The Great Unraveling, When the Right to Know Collides with the Right to Privacy
As the Supreme Court Confronts a Constitutional Crossroads, India’s Transparency Architecture Hangs in the Balance
On a Monday in early 2026, the Supreme Court of India did something that will shape the future of transparency and privacy in the country for decades to come. It referred a series of petitions challenging the amendment to Section 8(1)(j) of the Right to Information (RTI) Act—an amendment effected by Section 44(3) of the Digital Personal Data Protection (DPDP) Act, 2023—to a Constitution Bench, recognising its “constitutional sensitivity.”
The Chief Justice of India went further, remarking that the Court might “have to lay down what is meant by ‘personal information’.” This seemingly simple question—what counts as personal information—lies at the heart of a conflict between two fundamental values: the citizen’s right to know what their government is doing, and the individual’s right to control information about themselves.
The stakes could not be higher. The RTI Act, enacted in 2005, was designed to create an informed citizenry and ensure state accountability—principles that are vital for any functioning democracy. Over two decades, it has transformed the relationship between citizens and the state, empowering ordinary people to ask questions, demand answers, and hold officials accountable. The DPDP Act, passed in 2023, was designed to protect personal data from misuse in an increasingly digital world—a goal that is equally important. But in its implementation, it has delivered what many are calling a “body blow” to transparency by diluting one of the RTI Act’s foundational sections.
The Original Balance: Section 8(1)(j) of the RTI Act
To understand what is at stake, one must first understand how the RTI Act originally balanced transparency and privacy. Section 8(1)(j) allowed the withholding of personal information only under specific conditions: if it had no relationship to any public activity or interest, or if its disclosure would result in an unwarranted invasion of privacy.
Crucially, the section included a “public interest override” as an integral feature of the 2005 Act. This override permitted disclosure even of personal information if a Public Information Officer (PIO) was satisfied that the larger public interest justified it. The logic was straightforward: privacy is important, but it is not absolute. When the public’s right to know about government functioning outweighs an individual’s interest in keeping information private, transparency should prevail.
This balance served India well for nearly two decades. Citizens could request information about government officials—their assets, their decisions, their conduct. They could access procurement records that revealed how public money was spent. They could examine audit reports that exposed waste and corruption. They could scrutinise public spending data that showed whether development funds reached their intended beneficiaries. All of these might involve personal information, but they also bore directly on how the state functions. PIOs, guided by the public interest override, could make nuanced decisions that respected privacy while ensuring accountability.
The DPDP Amendment: A Blanket Ban
The DPDP Act amendment removes this public interest override entirely. Instead, it prohibits the disclosure of “any information which relates to personal information,” amounting to a blanket ban. The careful balancing act that had governed RTI requests for nearly twenty years has been replaced by an absolute prohibition.
The practical consequences are severe. Requests concerning government officials can now be rejected on the grounds that they involve personal information. Procurement records, which reveal how public money is spent, can be withheld. Audit reports, which expose waste and corruption, can be shielded. Public spending data, which citizens need to hold government accountable, can be declared off-limits.
The language of the amendment is sweeping: “any information which relates to personal information.” This could be interpreted to cover almost everything. What government record does not relate, in some way, to personal information? Files are created by individuals, decisions are made by individuals, contracts are signed by individuals. If the mere presence of personal information is enough to trigger the ban, then vast swaths of government functioning become opaque.
The Legitimate Uses Paradox
The Internet Freedom Foundation, which has campaigned for RTI, highlights a troubling paradox in this situation. Section 7 of the DPDP Act allows the state to process personal data without consent for various purposes. The government can monitor citizens, collect their data, and use it for its own ends—all without seeking permission or providing transparency about how the data is used.
But the RTI amendment prevents citizens from using similar principles to seek transparency from the state. The asymmetry is stark and deeply undemocratic: the state can see the citizen, but the citizen cannot see the state. The government can access personal information about its citizens, but citizens cannot access information about their government, even when that information bears directly on public interests.
This is not the balance that the Constitution envisions. A democracy requires that citizens be able to scrutinise their government. When that scrutiny is blocked, accountability suffers, and with it, the quality of governance. The state becomes a black box—inputs go in, decisions come out, but the internal workings remain hidden from those who are most affected by them.
The Chilling Effect on the Press
The amendment also creates what legal experts call a “severe chilling effect” on the press. As argued in one of the writ petitions filed by The Reporters’ Collective, journalists could be classified as “data fiduciaries” under the DPDP Act and its Rules when collecting information for investigative reports.
This classification carries serious consequences. Non-compliance with the Act can attract fines of up to ₹250 crore. For a news organisation, even the threat of such penalties can be enough to deter investigation. Why risk financial ruin to pursue a story that might involve personal information, however relevant to the public interest?
The result could be a dramatic reduction in investigative journalism. Stories about corruption, malfeasance, and abuse of power often require examining documents that contain personal information—the assets of a minister, the decisions of a bureaucrat, the contracts of a public official. If every such examination risks crippling fines, many stories will simply not be pursued. Journalism risks being reduced to publishing government releases, a prospect that should alarm anyone who believes in the Fourth Estate’s role as a check on power.
The irony is striking. The DPDP Act provides exemptions to startups, recognising that young companies need room to innovate without being crushed by compliance burdens. But it omits similar protections for journalism, despite the critical role that a free press plays in democratic accountability. This is not merely an oversight; it reflects a particular vision of the relationship between state and society—one in which the state’s power to collect information is maximised while the citizen’s power to access information is minimised.
The European Contrast
The contrast with the European Union’s General Data Protection Regulation (GDPR) is instructive. The GDPR, which is often held up as a global gold standard for data protection, does not treat privacy and transparency as opposing values. Instead, it seeks to balance them, recognising that both are essential for democratic governance.
