not giving up hope. That is a very positive aspect of how the citizenry at large is looking at the RTI. There has been a 4 to 5% increase in the number of RTI applications filed with the central government in 2023-2024. We are still waiting for data for 2024-2025.
What really needs to be appreciated is the ability of a person from a village or a jhuggi-jhopri cluster to file an RTI application with a BPL card or a 10-rupee fee and to stand before a government officer and demand information within 30 days. That is hugely empowering.
How well has the media covered DPDP? What do you make of the public interest?
When the RTI Bill was tabled in Parliament in 2004, it was discussed across the country, and prior to that, from 1997 onwards, there had been discussion on RTI laws primarily at the state level.Nine states passed the law. The media contributed in a big way by placing issues in the public domain, discussing the provisions threadbare when the central bill was about to be tabled in Parliament and thereafter. Unfortunately, I have not seen that kind of enthusiasm in the context of the DPDP Act. When there is a lack of media interest, how does the public even learn about the Act's implications and the regressive impact of the amendments on RTI?
This is also happening at a time when the central government has severely and adversely affected the ability of many of our organisations to go out and do the public education that we need to. Our funding has been brought to a nil. The FCRA of my own organisation (CHRI) has been taken away. That cancellation was set aside by the Delhi High Court, but the central government reinstated it a second time. The case has still not been decided, and we don’t know if we will even have funds to continue our work from June onwards. How will we go around holding workshops, even Zoom connections, if they require money? So, even civil society’s ability to go out and convey the message of what DPDP is all about has not happened the way we did with RTI. There are occasional meetings, like in Delhi, when the national campaign for people’s rights to information brings in people from different walks of life, including many living in jhuggi-jhopri clusters. These are rare instances where the message of what the DPDP Act is all about and how it negatively affects their right to know is conveyed to the people. The media has not helped much. I don’t think much of the regional press has even taken up spreading awareness about the DPDP Act with the help of explainers.
You have advocated for the right to information for more than 20 years. Is this personally painful for you?
I see it as a challenge. What I see in the future is that 8 out of 10 RTIs of mine that get rejected will now probably become 9 or 9.5 out of 10, and that is extremely concerning.
(Betwa Sharma is managing editor of Article 14.)
Get exclusive access to new databases, expert analyses, weekly newsletters, book excerpts and new ideas on democracy, law and society in India. Subscribe to Article 14.
This month, veteran information activist Venkatesh Nayak challenged provisions of the Data Protection Act, 2023, and the 2025 Rules in the Supreme Court, raising concerns about an amendment that was included without proper debate or explanation, which could cripple the Right to Information Act by creating a blanket exemption in the name of right to privacy. In effect, the government is using the right to privacy, meant to protect citizens’ data, especially from corporations, to shield information that should be disclosed in the public interest and to protect public officials from scrutiny.
Nayak, director of the Commonwealth Human Rights Initiative India office, who headed the access to information program since 2005, is particularly concerned about section 44(3) of the DPDP Act, which amended section 8(1)(j) of the Right to Information Act (RTI), 2005, which would have a sweeping and near-blanket exemption for “personal information”.
This would turn the 20 years of jurisprudence on the right to information and turn the transparency framework on its head, prioritising privacy over the public’s right.
The petition says the amendment has effectively stripped away the original three-part safeguard that balanced privacy with transparency in the RTI Act: the tests of public activity, unwarranted invasion of privacy, and the mandatory public interest override to facilitate disclosure.
“It allows the executive to deny information to citizens by citing the personal nature of the information, even for public functionaries entrusted with public duties,” the petition said.
“It is a death knell for participatory democracy, and ruinous to ideas of open governance, which must guide the Indian polity in consonance with the Constitutionally recognised fundamental right of the citizen to know and be informed,” it said.
The petition said “no public consultation or legislative debate was conducted on the impact of the amendment to provisions of the RTI Act, 2005, as the amendment was not separately tabled in Parliament with specific attention on the RTI Act.”
Beyond the RTI amendment, the petition challenges provisions—sections 71 (1) (c), 17(2) and 33 (1) and 36, and rule 23 (2)—that grant sweeping exemptions to state agencies for data collection and processing, warning that they enable disproportionate surveillance without meaningful oversight.
