Legal Showdown Over Data Privacy and Press Freedom

NEW DELHI — In a significant legal development impacting the media landscape, the Supreme Court has sought a formal response from the central government regarding a petition filed by the Digital News Publishers Association (DNPA). The association, which represents 21 prominent Indian news organisations, has challenged the constitutional validity of the Digital Personal Data Protection (DPDP) Act, 2023, and its accompanying rules notified in late 2025.

At the core of the legal challenge is the glaring absence of a specific statutory carve-out or exemption for journalism. Publishers argue that without protection for news reporting and information gathering, the sweeping mandates of the law threaten to severely restrict the freedom of the press and dilute citizens' right to information.

The Anatomy of the Challenge

Passed by Parliament in August 2023, the DPDP Act stands as India's maiden comprehensive legislation governing digital personal data. It mandates that any entity processing personal data—designated as a "Data Fiduciary"—must secure explicit consent from individuals or operate strictly within a limited set of "legitimate uses" outlined in Section 7 of the statute. Non-compliance carries severe financial penalties of up to Rs 250 crore.

However, media bodies have pointed out a critical omission: news reporting finds no place among the legitimate uses under Section 7 or the specific exemptions listed under Section 17. While earlier draft iterations of the data protection framework in 2018, 2019, and 2021 incorporated journalistic exemptions, the final legislation dropped these protections.

Legal representatives for the publishers contend that under the current framework, a journalist investigating or reporting on an individual could technically be required to secure prior explicit consent from the subject, creating an operational impossibility for investigative reporting and public accountability.

Contested Rules and the RTI Amendment

The petition also trains its sights on specific provisions within the newly notified DPDP Rules and amendments to legacy statutes. Rule 23, framed under Section 36 of the Act, has drawn particular ire from civil liberties and media advocacy groups. The provision empowers the central government, through an authorized official, to compel any data fiduciary or intermediary to furnish information while simultaneously barring them from disclosing that such a directive was issued.

Furthermore, the DNPA petition challenges Section 44(3) of the DPDP Act, which substantially amended Section 8(1)(j) of the Right to Information (RTI) Act. Previously, personal information could only be withheld if it lacked a nexus to public activity or would cause an unwarranted invasion of privacy, subject to a larger public interest override. The amended provision broadly exempts information that relates to personal data, a move critics argue severely curtails transparency.

As the Supreme Court initiates its review, the case sets the stage for a landmark judicial balancing act between individual privacy rights and the imperative of a free, unhindered press in a democracy.

Reported by Gaurav Sen for Daily News 365.