Why is it in the News?

In August 2023, India enacted its first comprehensive data protection law, the Digital Personal Data Protection (DPDP) Act, 2023, with the government currently in the process of formulating rules and regulations for its implementation, anticipated to conclude post the general election.

Context:

• In August 2023, India introduced its first comprehensive data protection law, the Digital Personal Data Protection (DPDP) Act, 2023.
• While aimed at safeguarding personal data, its impact on journalistic freedom warrants examination, as the absence of exemptions for journalistic activities may threaten the foundational principles of a free press.

Provisions of Digital Personal Data Protection (DPDP) Act:

• The Digital Personal Data Protection (DPDP) Act, 2023 is a landmark legislation aimed at regulating the collection, processing, storage, and use of personal data in India.
• The Act establishes a comprehensive framework for lawful and transparent handling of personal data, seeking to safeguard individuals' privacy and data rights.

Key provisions of the DPDP Act, 2023 include:

• Definition of personal data: Any information capable of identifying an individual, directly or indirectly.
• Principles of data protection: Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.
• Data handlers: Distinction between data fiduciaries (determining processing purpose and means) and data processors (processing data on behalf of fiduciaries).
• Consent: Requirement for explicit consent before processing personal data, with provisions for withdrawal.
• Individual rights: Access, correction, erasure, and transfer of personal data.
• Data localisation: Potentially mandating the storage and processing of certain sensitive data within India.
• Oversight: Establishment of a Data Protection Board to monitor compliance and resolve grievances.
• Non-compliance: Penalties and sanctions, including fines and legal consequences for violations.
• Cross-border data transfers: Ensuring data protection standards comparable to India's when transferring data across borders.
• Obligations for data fiduciaries and processors: Security measures, data breach notifications, and data impact assessments.
• The DPDP Act, 2023 represents a significant step towards upholding individual privacy rights in India and ensuring responsible data management by government entities, organisations, and individuals alike.

Journalistic Exemptions in Data Protection Laws:

• Traditionally, data protection laws include exemptions for journalistic activities, allowing journalists to access and report on personal data without consent for investigative purposes.
  • These exemptions ensure freedom of the press and facilitate accountability in society.
• However, the Digital Personal Data Protection (DPDP) Act, 2023 does not provide such exemptions.
  • Previous drafts of the Act, including versions released by an expert committee on data protection (2018), the government (2019), and a Joint Parliamentary Committee (2021), contained provisions for journalistic activities.
• The unexplained removal of these exemptions in the DPDP Act's final iterations (2022 and 2023) raises concerns over potential negative impacts on journalism and its role in maintaining transparency and accountability.
  • Addressing this absence of journalistic exemptions will be crucial to upholding the freedom of the press and protecting the public's right to information.

Challenges for Journalists under the DPDP Act:

• Consent Requirements: Journalists are now obligated to secure consent from individuals before utilizing their personal data in news stories.
  • This could impede investigative reporting, as subjects may refuse consent, thereby obstructing access to crucial information.
• Right to Erasure: The right to erasure permits individuals to demand the deletion of published stories containing their personal data.
  • This provision may result in the removal of significant investigative work, undermining transparency.
    • For instance, when reporting on a Member of Parliament (MP) and their activities, journalists often gather information such as meeting details, travel itineraries, and familial financial investments, all of which constitute personal data under the DPDP Act.
• Obtaining consent for such data usage poses challenges, and even after publication, MPs can invoke the right to erasure, compelling journalists to delete pertinent stories.
• Government Oversight: The Act grants the government authority to request information from data processors, potentially compromising the confidentiality of journalists' sources and research materials.
  • This governmental oversight may curtail the press's capacity to hold the state accountable.

Addressing Concerns and Potential Solutions for Journalistic Freedoms under the DPDP Act:

• To ensure a balanced approach that protects personal data while preserving journalistic freedoms, addressing the concerns raised by the Digital Personal Data Protection (DPDP) Act is essential.
• The following solutions could help achieve this goal:
• Transparent Consultation: The removal of exemptions for journalistic activities highlights the need for open and transparent public consultations.
  • Although drafts of the DPDP Act were released for public input, the comments received were not made publicly available.
  • Greater transparency in the consultation process would enable better comprehension of stakeholder perspectives and inform more effective law-making.
• Exemptions for Journalists: The central government should consider using its rule-making powers under the DPDP Act to exempt journalistic entities, including citizen journalists, from specific obligations within the Act.
  • This exemption would protect the freedom of the press and encourage a transparent and open environment for journalism.
• Public Consultation: Implementing an open, transparent, and robust public consultation process could facilitate better understanding and consideration of various viewpoints.
  • This approach would lead to a more balanced and effective data protection law that upholds both personal data privacy and freedom of the press.

Conclusion

The Digital Personal Data Protection (DPDP) Act, 2023, is an essential step towards safeguarding personal data in India. However, its potential impact on journalistic free speech raises significant concerns that must be addressed.

To strike a balance between protecting individual privacy and upholding the fundamental principles of a free press, the government should consider implementing exemptions for journalists and fostering transparent consultation processes. These measures would enable a harmonious coexistence of personal data protection and journalistic freedoms, ensuring that both critical elements thrive in India's democratic landscape