The petition raises concerns about constituting a government-dominated search cum selection committee with quasi-judicial powers under rule 17, as violating the separation of powers, given that the central government and agents are likely to be significant litigators.
At its core, the issue is about balancing two fundamental rights: the right to privacy, which the DPDP Act seeks to protect, and the right to information, which enables citizens to hold power to account.
This conflict is made even more acute in a digital economy where large corporations collect and process vast amounts of personal data.
The challenge is not against strong privacy protections, especially given the scale of corporate extraction of people’s data, but rather the state's increasingly blanket invocation of privacy to deny information, even when it relates to public functions and accountability.
Meanwhile, the government has been gathering more and more data on citizens through official records and surveillance while releasing broad statistics on welfare schemes that make it seem transparent.
But when it comes to key areas like electoral data or information that could hold public officials accountable, getting information has only become more difficult.
In this interview, we talk to Nayak about why he thinks the public’s right to know should come first in matters of public interest, even when privacy is claimed, how little public consultation there is around significant legal changes, and how this legal battle could shape the future of transparency in India.
“On the one hand, what has been happening since 2014 is that the government is increasingly interested in collecting information about citizens, either through legitimate means or through surveillance that is completely opaque,” said Nayak.
“At the same time, they are also curtailing the citizens' right to know what the government is doing,” he said. “They want the citizenry to be increasingly transparent with them, but the state’s obligation to be transparent is diminishing year after year.”
What is the DPDP Act? What is the amendment?
The Digital Personal Protection Act has been in the making for several years now. The first attempt was made by the Department of Personnel and Training and MEITY (ministry of electronics and information technology) under the UPA (Congress Party-led United Progressive Alliance) government, due to significant pressure from Western business entities to protect their personal data when they came to India to do business. And then, with the expansion of e-commerce, the collection of data by private agencies increased astronomically year after year. Before the launch of Uber and Ola, we would simply call up a taxi service or hail a three-wheeler from the road. There was no one who would collect data about who you are, from which place to which place you travelled, how many times you used a taxi and where exactly you were at every second when you were travelling.
The old days.
The old days. Now, the complete opposite is happening with these apps. They are collecting a lot of data about us, and we don’t even know about it. Another example is that I’m flipping through websites on Google, and within seconds, I see advertisements for a commodity or service I may have looked at, which then land in my email inbox. If I look for a chocolate cake to send to a friend on their birthday—and this is my personal experience— there will be advertisements for chocolate cake on the news curated for me through Google. This is the private sector surveilling people's surfing habits. A necessity was recognised way back in the UPA government: there had to be a way to protect people’s privacy. However, privacy is a broader concept. The Planning Commission, the predecessor of the Niti Ayog, set up a committee under the chairmanship of Justice AP Shah to examine the need to bring a law to protect personal data privacy, including data that is or is not digitised. They said there is a need for a data protection law, which is one dimension of the right to personal privacy.
Privacy can mean many things. Since the 1960s, constitutional jurisprudence on personal privacy has extended to the non-interference by state authorities in one’s personal affairs. The police cannot simply walk into your house on the claim that they want to check whether a law is being violated, nor can they intercept your personal correspondence or dig into your bank transactions. There has to be lawful authority and a proper procedure followed.
What is the major concern?
Leaving aside some of the key provisions that are hugely problematic in the DPDP Act itself, what it does in its current form is to put a blanket ban on citizens' right to access personal information about anyone else. The right to access information about anyone else was not available in an unrestricted manner under the original RTI Act. There is an exception under 8 (1) (j), which states that disclosure of information may be refused if it has no public interest, is not related to any public activity, or may cause an unwarranted invasion of the individual's privacy. However, if the public information officer believed that this information was fit for disclosure in the public interest, he had a statutory duty to disclose it. In addition to that, there was a proviso that said information which cannot be denied to Parliament shall not be denied to citizens. Now, all of these safeguards are gone because of the amendments, and the denial of personal information is the default option.
There is a lot of information that can be made public even without people filing RTIs under section 4 (1) (b). One clause states that all information about government subsidy programs and their beneficiaries should be publicly available. Another says, people who are given permits, authorisations, concessions, all of that would be put in the public domain voluntarily, gun licenses, licenses to run, cinema halls, restaurants, or even be concessions in paying income tax, would be put in the public domain voluntarily. Many business people receive concessions. These are important proactive information disclosure elements.
