Supreme Court to examine impact of data protection law on RTI, investigative journalism

The Supreme Court's decision to examine the interplay between the Digital Personal Data Protection (DPDP) Act, 2023 and the Right to Information (RTI) Act, 2005 marks a pivotal moment in India's evolving data governance framework. This judicial intervention arises from a fundamental tension between two constitutional values: the right to privacy, recognized as a fundamental right under Article 21 in the landmark K.S. Puttaswamy v. Union of India (2017) judgment, and the right to information, derived from Article 19(1)(a) (freedom of speech and expression) and operationalized through the RTI Act. The DPDP Act, enacted in August 2023 after multiple iterations (2018, 2019, 2022 drafts), establishes a comprehensive regime for processing digital personal data, emphasizing consent, purpose limitation, and data fiduciary obligations. However, its broad exemptions for state instrumentalities under Section 17 and restrictive data-sharing provisions have raised concerns about potential dilution of transparency mechanisms. The RTI Act, 2005, hailed as a watershed in participatory democracy, has empowered citizens to access government records, exposing corruption and ensuring accountability. Section 8(1)(j) of the RTI Act already balances privacy by exempting personal information unrelated to public activity. The DPDP Act introduces a new layer: Section 36 states it shall have overriding effect, but also mandates harmony with existing laws. The Supreme Court's observation that both are central legislations requiring harmonisation reflects the doctrine of harmonious construction — a well-established principle of statutory interpretation where courts strive to give effect to both statutes unless irreconcilable conflict exists. Key stakeholders include the Union Government (data fiduciary for massive citizen databases like Aadhaar, CoWIN, tax records), Information Commissions (adjudicating RTI appeals), investigative journalists (reliant on RTI for public interest reporting), and citizens (whose data is processed). The Editors Guild of India and civil society groups have warned that a 'cautionary approach' by public authorities — denying RTI requests citing DPDP compliance — could create a chilling effect on transparency. Notably, the DPDP Act's provisions are not yet fully operationalised; the Data Protection Board of India (DPBI) is yet to be constituted, and rules under Section 40 are pending. The significance for India is profound. A restrictive interpretation could undermine social audits, environmental compliance monitoring, and anti-corruption investigations — all heavily dependent on RTI. Conversely, unchecked data disclosure risks privacy violations, identity theft, and surveillance. Economically, the DPDP Act aims to enable India's digital economy (targeting $1 trillion) and facilitate cross-border data flows under adequacy determinations (e.g., EU GDPR). Politically, it tests the state's commitment to cooperative federalism, as states implement both Acts. Internationally, India's approach influences Global South data governance models. Constitutionally, the Court must navigate Article 21 (privacy), Article 19(1)(a) (information access), and Article 300A (property rights in data). The doctrine of pith and substance may determine whether DPDP's core is data protection or state control. Future implications include potential legislative amendments to clarify Section 8(1)(j)-DPDP interplay, DPBI guidelines on public interest disclosures, and judicial precedents shaping 'harmonious construction' in digital rights. Aspirants must track the Court's reasoning, as it will define the architecture of India's information regime for decades.