Supreme Court Seeks Centre Response on Challenge to Data Protection Act by News Publishers

On October 27, the Supreme Court issued notice to the Union government on a writ petition filed by the Digital News Publishers Association challenging the constitutional validity of the Digital Personal Data Protection Act, 2023 and the rules framed under it. The Association says the absence of an express exemption for journalistic activity treats news organisations like any other entity that handles personal data. That, it contends, places an unjustified restriction on freedom of the press. The Centre has been asked to file its reply, and the Court will take up the matter after pleadings are complete.

Issuance of notice is only the first step. It records no view on the merits. It requires the Union to place its stand on record on how the data protection framework applies to digital news operations. The questions raised concern reporting, editing and publication in the digital environment.

Members of the Association, the petition states, are engaged in publication and dissemination of news through digital platforms. They routinely collect, store, analyse and publish information that includes personal data. Names, photographs, voice recordings, location details, employment histories, financial information and statements made by individuals form part of everyday reporting. Election coverage, court reporting, investigations into public spending and reports on corporate conduct all involve handling of such material.

Much turns on how a news publisher is classified under the 2023 Act. The statute regulates processing of digital personal data and places obligations on entities that determine the purpose and means of processing, described as Data Fiduciaries. Without a distinct provision for journalism, the Association argues, publishers fall in that general category. Routine editorial functions would then face the same conditions and compliance structure as commercial processing of customer or user data.

Investigative journalism received separate emphasis in the petition. Such work often requires collection of information without prior intimation to the persons concerned. Documents are verified over weeks or months. Reporters speak to several sources, cross-check versions and retain notes, recordings and datasets for later verification. A regime built around prior consent, defined purpose and limited retention, the Association says, sits uneasily with that method.

Protection of sources forms another limb of the objection. Confidential sources share information on the understanding that identity will not be disclosed. Obligations relating to disclosure, access and erasure of personal data, the petition contends, could expose newsrooms to demands that breach that assurance. Even the prospect of such demands, it says, could deter individuals from sharing information of public importance.

Earlier drafts had press safeguard

A large part of the challenge draws a comparison with earlier reform efforts. The petition cites the report of the committee headed by Justice B. N. Srikrishna in 2018 and the Personal Data Protection Bill of 2019. Both, according to the petitioners, contemplated a specific accommodation for journalistic processing. The omission of a comparable provision in the 2023 Act, the argument goes, marks a departure from that approach.

According to the petitioners, the earlier approach recognised the distinct character of journalism. News reporting serves the public's right to receive information. It works to short deadlines and involves judgments on newsworthiness, public interest and verification. Applying a uniform standard without regard to that function, they contend, fails to balance competing constitutional interests.

Detailed reply from the Union government is still awaited. In matters of this nature, the Centre ordinarily places before the Court the legislative background, the scheme of the statute and the safeguards available within the law. The Court will then assess whether the framework, as enacted and supplemented by the rules, leaves adequate room for press freedom while advancing data protection.

Parliament enacted the 2023 Act as India's first comprehensive legislation on digital personal data protection. It regulates processing of personal data in digital form and recognises the rights of individuals in relation to their data. The rules made under the Act spell out operational detail for implementation. The petition challenges both the parent legislation and that delegated framework insofar as they apply to journalistic activity.

How newsrooms handle personal data

The practical setting was set out at length. A digital newsroom now does more than publish text. It maintains content management systems, archives, search functions, analytics tools, newsletters and mobile applications. Reader comments, subscription records and usage logs are stored alongside editorial content. Journalists use email, messaging services and cloud storage to receive tips and documents. Video and audio files carry embedded metadata.

Much of what is published already exists in the public domain in some form. Court records, legislative proceedings, company filings, press releases and public statements contain personal details. Reporters compile and republish such material with context and analysis. The petition asks whether each stage of that editorial process — collection, organisation, verification and publication — would attract the full set of obligations that apply to other data processing.

Uncertainty itself creates risk, the Association has argued. Editors and legal teams must decide before publication whether a report complies with data protection requirements. Faced with ambiguity, some publishers may withhold or dilute reports involving personal data of influential individuals or institutions. The term used in public discussion for such restraint is chilling effect. The Court has made no finding to that effect at this stage.

Defamation law, contempt law and programme and advertisement codes already impose limits on publication. News organisations also follow internal editorial guidelines on privacy, identification of victims of sexual offences, reporting involving minors and use of hidden cameras. The petition claims no immunity from those constraints. Its case is that data protection adds a separate and extensive layer that was not designed with news gathering in mind.

Privacy law meets press freedom

The case will require the Court to address two fundamental rights. Freedom of speech and expression, which includes freedom of the press, is guaranteed under Article 19(1)(a) of the Constitution. The right to privacy has been recognised as part of the right to life and personal liberty under Article 21. The Supreme Court affirmed that position in its 2017 decision in Justice K. S. Puttaswamy v. Union of India. A law regulating personal information must therefore be tested against the privacy right, while a restriction on publication must satisfy the test under Article 19.

Indian courts have dealt with conflicts between reputation, privacy and reporting on several occasions. Orders restraining publication, directions to mask identities and claims for damages for unlawful disclosure have required judges to weigh public interest against individual harm. The present petition raises that balance in a different form. It asks how a general data protection statute should apply to an activity whose purpose is dissemination of information about persons and events.

One issue is whether the statute contains internal flexibility that can accommodate journalism. Provisions dealing with legitimate uses, State functions, public order and publicly available data form part of the legislative scheme. The Centre may argue that those provisions, read with the rules, leave sufficient room for bona fide reporting. The publishers contend that a general provision is no substitute for a clear journalistic accommodation and leaves too much to interpretation.

Proportionality will be the second inquiry. Constitutional courts examine whether a restriction serves a legitimate aim, whether it is suitable and necessary, and whether it strikes a fair balance. The petition will invite the Court to apply that test to specific obligations when imposed on the press, such as requirements linked to consent, notice, purpose specification and retention. The government's reply is expected to explain the purpose of those obligations and how they operate.

Remedies and enforcement form the third issue. Data protection laws provide for complaints, inquiries and penalties. For publishers, the concern extends to the forum and process for deciding complaints arising from news reports. Who decides, within what time and with what safeguards for interim orders will assume importance as pleadings develop.

Legislative history will also receive close attention. Courts often use it to understand the choices made by Parliament. The petitioners rely on that history to argue that an exemption is workable. The Union may respond that Parliament was entitled to adopt a different model and that absence of a separate clause does not by itself render the law invalid.

For the present, news publishers remain subject to the law as it stands. No interim order has been passed. The operation of the Act or the rules has not been stayed, whether for members of the petitioner Association or otherwise. Compliance decisions in newsrooms will therefore continue under the existing framework until the Court gives further directions.

The next stage is the counter affidavit by the Union. Once the government's position is on record, the petitioners will have an opportunity to file a rejoinder. The Court may then hear detailed arguments, possibly with intervention applications from other media bodies, journalist unions or privacy advocates. A date for that hearing will be fixed after notice is served and pleadings progress.