Supreme Court Upholds Privacy Rights in Digital Data Protection Act
The Supreme Court of India delivered a significant ruling on Thursday, asserting that invoking public interest cannot serve as a blanket justification for seeking extensive access to the private information of individuals holding public offices. This landmark statement came during a hearing where the court agreed to entertain petitions challenging specific restrictions embedded within the Digital Personal Data Protection (DPDP) Act, which are designed to safeguard personal privacy.
Balancing Rights: Information Access vs. Individual Privacy
A bench comprising Chief Justice Surya Kant, Justice Joymalya Bagchi, and Justice Vipul M Pancholi articulated a crucial principle: "The right to access information in public interest must be balanced with the right to privacy of individuals. There cannot be a provision allowing sweeping access to an individual's private information." This declaration underscores the court's commitment to protecting citizens' privacy while acknowledging the importance of transparency in governance.
Legal Challenges and Concerns Raised
Senior advocate Indira Jaising, representing the petitioner, highlighted a critical conflict between existing legislation and the new DPDP Act. She argued that a provision in the Right to Information (RTI) Act, which permits access to private data concerning the background of individuals appointed to public or constitutional offices, has been effectively nullified by the DPDP Act. Jaising expressed concerns that this could enable the state to access any person's data under the pretext of maintaining public order, potentially leading to widespread state surveillance of citizens.
The bench acknowledged these concerns, noting that the court would ultimately need to define what constitutes public versus private data. This distinction is vital for ensuring that privacy protections do not unduly hinder legitimate public interest inquiries.
Compensation and Regulatory Oversight Issues
Jaising further pointed out discrepancies in compensation mechanisms between different laws. Under the Information Technology Act, individuals whose data is illegally accessed are entitled to compensation. However, under the DPDP Act, such compensation would be directed to the government rather than the affected individual, raising questions about accountability and victim redressal.
Additionally, she raised concerns about the Data Protection Board of India, the primary regulator for data privacy under the DPDP Act. Jaising argued that the board lacks judicial oversight, despite being tasked with deciding competing rights related to data access and privacy. The bench concurred with this assessment, emphasizing that "in such situations, there should be a judicially trained mind on the board."
Urgent Adjudication and Previous Petitions
Recognizing the urgency of these matters, the bench stated, "These matters require urgent adjudication," and agreed to list the case for hearing as soon as possible. This decision follows earlier petitions filed on February 16, which alleged that amendments to the RTI Act necessitated by the DPDP Act had diminished the right to information to a mere paper form. The petitioners argued that authorities could now deny information by classifying it as 'personal,' thereby undermining transparency.
While the Supreme Court had previously refused to stay the operation of the DPDP Act, citing its alignment with the Puttaswami case verdict that recognized the right to privacy as a fundamental right, the current hearing indicates a renewed focus on ensuring that privacy protections do not come at the expense of public accountability. The court's willingness to address these complex issues highlights the ongoing evolution of data protection laws in India, balancing technological advancements with constitutional safeguards.
