Constitution Bench to hear pleas against DPDP Act

Constitution Bench to Hear Pleas Against DPDP Act

UPSC Prelims + Mains Study Notes

1. At a Glance

• The Supreme Court of India has agreed to refer petitions challenging the Digital Personal Data Protection (DPDP) Act, 2023 to a Constitution Bench, marking a significant constitutional moment in India's data governance landscape. [S1]
• The central dispute: Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, allegedly replacing a nuanced exemption on "personal information" with a blanket ban, thereby undermining citizens' right to information.
• Critical for GS-II (Governance, RTI, Fundamental Rights, Judiciary) and the interface between Right to Privacy (Article 21) and Right to Information.
• A Constitution Bench ruling will authoritatively interpret the constitutional boundaries between privacy and transparency — potentially landmark jurisprudence.

2. Why in the News

• 17 February 2026: Chief Justice of India Surya Kant, heading a three-judge Bench, agreed to refer a series of petitions to a Constitution Bench challenging Section 44(3) of the DPDP Act, 2023. [S1]
• The petitioners argued Section 44(3) imposes a "blanket ban" preventing RTI applicants from seeking disclosure of "personal information" — described as a "body blow" to the right to a transparent government. [S1]
• The CJI refused an interim stay on Section 44(3) but acknowledged the petitions raised a "complex, slightly sensitive and really interesting question of law." [S1]
• The Court issued notice to the government and remarked it "may have to lay down what is meant by 'personal information'." [S1]
• DPDP Rules, 2025 were notified in November 2025, further operationalising the Act and intensifying scrutiny. [S3]

3. Background & Evolution

• 2017: Supreme Court's Justice K.S. Puttaswamy v. Union of India (9-judge bench) unanimously held Right to Privacy a fundamental right under Article 21. This necessitated a dedicated data protection law. [S2]
• 2018: Justice B.N. Srikrishna Committee submitted its report with a draft Personal Data Protection Bill.
• 2019: Personal Data Protection Bill, 2019 introduced in Lok Sabha; referred to a Joint Parliamentary Committee.
• 2021: JPC submitted its report.
• 2022: Government withdrew the 2019 Bill; announced intent to draft a simpler, comprehensive new law.
• August 2023: Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received Presidential assent. Passed by both Houses in the Budget Session 2023. [S4][S5]
• Section 44(3) of the DPDP Act amended Section 8(1)(j) of the RTI Act, 2005, replacing the conditional exemption for personal information with a broader restriction.
• January 2025: Draft DPDP Rules, 2025 published for public consultation. [S3]
• November 2025: DPDP Rules, 2025 notified by the government. [S3]
• February 2026: Supreme Court agrees to Constitution Bench referral. [S1]

4. Core Static Facts

5. Multi-Dimensional Analysis

Legal / Constitutional

• Article 21 (Right to Privacy) vs. Article 19(1)(a) (Freedom of Expression, which underpins RTI) — a core constitutional tension. [S2]
• Section 44(3) gives government "unguided discretion" to deny personal information — petitioners argue this is unconstitutional for lack of adequate guidelines/safeguards. [S1]
• The original Section 8(1)(j) RTI had a built-in balancing test (public interest vs. privacy harm); DPDP Act allegedly removes this test. [S1][S2]
• A Constitution Bench ruling will define the contours of "personal information" — potentially reshaping RTI jurisprudence for decades.

Governance / Ethical

• RTI Act, 2005 is a cornerstone of accountability and transparency in Indian governance; weakening it carries serious anti-corruption implications. [S1]
• The government's PIB position frames Section 44(3) as a codification of existing judicial practice, not an expansion of exemptions — asserting Section 8(2) continues to permit disclosure in public interest. [S2]
• Data Protection Board (under DPDP Act) is government-appointed — critics flag independence concerns, relevant to accountability. [S4]

Social

• RTI has historically been used by marginalised communities, journalists, and activists to hold government accountable; a blanket ban on "personal information" disproportionately impacts public accountability journalism. [S1]
• Privacy protections under DPDP Act benefit ordinary citizens whose data is held by State and private entities — a genuine competing social interest. [S4]

Technological

• DPDP Act establishes India's first comprehensive statutory data protection framework, applicable to both government ("State") and private Data Fiduciaries. [S4][S5]
• Significant Data Fiduciaries (SDFs) — a category under the Act — face higher obligations; classification criteria are set by MeitY. [S4]
• DPDP Rules, 2025 operationalise consent frameworks, grievance redressal, and children's data protections. [S3]

Administrative

• MeitY is the nodal ministry for implementation; the Data Protection Board handles adjudication. [S4]
• Rules were delayed — the Act was passed in August 2023 but Rules only notified November 2025 — indicating significant implementation lag. [S3]
• Overlap between DPDP Act, IT Act 2000 (Section 43A), and RTI Act 2005 creates regulatory complexity.

