Context

• In August 2023, the Indian government passed India’s first comprehensive data protection law, the Digital Personal Data Protection (DPDP) Act, 2023.
• While this law is a significant step towards ensuring the protection of personal data, its potential implications on journalistic free speech raise concerns.
• Therefore, it is crucial to examine why the absence of exemptions for journalistic activities may threaten the foundational principles of a free press.

The Digital Personal Data Protection (DPDP) Act, 2023

• It is an act that was passed to regulate the collection, processing, storage, and use of personal data by individuals, organisations, and government entities in India.
• The act aims to protect the privacy and data rights of individuals and establish a framework for the lawful and transparent handling of personal data.

Key Features of DPDP Act, 2023

• The act defines personal data as any data that can directly or indirectly identify an individual.
• The act outlines principles for data protection, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.
• The act distinguishes between data fiduciaries (entities that determine the purpose and means of processing personal data) and data processors (entities that process personal data on behalf of data fiduciaries).
• The act emphasises the importance of obtaining explicit consent from individuals before processing their personal data. It also provides provisions for the withdrawal of consent.
• Individuals are granted rights regarding their personal data, including the right to access, correct, erase, and transfer their data.
• The act may require certain types of data to be stored and processed within India, depending on the nature and sensitivity of the data.
• A Data Protection Board is established to oversee compliance with the act and handle data protection grievances.
• The act specifies penalties and sanctions for non-compliance, including fines and other legal consequences for violations of data protection principles.
• The act regulates the transfer of personal data across borders to ensure that data is protected to a similar standard as within India.
• The act sets out obligations for data fiduciaries and processors, including requirements for security measures, data breach notifications, and data impact assessments.

Exemptions for Journalistic Activities

• Data protection laws traditionally provide exemptions for journalistic activities, allowing journalists to operate without constraints related to privacy obligations.
• These exemptions enable journalists to freely access and report on personal data for their investigative stories without the need for consent from the individuals involved.
• Unfortunately, the DPDP Act, 2023, lacks such exemptions. While previous drafts of the Act did contain provisions for journalistic activities, these were removed in the final law without clear explanations.
• This departure from earlier versions could have a detrimental impact on journalistic practices and the ability to uphold accountability.
• Three previous drafts of the DPDP Act, one released by an expert committee on data protection (2018), the other by the government (2019), and the third released by a Joint Parliamentary Committee in 2021, contained clear exemptions for journalistic activities.
• In two subsequent drafts of the DPDP Act (2022 and 2023), the exemption given to journalistic activities was withdrawn without reasons being given.

Challenges for Journalists under the DPDP Act

• Consent Requirements
  • Journalists must now obtain consent from individuals before using their personal data in their stories.
  • This process may hinder investigative reporting, as subjects could refuse consent, thereby restricting access to critical information.
• Right to Erasure
  • The right to erasure allows individuals to request the deletion of published stories that contain their personal data.
  • This provision could lead to the removal of valuable investigative work and hinder transparency.
  • For example, if a journalist writing about a Member of Parliament (MP) and his performance.
  • For their story, they use information from MP’s lives such as the meetings they held, where, and with whom, the towns, villages, and cities they travelled to etc and the investments made by their close family members.
  • Most of this information is not available in the public domain and needs a lot of research.
  • All this information about an MP is their ‘personal data’, which is data protected under the DPDP Act.
  • Consequently, any journalist who wishes to use this data will have to get their consent before publishing the story.
  • Even after publication, the MP can exercise their right to erasure and request journalists to delete such stories.
• Government Oversight
  • The Act empowers the government to request information from data processors, which may compromise the confidentiality of journalists' sources and research documents.
  • This could limit the press's ability to hold the state accountable.

Potential Solutions

• Need for Transparent Consultation
  • The lack of clear explanations for the removal of exemptions for journalistic activities points to the need for more robust and transparent public consultation
  • Although the Indian government released drafts of the DPDP Act for public consultation, it did not make the comments received publicly available.
  • This lack of transparency impedes citizens' understanding of the different stakeholders' perspectives and the reasons behind the final formulation of the law.
• Exemptions for Journalists
  • The central government should use its rule-making powers under the DPDP Act to exempt journalistic entities, including citizen journalists, from the law's obligations.
  • This will protect the freedom of the press and ensure that journalism can thrive in an open and transparent manner.
• Public Consultation
  • Implementing an open and transparent public consultation process can facilitate better understanding and consideration of different viewpoints.
  • This approach would lead to a more balanced and effective data protection law.

Conclusion

• While the DPDP Act, 2023, is a crucial step in protecting personal data in India, its impact on journalistic free speech is concerning.
• By ensuring exemptions for journalists and promoting transparent consultation processes, the government can strike a balance between protecting individual privacy and upholding the fundamental principles of a free press.