How can India balance the right to privacy with the public's right to know? Suggest institutional safeguards.
New · District CollectorCan you hold the district for 72 hours?Floods, a heatwave, an outbreak, a grievance queue. Take the decisions, see the consequences.Play →In this answer
Privacy is a fundamental right under Article 21 (K.S. Puttaswamy, 2017). The right to know flows from Article 19(1)(a) and works through the RTI Act, 2005. The DPDP Act, 2023 has shifted the balance between them. It exempts research and statistics but not journalism, and its Section 44(3) rewrote RTI's personal-information exemption [3]. To balance the two rights, India must apply proportionality and not let either right override the other.
Principles for balancing
- Public-role test: The old Section 8(1)(j) allowed personal information to be withheld only if it was unrelated to public activity or was an "unwarranted" invasion of privacy [4]. Restoring it would keep officials' conduct open while protecting junior staff and third parties.
- Proportionality: A restriction must be no wider than its aim needs. PRS warns that the State's exemptions may allow data collection "beyond what is necessary" [1].
- Conditional press exemption: The 2018 draft exempted journalism. PRS said this had to be balanced against privacy [2]. A narrow exemption tied to public interest would prevent misuse such as doxxing without silencing reporters.
- Symmetry: The Centre can exempt its own agencies by notification [1], yet reporters who scrutinise them get no exemption. Scrutiny of power deserves at least equal protection.
Institutional safeguards
- Parliament: Amend Section 44(3) to put a public-interest test back inside Section 8(1)(j). The general override in Section 8(2) [4] is used at the officer's discretion and works only after a refusal.
- Independent regulator: The Data Protection Board is a fully digital, four-member body [5]. Its two-year terms with re-appointment may weaken its independence [1]. Longer fixed tenures would help.
- Graded penalties: The maximum fine is ₹250 crore [1]. Published guidelines that scale fines to an entity's size and the harm caused would stop the chilling effect on small newsrooms.
- Judicial check: Adopt the Srikrishna Committee's proposal for judicial pre-approval of security-related processing [1].
- Information Commissions: The CIC and SICs should issue guidelines on the public-interest test and train PIOs to apply it.
The government says the amendment balances both rights [6]. That claim should be tested by results: whether officials remain answerable while private citizens stay protected. A calibrated law with an independent Board, clear penalty rules and judicial oversight can protect both rights, in line with Puttaswamy's proportionality test and SDG 16.10 on public access to information.
Sources
- 1PRS Legislative Brief: The Digital Personal Data Protection Bill, 2023: State exemptions possibly disproportionate; Centre exempts agencies by notification; Board members' two-year re-appointable terms; ₹250 crore maximum penalty; Srikrishna Committee's judicial pre-approval
- 2PRS Legislative Brief: The Personal Data Protection (Draft) Bill, 2018: journalism exemption in the 2018 draft and the need to balance it against privacy
- 3The Digital Personal Data Protection Act, 2023 (Gazette text, MeitY): exemption for research/statistics only; Section 44(3) amends the RTI Act
- 4The Right to Information Act, 2005 (India Code): original Section 8(1)(j) wording; Section 8(2) public-interest override
- 5PIB: DPDP Rules, 2025 Notified: fully digital, four-member Data Protection Board
- 6PIB: Government notifies DPDP Rules to empower citizens and protect privacy: government's position that the amendment balances privacy and RTI