Historical

• Predecessor: Section 8(1)(j) RTI Act had evolved through extensive Central Information Commission (CIC) and High Court jurisprudence defining "personal information" and "public interest override" — all potentially displaced by DPDP Act's amendment. [S2]
• Global precedent: EU's GDPR (2018) similarly creates tension between data protection and freedom of information — resolved via Article 86 of GDPR (member states to balance both). India lacks an equivalent harmonising provision. [S5]

6. Recent Developments (Last 12–18 Months)

• November 2025: DPDP Rules, 2025 officially notified by MeitY, bringing the Act closer to full enforcement. [S3]
• January–November 2025: Draft Rules went through public consultation; concerns raised by civil society about consent fatigue, government exemptions, and children's data norms.
• 17 February 2026: Supreme Court (CJI Surya Kant bench) refers pleas against DPDP Act's Section 44(3) to a Constitution Bench; issues notice to Union Government; refuses interim stay. [S1]
• Petition basis: Activists and RTI practitioners argue the DPDP Act has fundamentally undermined India's transparency architecture. [S1]

7. Prelims Hooks

1. The DPDP Act, 2023 is officially known as the Digital Personal Data Protection Act, 2023 (No. 22 of 2023). [S4]
2. The nodal ministry for the DPDP Act is the Ministry of Electronics and Information Technology (MeitY). [S4]
3. Section 44(3) of the DPDP Act amends Section 8(1)(j) of the RTI Act, 2005 — the provision exempting disclosure of personal information. [S1]
4. The fundamental right to privacy flows from Article 21 of the Constitution, per the Puttaswamy judgment (2017) (9-judge bench). [S2]
5. The Data Protection Board of India is a quasi-judicial adjudicatory body established under the DPDP Act. [S4]
6. DPDP Rules, 2025 were notified in November 2025. [S3]
7. The Supreme Court referral to Constitution Bench was ordered by a bench headed by Chief Justice Surya Kant on 17 February 2026. [S1]
8. The Supreme Court refused an interim stay on Section 44(3) even while referring the matter to Constitution Bench. [S1]
9. Section 8(2) of the RTI Act remains operative under the government's interpretation — public interest can still override privacy protection. [S2]
10. Advocate Vrinda Grover appeared for petitioner Venkatesh Nayak challenging the DPDP Act's RTI amendment. [S1]
11. Prior to the DPDP Act, Section 8(1)(j) RTI required authorities to demonstrate that the information sought had no public activity link AND would cause unwarranted privacy invasion — a two-part test. [S1][S2]
12. The DPDP Act was passed in August 2023 — nearly 6 years after the Puttaswamy privacy judgment mandated a data protection law. [S4][S5]
13. A Constitution Bench consists of a minimum of 5 judges of the Supreme Court and is convened for cases involving "substantial questions as to the interpretation of the Constitution" under Article 145(3). [S1]

8. Mains Relevance

GS Paper(s): GS-II (Governance, Constitution, RTI, Judiciary); GS-IV (Ethics — transparency vs. privacy)

Specific Syllabus Headings: - GS-II: Significant provisions of RTI Act and their impact; Statutory, regulatory, and various quasi-judicial bodies; Fundamental Rights - GS-IV: Conflict of interest; Transparency and accountability in governance

Plausible Mains Questions: 1. "Section 44(3) of the DPDP Act, 2023 strikes at the root of India's transparency architecture." Critically examine with reference to the constitutional balance between the right to privacy and the right to information. 2. Trace the evolution of India's data protection framework from the Puttaswamy judgment (2017) to the DPDP Act, 2023. What are the key governance concerns raised by civil society? 3. The Supreme Court's decision to refer DPDP Act-related pleas to a Constitution Bench underscores the tension between fundamental rights. Analyse the constitutional issues involved and the likely implications for India's RTI regime.

9. Related Topics to Study Next

10. Common Errors / Trap Areas

1. Wrong year of Act: The DPDP Act was passed in August 2023, not 2022 or 2024. The Rules came only in November 2025 — don't conflate the two dates.
2. Wrong ministry: DPDP Act is under MeitY (Ministry of Electronics and IT), not the Law Ministry or Home Ministry.
3. Confusion between Section 8(1)(j) and Section 44(3): Section 8(1)(j) is the RTI provision being amended; Section 44(3) is the DPDP provision that makes the amendment. Don't mix the two.
4. Interim stay misconception: The Supreme Court refused an interim stay on Section 44(3) even while referring the matter to Constitution Bench — many aspirants assume referral implies automatic stay.
5. RTI vs. Privacy — "blanket ban" framing: The government's position (PIB) is that Section 44(3) merely codifies existing judicial practice and Section 8(2) still permits disclosure in public interest. The petitioners' position is that it imposes an unconditional, unguided ban. UPSC may test which side holds which view — do not conflate them.

11. Sources

• [S1] "Constitution Bench to hear pleas against DPDP Act" — The Hindu, 17 February 2026 (Article excerpt provided as primary source) — (Tier 4)
• [S2] "DPDP Act, 2023 Upholds Privacy While Preserving Transparency Under RTI" — PIB, Government of India — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2158506 — (Tier 1)
• [S3] "DPDP Rules, 2025 Notified" — PIB, Government of India — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655 — (Tier 1)
• [S4] "The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)" — MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf — (Tier 1)
• [S5] "The Digital Personal Data Protection Bill, 2023 — PRS Legislative Research" — https://prsindia.org/billtrack/digital-personal-data-protection-bill-2023 — (Tier 1)

Note: Facts marked [S1] derive from the newspaper article excerpt (Tier 4 primary source). Facts marked [S2]–[S5] are grounded in Tier 1 government/legislative sources retrieved via web search.