DNPA Vs DPDP: Where the arguments hold and where they don’t?

The Digital News Publishers Association (DNPA) on Monday challenged provisions of the Digital Personal Data Protection (DPDP) framework in the Supreme Court, warning that the absence of a journalistic exemption could constrain investigative reporting and public-interest journalism. The Court has issued notice to the Centre seeking its response to the plea.

The whole case is about the DPDP Act having no exemption for journalism. Old drafts in 2018, 2019 and 2021 had the exemption. The 2022 draft dropped it. So a newsroom is treated like any company holding customer PII data. It must follow the same rules of notice, consent and erasure, even when reporting on someone. 

As Madhavi Divan (DNPA Lawyer) told the court, journalism cannot work if you first ask permission from the people you are investigating. If it had to, newsrooms would shut.

Five sections have a clear objection, as I could not find the full copy of the petition, so relying on news sources.

Section 17(2) exempts research, archiving and statistics, but leaves journalism out. LiveLaw and The420 both say so.

Sections 18, 19 and 27 set up the Data Protection Board. The government appoints it, no judge is required, yet it decides cases and imposes fines. Reported in LiveLaw and The420.

Section 36, read with Rule 23, lets the government demand information with no court check and no notice to the person, which puts sources at risk. Stated in LiveLaw and The420.

Section 37(1) gives the power to restrict public access to information, and the petition calls it too broad. Stated in The420.

Section 44(3) rewrites Section 8(1)(j) of the RTI Act. It bars disclosure of personal information outright and drops the old public interest test. Stated in LiveLaw and The420.

Four more are only named, with no reason given in any news report.  Sections 7 and 29, and Rules 16 and 17. 

Let's go section by section.

Section 17(2)

The provisions of this Act shall not apply in respect of the processing of personal data 

(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and 

(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to make any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed. 

Section 17 is the exemptions clause. It lists the situations where the Act, or big parts of it, simply does not apply. Section 17(2) is a full exemption. There are two such cases given: 

 The first is any State body the government chooses to notify, on grounds like national security, sovereignty, public order or friendly relations with other countries. 

The second is processing done for research, archiving or statistics, as long as the data is not used to make a decision about a particular person. 

There is no blanket exemption for News publishers. In my view, journalism should not get the same full exemption. News reports are often proven wrong later, but by then the person’s reputation is already destroyed, and we have seen this happen many times. To sensationalise a story, journalists make claims based on limited information and leak personal information. News organizations take little responsibility in leaking personal information, resulting in defaming the individuals. A complete exemption would leave such people with no protection.  

Section 18, 19 and 27 

Summary of Section 18, 19 and 27: 

Section 18 creates the Board. The government decides when it starts, gives it a legal identity so it can own property, sign contracts and sue or be sued, and fixes where it sits. 

Section 19 staffs the Board. It has a Chairperson and as many members as the government decides. The government appoints all of them, in a manner it sets. Members need standing and knowledge in fields like data governance, law, technology or consumer protection, and at least one has to be a legal expert. 

Section 27 is where the Board gets its powers to penalize Data fiduciaries. It inquires into data breaches and into a fiduciary’s failure to meet the DPDP guidelines, and it has the power to impose the penalties. 

The fines go up to 250 crores. 

So yes, this can potentially be a vindictive clause for news publishers, even if one consumer complains that his/her data is misused, the board can punish the publisher or a bank or an insurance company for 50 crores of fine or even 250 crores of fine. 

But IMPORTANTLY this in my understanding does not infringe upon a journalist doing an investigation, linking it to journalism may be wrong. These rules apply to all data fiduciaries, whether it is a bank, an insurer, a hospital or an e-commerce site. This is about PII a company is holding and breaks the DPDP norms with consumer personal information. 

Yes, there can be penalties which can be put without any questions, but it's little to do with the journalism process in my view. 

Section 36 

Section 36 defines how the Central Government may demand information from three parties: the Board, any data fiduciary, and any intermediary. The only limit written into it is the phrase “for the purposes of this Act.” It does not clearly say what information can be sought, in what situations, under what safeguards, or whether the person whose data is involved is even told. 

But this “Section 36, read with Rule 23” is about PII can be asked by the Government of users, who have allowed the News Publishers to keep the PII, that is at some level their logged in users. Not the people their journalists are investigating, I think News publishers Lawyers have probably misunderstood this. The government can ask for information for what you legally have as PII, legally have meaning with consent of the user.

 If a journalist has a source, and does not have consent of the source to use his/her personal information, the Government cannot ask for it. The government can only ask for what you have, with consent.

If the news organizations are worrying that this clause puts “Which puts sources at risk”, I am not sure if they are correct. This is for the PII data which news companies have with consent, and the government can ask that data anytime without giving a reason, to which news publishers ideally should not have any issue. 

Lets also take example of GDPR, There is no provision in GDPR that requires journalists to reveal or hand over their sources. No article says it, directly or indirectly. But that may be due to Article 85 which keeps journalism out of data protection, which I guess news organizations are asking for in 17(B) in DPDP. 

One case in Romania, the RISE Project in 2018 was asked to reveal sources under GDPR law. But it was widely criticized and was considered an abuse of GDPR. RISE and OCCRP refused to name sources. Therefore I do not see any risk of revealing sources under DPDP. 

Section 37 

This section gives absolute power, post imposing fines(2 or more) to practically shut down the products and services of data fiduciaries due to not following the DPDP norms. 

In the worst case it says, the Board can ask the government authorities to shut down a website, app of a news organization or as it is technically written “the blocking for access by the public to any information generated, transmitted, received, stored or hosted”. 

It is a little extreme and more legal measures of settlement should be there, before such an extreme step is taken. 

Section 44(3)

The clause simply says personal information is exempt. So today, if your RTI asks for any personal information, the officer can refuse it outright. It does not matter if its sought for public good or some other purpose. 

News organizations are claiming that in the name of shielding the citizens, the RTI is blunted. This will weaken transparency of RTI queries by journalists. 

In my view, it's a 50:50 objection, it's definitely limiting RTI, but does give rights to individuals to maintain their privacy. Although this does mean being less open, from a government standpoint for sure.  

Section 29 

If the Board fines you or issues a direction and you disagree, you appeal to the Appellate Tribunal within sixty days. The Tribunal can confirm, change or cancel the Board’s order. The Act does not create a new tribunal for this. But the parties can go to supreme court and alternate dispute resolution (Section 31) and voluntary undertakings (Section 32). 

I am not sure of the objection of news publishers here. 

Rules 16, 17 and 23 

Rule 16 is regarding exceptions, similar to section 17(B), so nothing new to add here. 

Rule 17 is regarding the board, as covered in Section 19, nothing significant to add here. 

Rule 23 goes with section 36 and it's basically the government's power to ask PII of any user in your consented database. Which I guess is ok, since you have a consented user, and governments worldwide have these rights.

(Sandeep Amar is a senior media professional & digital transformation leader. Views expressed are personal.)