Privacy vs Transparency: How section 44(3) of DPDPA rewrites section 8(1)(j) of RTI Act

The DPDP Act and rules are coming into force from May 2027 as notified by the central government. The act is the first ever comprehensive law in India to protect digital personal data of an individual. However, the act and rules have triggered a major wave of high-stakes legal battles in India. One among them is with regard to section 44(3) of DPDPA, amending the section 8(1)(j) of RTI Act, and there by now it is prohibited for Public Information Officers to disclose any personal information of any individual. While this is done with an aim to protect privacy of an individual, however it is largely seen as an impediment on open governance and directly goes against the rule of transparency.

From its inception, the act has faced significant scrutiny from legal experts, privacy advocates, RTI Activists, and civil society, who argue that its structural framework is heavily tilted in favor of the government. Critics argue that while the law imposes strict compliance requirements on the private sector, it leaves expansive loopholes, unchecked executive power, and exemptions for state apparatuses. 

For instance, Under section 17(1)(c) and 17(2)(a) of the act, central and state governments under the garb of crime prevention, protecting security, sovereignty, and friendly relations with other states, can process the personal data, however this section does not define the scope or objective for exercising such powers. 

In a similar vein, under section 33(1) of the act, if the board determines on conclusion of inquiry that act and rules made thereunder by person is significant, it may after opportunity of being heard can impose such monterey penalty as specified in the schedule. However, nowhere in the act or rules the scope of “significant” is defined. 

Beyond these provisions, section 36 empowers the central government to “call for information” from DPBI, Data Fiduciary, Intermediary, and Data Principal. The language used in the section is dangerously vague, and grants unbridled discretionary powers to the central government, without specifying the scope and objective for exercising such powers. Moreover, there is absence of appeal against the orders of central government exacerbating the arbitrary power of the central government. 

Ultimately, Section 44(3) of the DPDPA creates an overbroad, blanket amendment to the RTI Act. By flatly exempting any "information which relates to personal information," the provision fails to clarify that its protections should only cover data that is digital or earmarked for digitisation. Consequently, it accidentally, or perhaps intentionally reaches far beyond the digital world, swallowing up offline, non-digital personal data as well.

Crucially, as per section 19 of the act read with rule 17, a five member committee consisting of cabinet secretary, secretary of ministry of electronics and information technology, secretary of department of legal affairs selects the chairperson of the DPBI. There is also a possibility for the government to be litigator before the DPBI, This creates a conflict and is seen as a  loophole which allows excessive governmental control over the board. 

Further more, If we look into the definition of “data fiduciary” it goes as “any person alone or in conjunction with any other person determines the purpose and means of processing data”, this is intended to also cover RTI Activists, Individual journalists, Advocates, Academicians etc, thereby violating their fundamental right to speech and expression, which is one of the strongest weapons in participatory democracy and open governance.  

In final analysis, the Digital Personal Data Protection (DPDP) Act is considered favorable to the Central Government due to broad state exemptions, the dilution of transparency under the RTI Act, and total government control over the Data Protection Board. Consequently, the framework functions more as a tool for state governance and surveillance than a mechanism for citizen privacy.