Supreme Court Examines Scope of ‘Personal Data’ under DPDP Act, 2023

Context:

Recently, The Supreme Court of India has agreed to examine petitions challenging provisions of the Digital Personal Data Protection (DPDP) Act, 2023 and related rules. The case raises an important constitutional question: what exactly constitutes “personal data” or “personal information” under India’s data protection framework.  The Court observed that the issue involves balancing two competing fundamental rights—the Right to Privacy and the Right to Information (RTI)—and indicated that it may have to clarify the scope of “personal information.”

Background:

• • • Digital Personal Data Protection Act, 2023: The DPDP Act provides India’s first comprehensive framework for the protection and processing of personal data.
      • It regulates how digital personal data is collected, stored and processed.
      • It creates obligations for Data Fiduciaries (entities processing data).
      • It establishes a Data Protection Board of India for enforcement.
      • It grants rights to individuals (Data Principals) over their personal data.
      • Under the Act, personal data refers to any data about an identifiable individual.
    • Examples include:
      • Name
      • Mobile number
      • Address
      • Aadhaar number
      • Location data
      • Online identifiers

Why is the Issue before the Supreme Court?

• • • Amendment to the RTI Act
      • The Digital Personal Data Protection (DPDP) Act, 2023 amended Section 8(1)(j) of the RTI Act, expanding exemptions related to personal information.
      • Critics argue that:
        • Authorities may deny RTI requests by labeling information as “personal data.”
        • This may weaken transparency and accountability in governance.
        • Petitioners include journalists, civil society groups, and transparency activists, who argue that the amendment dilutes the RTI framework.
    • Conflict between Two Fundamental Rights:
      • The case highlights a constitutional conflict between:
        • Right to Privacy: Recognised as a fundamental right in the 2017 Justice K.S. Puttaswamy judgment.
        • Right to Information: Derived from Article 19(1)(a) (Freedom of Speech and Expression).
      • The Supreme Court noted the need to balance these competing interests and clarify the meaning of personal data.

Key Legal Issues before the Court:

• • • What Constitutes “Personal Data”?
      • The Court may clarify:
        • Whether information about public officials performing public duties qualifies as personal data.
        • Whether such information can be withheld on privacy grounds.
    • Scope of Public Interest Exception
      • Earlier, RTI allowed disclosure of personal information if larger public interest existed.
      • Critics argue the DPDP amendment weakens this balancing principle.

Constitutional Principles Involved:

• • • Proportionality Test
      • Restrictions on fundamental rights must satisfy:
        • Legitimate aim
        • Necessity
        • Proportionality
        • Procedural safeguards
      • The Court may apply this doctrine to evaluate the DPDP provisions.
    • Privacy Jurisprudence
      • Key precedents include:
        • Puttaswamy v. Union of India (2017): Recognised privacy as a fundamental right.
        • CPIO v. Subhash Chandra Agarwal (2019): Balanced privacy with RTI transparency.
      • The present case may refine this balance in the digital era.

Conclusion:

The Supreme Court’s interpretation of “personal data” under the DPDP law will shape the balance between privacy and transparency in India.
The ruling could become a landmark judgment in India’s data protection and information governance framework.