Navigating The New Norm: The DPDPA's Critical Impact On Journalism In The Digital Age

The Digital Personal Data Protection Act, 2023 ("DPDPA" or the "Act") is a landmark legislation enacted to safeguard the personal and sensitive data of individuals in India. As per section 2(t) of the Act, Personal data refers to any information or data which can help in identification of an individual. The primary objective of the act is to uphold the right to privacy of an individual. However, the Act has raised significant concerns for media, the fourth pillar of Indian democracy. The indiscriminate application of the Act to journalistic activities poses serious threat to press freedom. This article aims to understand the implications of the DPDPA to journalistic activities and the need for exemptions, if any.

I. The Tension Between Data Privacy and Press Freedom

The term journalism is defined by Britannica dictionary as "the collection, preparation, and distribution of news and related commentary and feature materials through such print and electronic media as newspapers, magazines, books, blogs, webcasts, podcasts, social networking and social media sites, and e-mail as well as through radio, motion pictures, and television." Journalism fundamentally depends on the ability to gather, transmit, and process personal data. It is crucial in exposing corruption and informing the public, which generally involves handling sensitive data. The practice of investigative journalism and reporting on matters of public interest frequently requires journalists to collect and process personal data to verify facts, corroborate sources, and provide essential context for their stories. Exposing corruption, abuses of power, or matters affecting public welfare inevitably involves accessing information about persons involved, including their identities, roles, communications, and sometimes confidential details. However, the DPDPA places onerous requirements on journalists and media outlets some of which include consent, data principal rights, and purpose limitation amongst others. In the year 2024, Editors Guild ("Guild") of India has already made representations on their concerns regarding DPDPA and application of the Act to journalistic activities. The primary concerns of the Guild are as follows:

1. The consent to process personal data , which is necessary under the Act, may be withheld by individuals and could result in the selective dissemination of information, thereby undermining the core function of journalism in serving the public interest. Moreover, it is infeasible and impractical to require journalists to adhere to the obligations such as providing information to the Government on request as imposed by the Act, as such requirements may hinder their ability to effectively report news and investigate matters of public concern
2. Existing legal and ethical frameworks that govern journalists already provide sufficient safeguards for the responsible processing of personal data. Therefore, processing for journalistic purposes should necessarily be exempted from compliance with the provisions of the DPDPA to ensure the continued freedom and effectiveness of the press

The Act, though aimed at protecting privacy of individuals, may pose unrealistic expectations in the world of journalism and on journalistic activities. For instance, requiring consent from all the concerned individuals in a big news story may lead to slow reporting, hinderance in investigations, and can potentially keep crucial news from the public eye. Similarly, the right to withhold consent (provided to individuals under the Act may enable individuals to restrict access to information, thereby undermining transparency and accountability in the media. Practically, journalists engaged in investigative journalism may face cease and desist notices if the entity being investigated invokes their data privacy rights under the act, effectively delaying media coverage that serves public interest.

II. Use of publicly available data by the journalists

Section 3(c)(ii) of the Act explicitly exempts personal data from the Act's application, if such personal data is made public by the data principal to whom such data belongs or any other person obligated by law to make such data public. This means that journalists can freely use publicly available data specially of public figures like celebrities, and political leaders.

From the perspective of retrieving data under the Right to Information Act, 2005 ("RTI Act"), Section 8 (1)(j) provides that personal information that has no relationship to public activity or interest could only be shared if sharing of such information is deemed necessary by the Central/State Public Information Officer or the appellate authority. Section 44(3) of the Act changes how Section 8(1)(j) of the RTI Act works. Earlier, authorities could refuse to share "personal information" only after considering if sharing it would serve the public interest. Now, with the amendment, authorities can refuse to provide any "personal information" without applying the earlier public interest test.

This implies that there is no longer a requirement to balance a person's privacy rights with the public's right to know. As a result, individuals can withhold important information that might be necessary for holding public authorities accountable, simply because it is categorized as "personal information".

