Navigating the new norm: The DPDPA’s critical impact on journalism in the digital age

The Digital Personal Data Protection Act, 2023 (“DPDPA” or the “Act”) is a landmark legislation enacted to safeguard the personal and sensitive data of individuals in India. As per section 2(t) of the Act, Personal data refers to any information or data that can help in the identification of an individual. The primary objective of the act is to uphold the right to privacy of an individual. However, the Act has raised significant concerns for the media, the fourth pillar of Indian democracy. The indiscriminate application of the Act to journalistic activities poses a serious threat to press freedom. This article aims to understand the implications of the DPDPA to journalistic activities and the need for exemptions, if any.

The term journalism is defined by Britannica dictionary as “the collection, preparation, and distribution of news and related commentary and feature materials through such print and electronic media as newspapers, magazines, books, blogs, webcasts, podcasts, social networking and social media sites, and e-mail as well as through radio, motion pictures, and television.”

Journalism fundamentally depends on the ability to gather, transmit, and process personal data. However, the DPDPA places onerous requirements on journalists and media outlets, some of which include consent, data principal rights, and purpose limitation, among others. In the year 2024, Editors Guild (“Guild”) of India has already made representations on their concerns regarding DPDPA and the application of the Act to journalistic activities. The primary concerns of the Guild are as follows:

a) The consent to process personal data [Section 6, DPDPA], which is necessary under the Act, may be withheld by individuals and could result in the selective dissemination of information, thereby undermining the core function of journalism in serving the public interest. Moreover, it is infeasible and impractical to require journalists to adhere to the obligations, such as providing information to the government on request [Section 36, DPDPA] as imposed by the Act, as such requirements may hinder their ability to effectively report news and investigate matters of public concern.

b) Existing legal and ethical frameworks that govern journalists already provide sufficient safeguards for the responsible processing of personal data. Therefore, processing for journalistic purposes should necessarily be exempted from compliance with the provisions of the DPDPA to ensure the continued freedom and effectiveness of the press.

The Act, though aimed at protecting the privacy of individuals, may pose unrealistic expectations in the world of journalism and in journalistic activities. For instance, requiring consent from all the concerned individuals in a big news story may lead to slow reporting, hindrance in investigations, and can potentially keep crucial news from the public eye. The right to withhold consent under the Act could allow individuals to block journalistic investigations, hindering public interest reporting and transparency.

Section 3(c)(ii) of the Act explicitly exempts personal data from the Act's application if such personal data is made public by the data principal to whom such data belongs or any other person obligated by law to make such data public. This means that journalists can freely use publicly available data, especially of public figures like celebrities, and political leaders.

From the perspective of retrieving data under the Right to Information Act, 2005 (“RTI Act”), Section 8 (1)(j) provides that personal information that has no relationship to public activity or interest can only be shared if sharing of such information is deemed necessary by the Central/State Public Information Officer or the appellate authority. Section 44(3) of the Act changes how Section 8(1)(j) of the RTI Act works. Earlier, authorities could refuse to share "personal information" only after considering if sharing it would serve the public interest. Now, with the amendment, authorities can refuse to provide any "personal information" without applying the earlier public interest test.

This means individuals can withhold crucial information needed for public accountability merely by classifying it as "personal information," without balancing it against the public’s right to know. The RTI Act enables any entity to process information (which may involve personal and non-personal categories of data) from the public authorities (such public authorities majorly being governmental authorities). The personal data under the RTI Act can still be accessed by journalists - for example, a journalist can gain access to the quantum of public money spent on foreign travels done by a holder of public office, the remuneration records of bureaucrats, etc. Except in cases where disclosure of personal data would infringe privacy more than serve public interest, such as accessing a Member of Parliament’s passport contents, journalists can generally use the RTI Act to obtain publicly available data.

Within the global landscape, India is not the only country that is required to weigh and evaluate its data protection regime against freedom of the press. Jurisdictions like the European Union and Ghana [Sec. 64, Data Protection Act, Parliament of the Republic of Ghana], for instance, have taken measures to ensure that journalistic pursuits have been specifically exempted from their data protection legislations. Article 85(2) of the European Union's General Data Protection Regulation (“GDPR”) permits member states to introduce exemptions from certain provisions to safeguard freedom of expression and journalistic independence. Under the article, data related to criminal convictions and offences processed by news agencies and media outlets can be exempted from other GDPR provisions. For example, Austria and Belgium have made use of this provision to implement such exemptions. Even though there exists no blanket exemption for journalism, the Austrian amendment provides for protection for editorial secrecy and journalistic sources to uphold investigative journalism practices and “watchdog function” of media.  Similar stance has been taken by the regulators in Belgium to provide data privacy exemption to journalism while ensuring adequate transparency.

The Act's stringent compliance requirements further risks infringing on constitutional rights as enshrined under Article 19(1)(a) and Article 19(1)(g) of the Constitution of India.

Fortunately, the DPDPA is not without recourse. Section 17(5) of the Act allows for specific classes of data fiduciaries to be exempted from its scope. However, the Act so far is silent on establishing media or journalism as such a class liable for exemption under the Act. Despite Section 17(1(a)) and Section 17(1)(c) of the Act providing exemption for processing of personal data for enforcing any legal right or for prevention, detection, investigation and prosecution of an offence, there is no mention or inclusion of media personnel and outlets under the said provisions.  Advocates and policymakers must urge the Ministry of Electronics and Information Technology to exercise this provision, granting an exemption specifically for journalistic activities. This move would ensure the press can operate freely without the paralyzing effects of onerous compliance. The Act's limited exemptions hinder journalists' ability to access and process data for public-interest investigative reporting, as it lacks provisions for such activities.

The DPDPA, while crucial for safeguarding personal data, must align with the constitutional rights of journalism, ensuring both privacy and press freedom coexist harmoniously. Journalism, as a cornerstone of democracy, relies on accessing and disseminating information, often involving personal data. Striking a balance is essential to prevent the Act from stifling investigative reporting or undermining transparency. By exempting journalistic activities under Section 17(5), India can uphold both privacy rights and the press's role in empowering the public. Conformity between the Act and journalistic rights is vital to preserving democracy, accountability, and the public's right to know. With the DPDP rules awaiting approval and enactment in the country, it is also important for the rule makers to deliberate upon the intersection of data privacy laws and reasonable media restrictions to the extent that the role of media in upholding democracy is not curtailed.

About the authors: Rahul Deodhar is a Partner and Sudhanshu Singh is an Associate at Phoenix Legal.

Disclaimer: The opinions expressed in this article are those of the author(s). The opinions presented do not necessarily reflect the views of Bar & Bench.

If you would like your Deals, Columns, Press Releases to be published on Bar & Bench, please fill in the form available here.