Because of the amendment, a line has been added—information relating to personal information; there is no obligation to disclose any of this information. That is the amended form of the RTI Act through the DPDP Act.
The parity between citizens and elected public officials has also been removed. The earlier test, whether information sought by an RTI applicant can be disclosed to Parliament or the State legislatures, has been removed. The irony is that the people who elected them passed this amendment, telling the very citizens who elected them that they don’t have the right to access the same information they themselves do when it concerns personal information.
In the judges' assets case, Subhash Chandra Agrawal versus the Supreme Court of India (2009), a five-judge constitutional bench said that protection for personal information available to private individuals is not of the same level as that for public servants, MPs, MLAs, and police officers. They cannot claim the same standard of protection under privacy law as private citizens. If a police officer has been authorised to use a jeep for official work, the public has the right to know how the jeep was used, unless another exemption applies, for example, the information could impede an investigation. However, if the police officer used the jeep to pick up his wife and children and go to the market, that is information of public interest because the jeep is not intended for the officer's personal use. How much money have you invested in mutual funds, and how much premium are you or I paying for life insurance cover is personal information that cannot be disclosed, but if you or I decide to contest elections and decide to be a representative of the people, then all that information has to be disclosed on an affidavit because, in 2003, the Supreme Court said, the voter has the right to know all this information.
What is the big worry?
Because there are sweeping powers of the government to deny every personal information—in addition to the amendments being made in the RTI Act section 44(3)—they can exempt entire swathes of information which are already in the public domain and prevent them from being disclosed or they can actually call for information about you or I, and say we needed them for security purposes, and they don’t have any obligation of performing those very basic duties of informing us what information has been called for by us, how long will they use it, how long will they keep it, how will it be stored, how will they ensure no one else can access that information.
These are called the individual's data protection rights, which the DPDP Act establishes a system for, and you have the right to know who has collected what data about you. I can file a request with Amazon for the information they have about me, and they cannot deny it. They are bound to disclose, but the government does not have to. They can say we are using it for security purposes, so we don’t have to give you any clarification.
These are all provisions which we have challenged through this petition because the fundamental right to know has been established over more than four decades of jurisprudence, RTI jurisprudence has been established over the last 20 years, and that is as important a fundamental right as personal data protection.
What are the other problems?
There is also a big uncertainty about how the protections under the DPDP Act will apply to data that is not digitised. This law applies only to data collected in digital form or to data that was previously available in analogue form but has been subsequently digitised. But what the amendment does is take away the citizen’s right to access even non-digitised data by making a blanket exemption under section 8 (1) (j) of the RTI Act.
The data protection board, which is designed to be government-dominated, performs quasi-judicial functions. However, the government will often be an interested party in the disputes. When a body such as a data protection board performs quasi-judicial functions, there must be some measure of autonomy from the government in selecting its members. That is also something we have challenged. It goes against the principles of ensuring the autonomy for these kinds of bodies that perform quasi-judicial functions.
How did such a major change come about to the RTI without pushback or opposition?
That is another point we have mentioned in our petition. There was no separate consultation on the amendment to the RTI Act. It was simply fitted into the DPDP Bill. That Bill, to the best of my knowledge, did not go before any Parliamentary committee or House select committee. The single point of why there was a need for amending section 8 (1) (j) and removing that proviso was not explained in the note on the clause-by-clause explanation of the Bill. Cabinet notes related to this amendment were denied to various RTI applicants. Nevertheless, there was significant public and visible opposition articulated by civil society actors, NGOs, academics, and journalists. The Opposition tried to raise some of these issues during the debate on the Bill, but the government, in its wisdom, steadfastly refused to undertake any widespread public consultation on why the RTI Act had to be amended in this manner.
The funny part was that when they put the initial draft of the Bill in the public domain, it was so sketchy. It was just a few pages long. The entire scheme of the DPDP Act was not put up for public consultation. When they put the draft rules out for consultation, they included a rider stating that any views or comments from the public on the draft rules would also be treated as confidential. So, what kind of recommendations were made by whom is also not publicly known.
