T
here is no gainsaying that data is the new gold, in fact it is platinum and diamond as well. This is evident in the manner the
(the Act) fortifies the rights around personal data. The legislature has endeavoured to safeguard personal data by creating a stringent statutory architecture. The access and use of personal data without consent of the data principal
, who under the Act is the person to whom the data relates, is restricted on all fronts, exception to the rule being the State and instrumentalities of the State. The State and its instrumentalities can access and direct processing of personal data under the situations specified under Section 7
of the Act and get further exemptions from its application under Section 17
of the Act.Section 7(a) prescribes that the data fiduciary , which under the Act is defined as a person who alone or in conjunction with others determines the purpose and means of processing of personal data, may process such data for the specified purpose for which data is given by the data principal and in respect of which consent to use has not been denied. The Act under Section 7(b) lays down the instances where State or its instrumentalities, may require a data fiduciary to process personal data. Such instances include purposes where processing of data is required to provide or issue to the data principal subsidies, benefits, services, certificates, permits or licences; for performance of functions under the law or in the interest of sovereignty, integrity of India, security of the State; for compliance of obligations under law or any judgment; to respond in medical emergency involving threat to life or immediate health of the data principal or any other individual; to provide medical treatment or health service during epidemics, outbreak of disease; and to ensure safety of or provide assistance to any individual during disaster or breakdown of public order, etc. The Act further lays down exemptions from its application in the instances specified under Sections 17(1) and (2) of the Act. The exemptions in relation to processing of the personal data provided under Section 17(1) of the Act are limited to the application of Chapter II except sub-sections (1) and (5) of Section 8 , Chapter III and Section 16 of the Act. Some situations, where such exemptions are provided, are where processing of such data is required by State or its instrumentalities for enforcing legal rights; by courts and tribunals for performance of their functions; for prevention, detection, investigation or prosecution of an offence, etc. However, the complete exemption from application of the prior consent regime as provided for in the Act is provided to the State and its instrumentalities under Section 17(2) of the Act but only for situations where processing of such data is required in the interest of sovereignty and integrity of India, for maintaining friendly relations with foreign States, for maintenance of public order, etc.
The purposes for which exemption under the Act is made available for persons other than State and its instrumentalities are illustrated under Section 17(2)(b) of the Act, where processing of data is “necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a data principal and such processing is carried on in accordance with such standards as may be prescribed”.
The narrow ambit of the exemptions begs a question about rights of journalists to access and process data for investigative purposes. Often times, hidden behind complex walls of data could be a story which needs to be brought to light and where disclosure might be the larger public interest. The hidden and underlying truth in such stories normally comes to light only after a deeper investigation, which is where journalists play a role. There is no provision in the Act as of now, which grants such journalistic activities exemption from the stringent application of the provisions of the Act. In the world’s largest democracy, it seems that the fourth pillar is now left to grapple with red tape prior consent under the Act, even when there might be events whose exigent disclosure to the public is in its larger interest and for the country’s greater good. Looking at the Act one can only imagine, that in past if we lived in an era of stringent data protection, where such prior consent regime was in place for journalists, most of the unravelled scams would still be shrouded in mystery. Alarmed by the looming existential crisis around journalistic activities on account of the Act, the Editors Guild sometime in February 2024 had strongly urged the Union Minister for Electronics and Information Technology, representing to him that the Act poses danger to the freedom of the press and requested that the processing of data for journalistic purpose be exempted from the application of the Act (The Wire, 2024) .
If we see the Preamble of the Act, it expounds the legislative intent behind its enactment, as being “An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.” The Preamble naturally leads us to a question, whether journalism is not a lawful purpose which needs accommodation in the privacy landscape under the Act? Running counter to an individual’s inherent right to privacy might be the right of the larger citizenry to be informed of matters which are in their larger interest and the two must coexist harmoniously and in balance. If an investigative journalists working secretly on a story for bringing to light a scam, Ponzi scheme or a malpractice affecting the lives of people is mired down with the onerous task of seeking prior consent at various levels before investigating or publishing a story, which they would have to if exemptions are not made available under the Act, then it would not just be an onerous task but the whole mandate of media being the fourth pillar of democracy would be lost. It is true that in the name of journalism a free pass or unbridled access to personal data ought not be given to anyone, but it would be in the nation’s interest to grant such an exemption for limited purposes like journalism. Few of the other activities which need consideration for similar exemptions are artistic and literary activities. Although exemptions in any such cases ought to be with checks and balances being put in place, possibly through framing of rules to establish standards for such exemptions and for laying down measures to ensure accountability for needless breach of privacy.
