The Right to Know vs. The Right to Privacy: India’s Data Law Dilemma
Introduction
India has two landmark citizen-rights laws less than 20 years apart—one demanding openness, one demanding restraint. The Right to Information Act, 2005, came as a hope for democratic India, granting citizens the power to hold those in power accountable. While in 2023, the Digital Personal Data Protection Act was enacted to secure the personal data of individuals in the digital economy. The two fundamental rights-based laws, both meant to protect the citizen, now pull in opposite directions. This raises a question the Supreme Court itself is now being asked to answer.
Understanding the Two Laws
The Right to Information Act, 2005
The landmark case of State of U.P. vs. Raj Narain (1975) first recognized the right to information as a part of the fundamental right to freedom of speech and expression [Article 19(1)(a) of the Indian Constitution]. The Supreme Court of India held that people are masters in a democracy and have the right to know how the government works, making disclosure of official information to the public a crucial rule.
Under the RTI Act, citizens can file RTI applications, and the Central/State Public Information Officers, within the proviso, use such information for the benefit of the public at large. Section 7 of the RTI Act makes a proactive obligation on the public authorities to disclose such information upon request.
The Digital Personal Data Protection Act, 2023
The DPDP Act is an enactment made in India laying down the directives on how personal data should be collected, stored, processed, and administered. The core principle of the DPDP Act is safeguarding the personal information of an individual. The historic Justice K.S. Puttaswamy (Retd.) v. Union of India case, decided by a nine-judge bench, declared that the right to privacy is a fundamental right under Article 21 of the Indian Constitution.
The DPDP act operated between the data principal (person whose date is collected) and the data fiduciary (company or app that collects the data), governing on how to use the data collected and granting statutory power to the principal to control their data.
The Flashpoint: Section 44(3) of the DPDP Act
Section 44(3) of the DPDP Act amends Section 8(1) of the RTI Act. Section 8(1) of the RTI Act stated that personal information of an individual could be disclosed in the question of public interest, but the adoption of the DPDP Act section 44(3) removes the condition of public interest and replaces it with a broad exemption, putting a blanket ban on the personal information in RTI applications.
The Right to Information Act never defined what constitutes “personal information”; consequently, the DPDP Act’s broad definition now fills that gap. The new rule makes it undisputed that any “personal information” cannot be disclosed, whatever the reason may be.
The Exemption Gap: How Public Authorities Are Treated Differently
The DPDP Act, 2023, grants broader immunity to the public authorities than to private data fiduciaries. The private data fiduciaries have to face strict consent mandates, retention caps, and high compliance penalties, while, on the contrary, the public bodies enjoy systematic derogations for public welfare and national security. This creates an accountability imbalance where the commercial data collection is over-surveilled while the large-scale data acquisition operates under near-absolute immunity.
Here lies the deeper asymmetry: while ordinary citizens face a stricter bar to access the personal information under RTI, public authorities operate under relatively relaxed obligations. Section 17(2)(a) of the DPDP Act exempts notified state instrumentalities from the Act altogether when processing data serves the state interest, while Section 17(4) waives specific citizen-facing duties—such as data erasure and grievance redressal—for government processing more broadly.
Judicial Intervention
CPIO v. Subhash Chandra Agarwal (2019)
Back in 2019, RTI activist Subhash Chandra Agarwal wanted to know something the judiciary didn’t much want to share: judges’ asset declarations and the correspondence behind judicial appointments, both held by the Chief Justice’s office. He files an RTI. The CJI’s office pushed back.
The case went all the way to a five-judge Constitutional Bench, which ruled that yes, the CJI’s office counts as a “public authority” under the RTI Act—so the information isn’t automatically off-limits. But it isn’t automatically fair game either. The Court’s real contribution here was refusing to pick a winner between privacy and transparency. Neither right trumps the other by default; each request gets weighed on its own, against the public interest at stake.
That’s the balancing act Section 44(3) is accused of throwing out. And oddly enough, both camps in the DPDP-RTI fight now lean on the same 2019 ruling to make their case—which is probably why the Supreme Court can’t just wave the issue away this time.
Conclusion
Both statutes trace back to the same constitutional commitment: the dignity and rights of the individual citizen. And yet, in practice, they now work at cross purposes. The RTI Act rests on the idea that citizens have a right to scrutinize how public power is exercised. The DPDP Act rests on the idea that individuals have a right to control their own data. Neither premise is flawed on its own terms. The problem is how Section 44(3) settles the conflict between them—not by weighing the two interests against each other case by case, but by deciding the matter in advance, squarely in favor of privacy, with no room for exception.
That decision now sits with the courts. The Constitutional Bench will have to do something close to what the Court did in Agarwal nearly a decade ago—work out where privacy ends and public accountability begins. It’s not a question with an obvious answer, which is presumably why the Court didn’t dispose of it at the first opportunity. Until there’s a ruling, India’s transparency framework runs on a provision that hasn’t really been tested against hard facts. And it’s the ordinary RTI applicant, not the legislature or the judiciary, who ends up finding out what that means in practice.