This goes against the methodology of the basis of public consultation in other countries we have entered into free trade agreements now, like the UK, the EU, and the USA. When there is 20 years of jurisprudence available in terms of balancing, transparency, and protecting personal privacy, why is it that an amendment had to be made in such a manner that personal privacy becomes a blanket ban on disclosure? There is simply no explanation.
Give an example of how this would change things?
Until about the Covid period, the media was very happy reporting on the PM Kisan Yojna. There were some local news reports coming out that said there are farmers who are technically ineligible who are getting benefits. After reading those news reports, I filed an RTI seeking the number of instances across the states in which farmers have been found ineligible. I did not ask for names. The PM Kisan dedicated website publishes the names of beneficiaries. Now you need to put out the names of people who have been found ineligible. Not only did they give me data showing that more than 1,300 crores had been distributed to ineligible farmers, and district-wise breakups, but the appellate authority also directed the NIC, which maintained the website for PM Kisan beneficiaries, that the names of ineligible beneficiaries had to be given village-wise. I know of at least one instance in West Bengal where an RTI activist used the information to file complaints with the district agricultural officer, demanding that the names of ineligible beneficiaries should be removed.
Under the DPDP Act, the government has discretion to withhold the names of beneficiaries or their bank account details. They will provide only dashboard data: so many instalments amounting to 1000s of crores of rupees have been disbursed, and there are so many crore farmers. Nothing beyond that.
Give an example that the middle class will care about?
There is this huge issue about reservation quotas and their misuse. A large number of cases that reach the High Courts and even the Supreme Court involve the practice of fudging of caste certificates. In the initial years of RTI jurisprudence, caste certificates were not made public. In recent years, a judgment from Madhya Pradesh requires that this information be made public because there are many instances of misuse, and people who should not have been given the benefit of the reservation quota take it. If you don’t have caste certificates in the public domain, then how can one challenge the appointment of a person who should not have been appointed on a quota basis?
Give another example.
One more thing: one of the High Courts has recently said that, in the context of alimony, husbands and wives in divorce litigation will not be denied information about each other's earlier assets and earnings. Earlier, this information was denied as personal information of the estranged spouse. But in recent years, the jurisprudence has changed due to a need for transparency, as neither party will come forward and be completely truthful. They file RTIs for it. Technically, under the DPDP Act, the authorities will say we don’t have a duty to give this because it is all personal information. Under RTI, they will cite the amended 8(1)(j) and say this is personal information and there is no duty to disclose.
Another example?
There are so many hit-and-run cases that happen. There is a victim who has been struggling to get justice in court, has not had a helpful lawyer and has not been able to get full details of the ownership of the vehicle. Until yesterday, the victim could get the information under RTI. Today, technically, under the DPDP, the government can issue a circular saying private ownership cannot be disclosed.
But isn’t that a police matter? The police will find ownership details.
Today, if you do a word search for RTI Act for Manupatra (legal research website), just High Court judgements, the proportion of judgments where just RTI has been used—civil, criminal, matrimonial, environment, recruitment—to the cases where the RTI itself is a subject matter of dispute is 10 to 1. Every ten cases where the RTI has been used to get information in the context of some other litigation, there is one case where the dispute is whether I should get access under RTI or not. That is the frequency with which RTI has been used in litigation. It has helped courts a great deal in deciding matters that they would otherwise have had to issue directions for production. It reduces the wastage of the court’s time spent on summoning documents required for settling the dispute.
What is the government’s point of view on the amendment? How have they justified it?
They have made the focus of the debate in Parliament on these large corporations that collect large gigabytes of data on individuals, and they say this kind of Act is necessary to give the individual control over the data which such corporations collect. When questioned about the amendment to the RTI Act, even the attorney general has said there is no conflict caused by this amended form. The amendment through the DPDP Act does not curtail the right to know under the RTI Act. That is the bland reasoning that they give. The justification for all this is simply not publicly available.
What is the balance of protecting us from corporations and having access to information?
The balance is established by the DPDP Act, where you have the right recognised to seek information from corporations that collect it. Now, the struggle is that the state, which is run by public functionaries, cannot be allowed to claim the right to privacy for the public functions they perform. Today, there are entire sections of the DPDP Act and entire categories of information about government agencies that are available in digital or digitised form, which can be exempted without any reasoning. The State cannot claim any right to privacy for itself. The right to privacy is available only to natural persons. It is not available to government departments, police, government hospitals, private companies, churches, temples, schools, or colleges.