The Committee of Experts headed by Justice (Retd.) Sh. B.N. Srikrishna, which had drafted and proposed the Personal Data Protection Bill, 2018 had published a report titled “A Free and Fair Digital Economy — Protecting Privacy, Empowering Indians”. The Committee had published a white paper and had invited public comments, the said report had the following to say in respect of the public reaction on provision of exemptions under the Data Protection Act—
The White Paper suggested that exemptions may be provided from data processing for household purposes, journalistic/artistic and literary purposes, academic research, statistics and historical purposes, investigation and prosecution of crime, maintenance of national security and public order. Further, it was felt that exemptions should have sufficient safeguards, such as only allowing processing for the stated purpose, while ensuring that they were reasonable and not granted arbitrarily. Further, they should have an effective review mechanism in place. A large number of commenters agreed with the need for exemptions in the law.…
The report under the chapter titled Journalistic Activities, further exposited the following:
… Journalism acts in public benefit since it helps in building social accountability and brings about discussions on issues of public concern. If journalists were made to adhere to the grounds of processing personal data, it would be extremely onerous for them to access information. Further, mandating grounds of processing like consent would mean that accounts that are unfavourable to the data principal would simply not get published. There therefore exists a public interest in the untrammelled dissemination of news, current affairs and documentaries, especially when they inform, criticise and analyse issues of public importance.…
The report further prescribed a balancing measure between the right of privacy and access to personal data for publication purposes. It had proposed laying down of a mechanism to decide on access to personal data, rather than to lay it open in the name of journalistic activities — “To be able to give effect to both these rights, it is essential to ensure a balance between the freedom of expression and the safeguarding of personal data for the public good of a free and fair digital economy. This can be done by allowing recourse to the journalistic exemption where public interest in the disclosure of the personal data is overriding….”
On that basis, the previously proposed and subsequently amended Bills for Personal Data Protection in the years 2018, 2019 and 2021 carried a clearly defined “journalistic purpose” and even provided for the exemptions from certain provisions of the then proposed Act for such journalistic purposes. However, the current Act neither provides for journalistic exemptions nor defines journalistic purpose.
The Government is yet to frame the rules under the Act and there is hope in some quarters that the scope of exemptions, which under the Act is narrow and limited, may get expanded through such rules, once framed. Curiously though, the power to frame rules reserved under Section 40(2) of the Act in relation to the exemptions provided under Section 17 of the Act, is specifically reserved under Section 40(2)(q) of the Act only for setting “the standards for processing the personal data for exemption under clause (b) of sub-section (2) of Section 17”, which reflects the legislatures mandate to lay down standards for processing of data in relation to the exemptions already made available and does not indicate that rules for providing exemption for journalistic or any other kind of activities were under contemplation. Even otherwise, it is a debatable proposition in law whether the rules can expand the scope of the Act. The extant law suggests that conferment of rule-making power does not enable the rule-making authority to make a rule which travels beyond the scope of the enabling Act. All the aforesaid raise a serious doubt regarding the extent to which, if at all, journalistic exemptions may be introduced through rules.
It would be interesting to note that most of the nations across the world such as South Africa , Brazil , Canada , Singapore , Austria and those in Europe , albeit in different measures, do provide for journalistic exemptions under their respective data protection/personal information protection laws. Even in China, in terms of Article 13 of the Personal Information Protection Law, a personal information processor can process the personal information of an individual where it is reasonably processed for news reporting, media supervision and other activities conducted in public interest. Other popular exemptions, which are available in other parts of the world but are missing from the current Act in India, are exemptions for artistic and literary works.
There is no denying the primacy for protection of personal data of an individual and the life altering consequences which could result on account of its breach, but at the same time it is essential that with sufficient safeguards in place, access to data for journalistic purposes where there is public good and interest involved be also granted and under some circumstances, it be granted even for artistic and literary purposes. In this context, it would be relevant to remember what Mahatma Gandhi once said, “Freedom of the press is a precious privilege that no country can forego” and also what famous American broadcaster Walter Cronkite said, “Freedom of the press is not just important to democracy; it is democracy”. We would therefore, hold out hope, trust and at the same time urge that the Government, in the larger public interest would soon strike a balance between the right to privacy under the Act and exemptions relating to journalistic, artistic and literary activities.
*Advocate, LLB, LLM. Author can be reached at: udayan@udayanjain.com.
The Wire Staff, 2024, “Editors Guild Expresses ‘Grave Concerns’ on Data Protection Act in Representation to IT Ministry”, The Wire (thewire.in).
Personal Data Protection Bill, 2018.
Justice B.N. Srikrishna Committee, Report of the Committee on A Free and Fair Digital Economy — Protecting Privacy, Empowering Indians, 120 (2017).
Justice B.N. Srikrishna Committee, Report of the Committee on A Free and Fair Digital Economy — Protecting Privacy, Empowering Indians, 142 (2017).
Justice B.N. Srikrishna Committee, Report of the Committee on A Free and Fair Digital Economy — Protecting Privacy, Empowering India, 143 (2017).
State of Karnataka v. H. Ganesh Kamath, , para 7.
South African Personal Information Act, 2013, Ss. 7(1) & (2) and 44(2) & (3).
Brazilian General Data Protection Law, Art. 4.
Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Ss. 4(2), 7(1), 35 & 36 and Privacy Act of Canada, S. 69.
Singapore Personal Data Act, 2012, S. 17 and Sch. I Part 2.
General Data Protection Regulations, Part 2 Sch. 1, Part 5 Sch. 2. (European Union)
Personal Information Protection Law, Art. 13.
Mahatma Gandhi, Young India (1919-1922).
The post appeared first on .