Introduction

Personal data has become a valuable asset in the era of smartphones, cloud storage, and artificial intelligence. It is frequently traded, analysed, and used for profit without the owner’s knowledge. A landmark in the defense of privacy rights was reached when India passed the Digital Personal Data Protection Act, 2023 (DPDPA), acknowledging the pressing need for a strong legal framework.

Important concerns are raised by this Act, meanwhile, regarding how it interacts with other laws that promote transparency, particularly the Right to Information Act of 2005 (RTI Act).

Definitions under DPDPA

• Section 2(n): Digital personal data means personal data in digital form.
• Section 2(t): Personal data means any data about an identifiable individual, either directly or indirectly.

DPDP Act Vs. RTI Act

The RIGHT TO INFORMATION ACT OF 2005 (RTI Act) in India empowers citizens to demand transparency and accountability from the government. However, the DIGITAL PERSONAL DATA PROTECTION ACT , 2023 (DPDP Act) weakens it by amending Section 8 (1) (j), limiting access to personal data without any public interest evaluation. This change threatens openness, accountability, and the constitutional right to freedom of speech and expression  under Article 19(1)(a) of the Indian Constitution..

The conflict between the Digital Personal Data Protection Act (DPDPA), 2023 and the Right to Information (RTI) Act, 2005 is a critical legal issue. It primarily revolves around the disclosure of personal information, pitting the right to privacy against the right to transparency. The core of this friction lies in how these two laws define and balance public interest versus an individual’s privacy.

Key Provisions

RTI Act, 2005: Section 8(1)(j)

This provision exempts the disclosure of personal information that has no relation to public activity or interest, or information that would cause an unwarranted invasion of privacy. However, it provides a crucial exception: the information can be disclosed if the Public Information Officer (PIO) is satisfied that a larger public interest justifies it. The RTI Act, therefore, uses a balancing test where the default position is to disclose information unless the privacy harm is greater than the public interest served by the disclosure.

DPDPA, 2023: Section 44(3)

This is the most critical clause in the DPDPA concerning this conflict. It acts as an overriding provision, stating that the DPDPA will prevail over any other law that is inconsistent with its provisions, unless that other law is a specific privacy-focused statute. This creates a clear legal hierarchy, effectively giving the DPDPA primacy in matters of personal data protection. Under the DPDPA, the default position is non-disclosure of personal data unless specific conditions, such as the data principal’s consent, are met.

The Core Conflict

The tension arises when an RTI request seeks personal data.

• Under the RTI Act

A PIO can disclose the information after weighing the individual’s privacy against the public interest. The focus is on transparency first, with an exception for privacy.

• Under the DPDPA,

The focus is on privacy first. The overriding clause (Section 44(3)) can be interpreted to significantly limit the PIO’s discretion to apply the “larger public interest” test from the RTI Act.

This fundamentally shifts the burden of proof. While the RTI Act requires the PIO to demonstrate why a privacy harm outweighs public interest, the DPDPA would require proving that the disclosure of personal data is permissible under its own strict conditions.

Landmark Judgement

K.S. Puttaswamy v. Union of India (2017)

The Supreme Court described privacy and its significance in the landmark decision of K.S Puttaswamy v. Union of India in 2017 that – Right to Privacy is a fundamental and inalienable right and attaches to the person covering all information about that person and the choices that he/ she makes. As a fundamental component of the freedoms granted by Part III of the Constitution and the right to life and personal liberty under Article 21, the right to privacy is safeguarded.

The judgment provides the constitutional framework for resolving this conflict. However, the Court also clarified that privacy is not absolute. Any state action that limits privacy must meet a three-part proportionality test:

• Legality – There must be a valid law authorising it.
• Legitimate aim – The measure must serve a lawful and necessary purpose.
• Proportionality – It must be the least intrusive way to achieve that aim.                             This judgment provides the judicial standard for balancing privacy with other rights, including the right to information. While the DPDPA provides a strong legal backing for privacy (the first part of the test), the judiciary will ultimately have to decide on a case-by-case basis whether a specific disclosure is “proportional” to the public interest.

Additional Jurisprudence on the Right to Information

The Supreme Court of India has long recognised that the right to information flows from the guarantee of freedom of speech and expression under Article 19(1)(a) of the Constitution, as affirmed in State of Uttar Pradesh v. Raj Narain (1975) and S.P. Gupta v. Union of India (1981). The Right to Information Act, 2005 operationalises this principle by granting every citizen the legal right to seek information from public authorities and establishing a clear procedure for doing so. Complementing this entitlement, Section 7 of the RTI Act places a statutory obligation on public authorities to maintain records systematically and make them available for public access in a timely manner.

However, the right is not without limits. Section 8 of the RTI Act sets out specific exemptions — for example, requests involving information that is classified, privileged, or potentially harmful to the sovereignty and integrity of India may be lawfully denied. In such cases, Central or State Public Information Officers (CPIOs or SPIOs) are under no duty to disclose the material.

Practical Implications

• For RTI Officers: The DPDPA’s overriding clause could lead to a significant increase in the denial of RTI requests seeking personal data. The balancing test becomes more difficult to apply, as the DPDPA provides a strong legal basis for non-disclosure. This may shift their role from balancing public interest to primarily protecting personal data.
• For Citizens: Access to information, particularly about public officials’ performance records, internal memos, or financial details, could become more challenging. Transparency in governance may face new hurdles, potentially limiting the public’s ability to hold officials accountable.
• For the Judiciary: The inevitable legal challenges will require courts to interpret the two laws harmoniously. This will likely involve re-examining the proportionality principle from the Puttaswamy judgment to create a new, coherent framework that upholds both the fundamental right to privacy and the right to information. The ultimate resolution will define the future of transparency and privacy in India.

Conclusion

The Digital Personal Data Protection Act, 2023 represents a major step forward in protecting individual privacy in India’s rapidly evolving digital landscape. However, its interface with the RTI Act highlights the delicate balance between safeguarding privacy and upholding transparency. Guided by constitutional principles from landmark judgments, India’s legal system will play a pivotal role in defining how these rights coexist in practice, ensuring that both privacy and the public’s right to information are preserved in appropriate measure.

Also Read:
Rights of undertrial prisoners in India
How To Send A Legal Notice In India