In August 2023, India got its first comprehensive data protection law, the Digital Personal Data Protection (DPDP) Act, 2023. The government is in the process of framing rules and regulations to operationalise the law and the process is expected to be done after the general election. The law is largely based on users giving consent for the processing of their personal data. It provides basic rights such as access to and erasure of data, places some obligations on companies, and establishes a complaints body for grievance redress. However, the law might have an invisible impact on journalistic free speech.
Typically, data protection laws exempt journalistic activities from privacy obligations such as notifying users and taking their consent before using their personal data. Three previous drafts of the DPDP Act had exemptions for journalistic activities, but the final law withdrew such an exemption. The Editors Guild of India also pointed to this risk and in a letter to the government, requested that journalistic activities be exempted from the DPDP Act.
An impediment
Now you may ask, what does privacy have to do with journalistic free speech? Imagine that you are a journalist writing about a Member of Parliament (MP) and his performance. For your story, you use information from their lives such as the meetings they held, where, and with whom, the towns, villages, and cities they travelled to. How often did they use a private jet or a chartered plane? What about their financial background and also the investments made by their close family members? Most of this information is not available in the public domain and needs a lot of research. All this information about an MP is their ‘personal data’, which is data protected under the DPDP Act. Consequently, any journalist who wishes to use this data will have to get their consent before publishing the story. Even after publication, the MP can exercise their right to erasure and request journalists to delete such stories.
Further, the DPDP Act empowers the government to call for information from any data processor in India. Depending on how this provision is interpreted and applied, this may impact the confidentiality that journalists must maintain for their sources and research documents. Taken together, this need for journalists to get consent before publishing their story, the potential for the subject to rely on the right to erasure to have the story deleted, and the power of the government to call for information would likely impede a journalist’s ability to discharge their role as the fourth estate — of holding the state accountable.
If this is a well-identified challenge, then why did the government remove such an exemption from subsequent drafts? This remains unclear. Three previous drafts of the DPDP Act, one released by an expert committee on data protection (2018), the other by the government (2019), and the third released by a Joint Parliamentary Committee in 2021, contained clear exemptions for journalistic activities. In two subsequent drafts of the DPDP Act (2022 and 2023), the exemption given to journalistic activities was withdrawn without reasons being given.
No clarification
This instance of the end stage removal of the clause for journalistic exemption points to the need for adopting a more robust and transparent public consultation process around proposed laws. One of the primary ways to get feedback on a law is to institute an ‘open and transparent’ public consultation model. Although the Indian government released three separate drafts of the data protection law for public consultation, none of the comments received on the drafts has ever been released in the public domain. This impedes the ability of citizens to understand what different stakeholders were saying and who was finally heard in the final formulation of the law. The government has also conducted invite-only town halls to gather feedback on drafts of the DPDP Act.
The withdrawal of exemptions for journalistic activities was not discussed in such town halls. And, no clarification was provided by the government for its withdrawal. Unfortunately, these consultations and town halls are often not conducive to enable open debate and deliberation on the proposed law and its provisions.
An appeal
Legally then, what are the solutions we can envision? In addition to enabling an open and transparent consultation process, the government can swiftly remedy this problem via rules under the DPDP Act. Under the Act, the central government has the power to exempt any data processor or ‘classes’ of data processors from any provisions of the law. These give wide powers to the government to single-handedly provide and take away an exemption — but it is the quickest route available in this case. Although an exemption for journalistic work should form part of the core text of the law, the government must use this rule to exempt journalistic entities, including citizen journalists, from any obligations under the DPDP Act. This will ensure that the DPDP Act does not have negative consequences on journalistic free speech in India.
Shashank Mohan is Programme Manager at the Centre for Communication Governance, National Law University Delhi