We are talking about this amendment within the broader context of a growing lack of transparency and efforts to ring that about since 2014. Could you talk about that context?
The larger context is this that while the government has created, not just the central government, even state governments, have created umpteen websites to put out statistical data—dashboard level transparency—but when it comes to information required for holding a public functionary or a government servant accountable for their actions, that information is not made public. Take this very case. What are the reasons behind amending 8 (1) (j) in the current manner? What has been amended is what we know. But why it has been amended has never been explained adequately by the government. They only say that the scope of the RTI Act and the scope of citizens' rights to information have not been curtailed.
Tomorrow, if the government says that information related to beneficiaries of various government schemes is being misused, it will not be made public under the DPDP Act to any third party. I cannot use the RTI Act either to get it. What is happening is that, bit by bit, first within the RTI Act and in its implementation, the government is putting a whole lot of information into black boxes, and now through the DPDP Act, they are trying to expand that sphere of confidentiality in the name of protecting people’s right to know about their own information from these private entities.
It is a downslide as far as the transparency regime is concerned. On the one hand, what has been happening since 2014 is that the government is increasingly interested in collecting information about citizens, either through legitimate means or through surveillance that is completely opaque. At the same time, they are also curtailing the citizens' right to know what the government is doing. They want the citizenry to be increasingly transparent with them, but the state’s obligation to be transparent is diminishing year after year.
It also feels like the government is extracting information about us, but curtailing our access to it.
Now they will also say private entities can withhold information. They talk about data localisation, but they also talk about data fiduciaries subject to certain conditions to take data across borders. From here, they can shift to America, and there is no duty to tell the data principal why, when, how and for how long information about that person is being given away.
But the DPDP Act at least protects us from that.
All of that will become known during implementation. It is still very much in its nascent stages. So, what is happening in the private sector viz z viz citizens’ rights, how many people are filling up consent forms, how many data fiduciaries have set up the kind of mechanisms of protecting data while processing it, very little is known. But what we are increasingly seeing is that, even before the DPDP rules were put in place, in places like Gujarat, PIOs (public information officers) had already begun implementing 8(1)(j) in its amended form.
The RTI was a big win for civil society and the public, but we are now in a completely different digital era, so how do we deal with the challenges of privacy while protecting the vision of the RTI?
The vision of the RTI was to empower citizens to stand on the same footing as public functionaries by creating a regime of transparency that leads to accountability. There is an empowerment element in the DPDP Act also which is called the right to informational self determination but the funny part is that while the RTI was subject to widespread consultation during the formulation stage because it was to empower the citizen, but this latest law which is also supposed to empower not just citizens but any person, but any person whose personal data is processed by a data fiduciary, there was hardly any public consultation of the kind which the RTI Bill generated, and any little consultation they did was also put into locked in hard disks. How can you empower the citizen by saying that the basis for making the law through which they seek empowerment will not be publicly disclosed?
How will RTI and DPDP work together?
The New Zealand ombudsmen body not only decides what information should be given under its own RTI law, but also acts as the grievance redressal authority, as far as data protection issues are also concerned. Here, you have a kind of diarchy in terms of information. For RTI, there are information commissions in each state and one for the central government. For DPDP, you will have a highly centralised and government-dominated dispute resolution mechanism, the data protection board, which will be at the central level. Benches could be set up in different states but under the central umbrella. When it comes to an issue of dispute regarding access to information, whose authority will prevail—is it the information commission’s or that of the data protection board?
Say if I need to know my spouse’s earnings in a divorce case. I will go to the information commission, but now, under the new amendment, they will say we can’t give personal information, and then refer it to the DPDP board?
Not even that bridge is there between the two laws. Here, the information commission will look at the amendment and say “blanket ban, we can’t give you this information”. And you can’t go to the data protection board to get information on your spouse because only your estranged spouse can seek information about themselves.
Scenario number 2: If there is a very progressive information commissioner who says public interest overrides and directs disclosure of personal information. Tomorrow, the person whose information was disclosed can go to the data protection board and say that my consent was not taken. Those bridging provisions between the two laws are missing.
It will be a mess.
Exactly. You cannot have two adjudicating bodies, as it creates a significant conflict.
How could this impact your work?