The RTI Act enables any entity to process information (which may involve personal and non-personal categories of data) from the public authorities (such public authorities majorly being governmental authorities). The personal data under the RTI Act can still be accessed by the journalists, for example, a journalist can gain access to the quantum of public money spent on foreign travels done by a holder The RTI Act enables any entity to process information (which may involve personal and non-personal categories of data) from the public authorities (such public authorities majorly being governmental authorities). The personal data under the RTI Act can still be accessed by the journalists, for example, a journalist can gain access to the quantum of public money spent on foreign travels done by a holder of public office , the remuneration records of bureaucrats etc. Barring few instances wherein revelation of personal data can do more to infringe privacy of individuals rather than upholding public interest like, requesting for access to information of contents of a Member of Parliament's passports, journalists are free to use the RTI Act to access publicly available data.

III. Learning from Global Examples: The Need for an Exemption for Journalism

Within the global landscape, India is not the only country that is required to weigh and evaluate its data protection regime against freedom of the press. Jurisdictions like the European Union and Ghana , for instance, have taken measures to ensure that journalistic pursuits have been specifically exempted from their data protection legislations. Article 85(2) of the European Union's General Data Protection Regulation ("GDPR") permits member states to introduce exemptions from certain provisions to safeguard freedom of expression and journalistic independence. Under the article, data related to criminal conviction and offences processed by news agencies and media outlets can be exempted from other GDPR provisions . For example, Austria and Belgium have made use of this provision to implement such exemptions. Even though there exists no blanket exemption for journalism, the Austrian amendment provides for protection for editorial secrecy and journalistic sources to uphold investigative journalism practices and "watchdog function" of media . Similar stance has been taken by the regulators in Belgium to provide data privacy exemption to journalism while ensuring adequate transparency.

In line with the Global viewpoint, the indiscriminate application of the Act to journalistic activities in India endangers press freedom, an essential ingredient for the effective working of a democratic polity. The Act's stringent compliance requirements further risks infringing on constitutional rights as enshrined under Article 19(1)(a) and Article 19(1)(g) of the Constitution of India.

IV. A Call to Action: Exempting Journalism from the DPDPA

Fortunately, the DPDPA is not without recourse. Section 17(5) of the Act allows for specific classes of data fiduciaries to be exempted from its scope. However, the Act so far is silent on establishing media or journalism as such a class liable for exemption under the act. Despite Section 17(1(a)) and Section 17(1)(c) of the Act providing exemption for processing of personal data for enforcing any legal right or for prevention, detection, investigation and prosecution of an offence, there is no mention or inclusion Fortunately, the DPDPA is not without recourse. Section 17(5) of the Act allows for specific classes of data fiduciaries to be exempted from its scope. However, the Act so far is silent on establishing media or journalism as such a class liable for exemption under the act. Despite Section 17(1(a)) and Section 17(1)(c) of the Act providing exemption for processing of personal data for enforcing any legal right or for prevention, detection, investigation and prosecution of an offence, there is no mention or inclusion of media personnel and outlets under the said provisions. Advocates and policymakers must urge the Ministry of Electronics and Information Technology to exercise this provision, granting an exemption specifically for journalistic activities. This move would ensure the press can operate freely without the paralyzing effects of onerous compliance.

In its current state, the narrow scope of the exemptions may raise questions regarding a journalist's rights to access and process data for journalistic purposes including but not limited to investigative reporting. Often, concealed behind complicated data barriers is a tale that needs to be told, and the disclosure may serve the best interests of the public. In multiple instances, the underlying truth comes to light only after a thorough investigation, which is where journalists come in picture with their investigative reporting. However, the Act presently provides no exemption to such journalistic activity from the Act's strict provisions.

In the world's largest democracy, it seems that the fourth pillar is now entangled in regulatory hurdles in the form of prior consent requirement under the Act, even in cases where immediate disclosure to the public is in its larger interest and for the country's greater good.

V. Conclusion

The DPDPA, while crucial for safeguarding personal data, must align with the constitutional rights of journalism, ensuring both privacy and press freedom coexist harmoniously. Journalism, as a cornerstone of democracy, relies on accessing and disseminating information, often involving personal data. Striking a balance is essential to prevent the Act from stifling investigative reporting or undermining transparency. By exempting journalistic activities under Section 17(5) , India can uphold both privacy rights and the press's role in empowering the public. Conformity between the Act and journalistic rights is vital to preserving democracy, accountability, and the public's right to know. With the DPDP rules awaiting approval and enactment in the country, it is also important for the rule makers to deliberate upon the intersection of data privacy laws and reasonable media restrictions to the extent that the role of media in upholding democracy is not curtailed.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.