Whose Privacy are the Petitioners of DPDPA Challenge Brigade are protecting?

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

The petitions filed in Supreme  Court against DPDPA 2023 mainly revolves around Section 44(3) and thee conflict with RTI Act. Petition of Mr Venkatesh Nayak restricts its prayer to the declaration of declaringSection 44(3) as Ultravires the Articles 14,19 and 21 of the Constitution.  Additionally it argues that Sections 17(1)(c),17(2) , 33(1) and 36 as well as Rule 23(2) as ultra-vires the constitution.

In this context let us see whose Personal data is at stake in an RTI application. Is it the personal data of the official who was involved in any of the decisions or Is it the personal data of the public whose personal data is sought to be disclosed in the reply.

We also should verify if there are already grounds in RTI act itself where the provision of information can be rejected even before invoking Section 44(3) of DPDPA 2023.

Let us look at the personal information involved of the official. The official is a public servant and once he is appointed for a public post, the information becomes a matter “Made public” and hence is not covered under Section 44(3) of the Act. This is a matter of interpretation of “Personal Data” which should exclude data that is made public as a “Business Contact”. The official’s name and designation is similar to “Business Contact” and hence is outside the scope of DPDPA.

However, the personal information of the beneficiaries of a Government project which is part of the information sought need to be considered as subject to Privacy Rights.

This can be anonymized before release in which case there is no violation of DPDPA.

Hence if the Government considers that no personal information is disclosed under Section 8(1)(j) other than in Anonymized form, the dispute would vanish.

This can be done through a reading down on both 8(1)(j) of RTI act and Sec 44(3) of DPDPA stating that disclosure of information of public during a RTI disclosure shall be consistent with the DPDPA under Section 7(d) and  17(2) (b) .

Under Section 17(2)(b) there is an additional restriction that says that the processing does not include making a decision that affects the data principal. Hence if the objective of the RTI activist is to stop any benefits under any scheme then the affected Data Principals have to be made parties to a legal request of their information and the department has to send notices to all the beneficiaries that a request has been made about their personal data. Since this would in most cases involve a disporportionate effort, the denial of information is justified under Section 8/9 of the RTI act itself.

In protecting the RTI of the activist, Judiciary cannot deny the Right to privacy of persons who are pawns in the dispute between the RTI activist and the Government.  If the petitioners are comfortable with Wection 9 of RTI act which enables disclosure of information which could result in infringement of Copyright, there is no logic why they should be excessively concerned about the amendment to 8(1)(j) which protects the information property rights of a data principal who is a beneficiary of a Government scheme.

What Section 44(3) has done is to remove the burden on the PIO to decide under Section 8(2) of RTI act that “public interest in disclosure outweighs the harm to the protected interests.”. This could however be a part of a judicial review and the RTI applicant who is denied information can proceed to challenge the demial in a Court of law.

If necessary, he can appeal on the decision to the CPIO and the State/Central Commission. Hence denial of any information under Section 44(3) amendment does not infringe any right fundamental or otherwise, linked to Article 14,19,21 or otherwise. It only diverts one stream of information which the PIO considers primafacie to infringe on the privacy of a citizen to a higher standard of scrutiny.

As indicated earlier, the above view does not apply to the identity of the officials who are discharging their duties in an official capacity.

If there is any information of the official beyond the identity which can be used for alleging corruption etc., then his own privacy rights should naturally be applicable along with the intention of the  RTI being treated as “llitigation”.

Hence the petition of Mr Venkatesh Nayak and others on Section 44(3) can be resolved with a clarification and reading down of the section that it does not apply to the disclosure of the names of the decision makers but only applies to the information of the public.

We shall discuss 17(1)(c), 17(2), 33(1) and 36 as well as Rule 23(2) separately in our subsequent articles.

We need to debate if we donot have our right to get DPDPA and DPDPA Rules retained in public interest as much as the few petitioners want it to be scrapped. The Supreme Court has to settle once for all how it can decide on the applications of a few advocates claiming to be representing public interest and not involve the larger public to express their objections. Who is representing the “Real Public Interest”  should be considered before entertaining the applications of the select few who always oppose the Government. If the background of the petitioners are checked, it would be clear that they only oppose the Government and it is not clear if their intentions are positive to the Country. The real public interest is therefore not represented by them as much as what Naavi or FDPPI represents.

I recall that in one of the old (around the year 2000) cases in Mumbai High Court on Cyber Cafe regulations, the Mumbai High Court had published an article of Naavi.org (at that time naavi.com) along  with some other information and had invited the public to send their views.  Without any intervention the Court had involved the “Real Public” to particiapte in the decision. Supreme Court should follow similar principles and should not allow the few petitioners to hijak the “Right to Represent the public”.

I am a member of the public and I donot consider the petitioners to be representing my View.

(Please send in your comments if any)

Naavi

 

 

About Vijayashankar Na

Naavi is a veteran Cyber Law specialist in India and is presently working from Bangalore as an Information Assurance Consultant. Pioneered concepts such as ITA 2008 compliance, Naavi is also the founder of Cyber Law College, a virtual Cyber Law Education institution. He now has been focusing on the projects such as Secure Digital India and Cyber Insurance
This entry was posted in Privacy. Bookmark the permalink.