Every year, I file between 50 and 60 RTIs. Since 2018-2019, much of my time and work have been taken up by the lack of transparency in the electoral field. There is a whole lot of data, beyond who won and who lost, that is not publicly available. And if that information is not publicly available, we will never be able to take the baby steps to put an end to the nefarious influence of money and muscle on electoral outcomes.
Even before the DPDP Act was implemented, the Election Commission was denying access to information. My worry is that the DPDP Act and its amendment will be used to deny even the basic information we would normally receive.
Earlier, I had filed for the 2024 Lok Sabha election in Karnataka, requesting the names of officers appointed to monitor for voter intimidation at the polling station level. I got that information after paying the requisite fee. Now, under the DPDP Act, I will probably not get it, as it contains the names and mobile numbers of these officers. This is just one example. That is when I realised this is too harmful to the RTI regime.
On balance, how do you think the RTI has fared in India? What is the legacy?
It has been successful in creating demand for information in a visible way. But implementation, even during the UPA regime, was not easy. They were the first to propose amendments in the very first year of implementation. Resistance was always there, but resistance was tempered by information commissions. But now, what is happening is that the vacancies are rarely filled until the Supreme Court directs in response to public interest litigations. Then, the kind of people who have been appointed to information commissions, with very few honourable exceptions, most of them are pro confidentiality. Crucial information needed to secure accountability of government officials is increasingly being denied. Somebody’s widow pension has been stopped; they will give that information, but they won’t tell who is responsible for stopping it. Under the DPDP Act, that will become the default position.
But people are still fighting. There are a whole lot of intellectual elites who used to be RTI users, who are now happy writing obituaries to the RTI Act. But at the same time, the number of RTI applications that get filed with the central government, during Covid, went down by about 3% but after that, it has always been rising. It has not decreased. So the interest in the RTI, despite all the sob stories about how we did not get this information, is also part of reality: people are not giving up hope. That is a very positive aspect of how the citizenry at large is looking at the RTI. There has been a 4 to 5% increase in the number of RTI applications filed with the central government in 2023-2024. We are still waiting for data for 2024-2025.
What really needs to be appreciated is the ability of a person from a village or a jhuggi-jhopri cluster to file an RTI application with a BPL card or a 10-rupee fee and to stand before a government officer and demand information within 30 days. That is hugely empowering.
How well has the media covered DPDP? What do you make of the public interest?
When the RTI Bill was tabled in Parliament in 2004, it was discussed across the country, and prior to that, from 1997 onwards, there had been discussion on RTI laws primarily at the state level.Nine states passed the law. The media contributed in a big way by placing issues in the public domain, discussing the provisions threadbare when the central bill was about to be tabled in Parliament and thereafter. Unfortunately, I have not seen that kind of enthusiasm in the context of the DPDP Act. When there is a lack of media interest, how does the public even learn about the Act's implications and the regressive impact of the amendments on RTI?
This is also happening at a time when the central government has severely and adversely affected the ability of many of our organisations to go out and do the public education that we need to. Our funding has been brought to a nil. The FCRA of my own organisation (CHRI) has been taken away. That cancellation was set aside by the Delhi High Court, but the central government reinstated it a second time. The case has still not been decided, and we don’t know if we will even have funds to continue our work from June onwards. How will we go around holding workshops, even Zoom connections, if they require money? So, even civil society’s ability to go out and convey the message of what DPDP is all about has not happened the way we did with RTI. There are occasional meetings, like in Delhi, when the national campaign for people’s rights to information brings in people from different walks of life, including many living in jhuggi-jhopri clusters. These are rare instances where the message of what the DPDP Act is all about and how it negatively affects their right to know is conveyed to the people. The media has not helped much. I don’t think much of the regional press has even taken up spreading awareness about the DPDP Act with the help of explainers.
You have advocated for the right to information for more than 20 years. Is this personally painful for you?
I see it as a challenge. What I see in the future is that 8 out of 10 RTIs of mine that get rejected will now probably become 9 or 9.5 out of 10, and that is extremely concerning.
(Betwa Sharma is managing editor of Article 14.)
Get exclusive access to new databases, expert analyses, weekly newsletters, book excerpts and new ideas on democracy, law and society in India. Subscribe to Article 14.
.JPG)
.JPG)
