Supreme Court Examines Definition of “Personal Data” Under India’s Digital Personal Data Law

          The Supreme Court of India has agreed to examine what constitutes “personal data” and “public data” under the Digital Personal Data Protection Act, 2023 and its Digital Personal Data Protection Rules, 2025.

         The case arose from a petition filed by journalist Geeta Seshu and the Software Freedom Law Center, represented by senior advocate Indira Jaising. The petition argues that the new law may restrict journalists’ access to information of public interest, potentially undermining the Right to Information Act, 2005.

Supreme Court’s Intervention

• A three-judge bench led by Chief Justice of India Surya Kant issued notice to the Union Government.

• The Court will examine how “personal data” and “public data” should be defined under the new law.

• The issue arose after implementation of the DPDP Act (2023) and its Rules (2025).

• The Court emphasised the need to balance privacy rights with the public’s right to information.

Concerns Raised by Petitioners

The petition highlights several concerns:

a. Impact on Journalism

• Journalists may be blocked from accessing information of public interest about individuals holding public office.

• The Act allegedly removes the explicit concept of “public interest” as a justification for accessing data.

b. Lack of Clear Definitions

• Terms such as “personal data” and “information” are not clearly defined.

• This ambiguity could allow broad interpretation by authorities.

c. Risk of Surveillance

• The law may allow wide government surveillance without sufficient safeguards.

d. Compensation Issue

• Under the Act, penalties for misuse of data go to the Consolidated Fund of India, not to the affected individuals.

• Victims of privacy violations may not receive compensation for harms like:

• identity theft

• financial fraud

• reputational damage

• dignity violation

Supreme Court’s Observations

The Court raised important constitutional questions:

• When does information about a public official become public information?

• When should it remain private?

The Court noted:

• Data privacy must be protected from sweeping legal provisions.

• In the modern world, data has become a valuable economic resource.

• Large amounts of citizens’ personal data flow into powerful global private entities.

Next Steps in the Case

• The Court asked the petitioners to frame specific questions of law.

• The case has been scheduled for detailed hearing on March 23.

Understanding the Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 is India’s first comprehensive law governing collection, processing, and protection of personal data.

Key Objectives

• Protect individual privacy rights

• Regulate data processing by companies and government

• Establish penalties for misuse of data

• Promote responsible data governance

Important Features

• Consent-based data processing

• Rights of data principals (citizens)

• Creation of a Data Protection Board of India

• Strict penalties for violations (up to hundreds of crores)

Constitutional Context

The debate sits at the intersection of two fundamental rights.

1. Right to Privacy

Recognised as a fundamental right in the landmark judgment of
Justice K. S. Puttaswamy vs Union of India.

This judgment held that:

• Privacy is intrinsic to Article 21 (Right to Life and Personal Liberty).

2. Right to Information

The Right to Information Act, 2005 promotes government transparency and accountability.

It allows citizens to access:

• Government records

• Public decision-making processes

• Information affecting public interest

The challenge is ensuring privacy protection does not weaken transparency.

Major Issues Raised by the Case

1. Privacy vs Transparency

A central constitutional question arises:

How can the state protect personal data while ensuring democratic accountability?

Example:

• Financial disclosures of public officials

• Conflict of interest information

• Asset declarations

Such information may be personal but also essential for public scrutiny.

2. Definition of “Personal Data”

If the definition becomes too broad, it could include:

• Salary details of public officials

• Property records

• Official communications

This could weaken investigative journalism.

3. Impact on Media and Investigative Journalism

Journalists rely on access to public-interest information for:

• corruption investigations

• public accountability

• governance transparency

If access becomes restricted, it could limit watchdog journalism.

4. Compensation for Data Breaches

The petition highlights a structural issue:

• Current penalties go to the state treasury.

• Victims of privacy violations may not receive direct compensation.

This raises questions about justice for affected individuals.

5. State Surveillance Concerns

Without strong safeguards:

• governments may access large volumes of personal data

• surveillance risks may increase

• civil liberties could be affected

This has been a global concern in the digital age.

Global Context

Many democracies are struggling with the same balance.

Examples include:

• General Data Protection Regulation

• Data protection laws in the US, UK, and Australia

Most frameworks attempt to balance:

• privacy rights

• media freedom

• public interest disclosure

India’s debate reflects this global governance challenge.

Way Forward

A balanced framework may require:

1. Clear Legal Definitions

• Explicit distinction between personal data and public-interest data.

2. Public Interest Safeguards

• Allow journalists access to information involving public office or public accountability.

3. Victim Compensation

• Ensure affected individuals receive direct remedies for data violations.

4. Strong Oversight Mechanisms

• Independent regulatory bodies

• Transparent data access rules.

      The Supreme Court’s examination of the DPDP framework highlights a crucial constitutional question for the digital age: how to protect individual privacy while preserving transparency and democratic accountability. The outcome of this case could shape the future of data governance, journalism, and citizens’ rights in India.

Prelims Questions:

1. The right to privacy in India was recognised as a fundamental right in which case?

A. Kesavananda Bharati vs State of Kerala
B. Maneka Gandhi vs Union of India
C. Justice K. S. Puttaswamy vs Union of India
D. Minerva Mills vs Union of India

Answer: C
Explanation: In 2017, the Supreme Court in Justice K. S. Puttaswamy vs Union of India declared privacy as a fundamental right under Article 21.

Mains Questions:

1. Discuss the conflict between Right to Privacy and Right to Information in the digital age. (150 Words)