The GDPR includes specific exemptions for journalistic purposes, acknowledging that the public’s right to know may sometimes override individual privacy interests. It does not create a blanket ban on the processing of personal information; rather, it establishes a framework within which such processing can occur when justified by legitimate purposes. It recognises that a free press cannot function if every investigative step risks massive penalties.
This balanced approach reflects a mature understanding of the relationship between privacy and transparency. They are not zero-sum; they can and must coexist. A society that prioritises privacy to the exclusion of transparency becomes opaque and unaccountable. A society that prioritises transparency to the exclusion of privacy becomes intrusive and oppressive. The task of governance is to find the right balance.
India’s DPDP Act, as amended, tilts too far toward privacy at the expense of transparency. It creates an information asymmetry that benefits the state at the expense of citizens. And it does so without the nuanced exceptions and balancing mechanisms that make data protection regimes in other democracies workable.
The Constitutional Question
The Supreme Court’s decision to refer these petitions to a Constitution Bench recognises that fundamental constitutional questions are at stake. The Court may have to define, for the first time, what “personal information” means in the context of the RTI Act. It may have to reconcile the right to privacy—recognised as a fundamental right in the landmark Puttaswamy judgment—with the right to information, which is essential for the exercise of other fundamental rights.
The Court will also have to consider its own precedents. In Central Public Information Officer v. Supreme Court of India (2019), the Court held that personal information should remain private unless disclosure is necessary for the larger public interest. This judgment recognised that privacy is not absolute and that transparency may sometimes override it. The DPDP amendment, by removing the public interest override, directly contradicts this principle.
The Constitution Bench must decide whether the amendment can stand consistently with the constitutional scheme. It must determine whether the blanket ban on disclosing personal information is compatible with the democratic principle that citizens have a right to know what their government is doing. And it must articulate a framework that balances privacy and transparency in a way that serves both values.
The Two-Decade Legacy of RTI
It is worth recalling what the RTI Act has achieved in its two decades of existence. Before 2005, government information was largely inaccessible to ordinary citizens. Files were hidden, decisions were opaque, and accountability was minimal. The RTI Act changed this by creating a statutory right to information and establishing mechanisms for its enforcement.
Over the years, the RTI has significantly reduced the information asymmetry between state and citizen. Poor people, who were previously excluded from decision-making processes, have used the Act to demand their rights, expose corruption, and hold officials accountable. Journalists have used it to investigate stories that would otherwise remain hidden. Civil society organisations have used it to monitor government programmes and advocate for reform.
The Act has not been perfect. Implementation has been uneven, with some information commissions overwhelmed by backlogs and some officials resistant to transparency. But the overall impact has been profoundly positive. India is a more transparent, more accountable, more democratic country because of the RTI Act.
The DPDP amendment threatens this legacy. By creating a blanket ban on disclosing personal information, it closes off vast areas of government functioning from public scrutiny. It hands officials a powerful new tool for resisting transparency: simply claim that the requested information is personal, and the request can be rejected. No public interest override, no balancing, no accountability.
The Way Forward
The Constitution Bench’s decision will shape the future of transparency in India. It has several paths it could take.
It could uphold the amendment, accepting that privacy concerns justify a blanket ban on disclosing personal information. This would represent a major shift in the balance between transparency and privacy, privileging the latter at the expense of the former. It would also effectively nullify two decades of progress under the RTI Act.
It could strike down the amendment, restoring the public interest override and reaffirming the RTI Act’s original balance. This would preserve the citizen’s right to know while still protecting legitimate privacy interests through the override mechanism. It would send a strong signal that transparency remains a core constitutional value.
It could articulate a middle path, perhaps defining “personal information” in a way that excludes information about government functioning, or establishing categories of information that can never be withheld regardless of privacy claims. Such an approach would require the Court to do what the Chief Justice suggested: “lay down what is meant by ‘personal information’.”
Whatever path it chooses, the Court must be guided by the constitutional vision of a democratic republic in which citizens are not subjects but sovereigns. In such a republic, the state exists to serve the people, not the other way around. And the people cannot be served if they cannot see what the state is doing.
The information asymmetry between state and citizen must be minimised, not maximised. That is the lesson of two decades of RTI. That is the promise of the Constitution. And that is the standard against which the DPDP amendment must be judged.
Q&A: Unpacking the RTI-DPDP Conflict
Q1: What is the specific amendment being challenged before the Supreme Court?
A: The challenge concerns the amendment to Section 8(1)(j) of the Right to Information (RTI) Act, 2005, effected by Section 44(3) of the Digital Personal Data Protection (DPDP) Act, 2023. Originally, Section 8(1)(j) allowed withholding of personal information only if it had no relationship to public activity or interest, or if disclosure would cause unwarranted privacy invasion. Crucially, it included a “public interest override” permitting disclosure when larger public interest justified it. The DPDP amendment removes this override and creates a blanket ban on disclosing “any information which relates to personal information,” effectively prohibiting requests concerning officials, procurement, audits, and public spending.
Q2: Why does the Internet Freedom Foundation highlight a “legitimate uses paradox”?
A: The paradox arises from asymmetry between state and citizen powers. Section 7 of the DPDP Act allows the state to process personal data without consent for various purposes—the government can monitor citizens and collect their information. However, the RTI amendment prevents citizens from using similar principles to seek transparency from the state. While the government can access citizen data, citizens cannot access government information that may contain personal details, even when public interest justifies disclosure. This creates an information hierarchy where the state sees all, but citizens see little—a deeply undemocratic arrangement.
Q3: How does the amendment create a “chilling effect” on journalism?
A: Under the DPDP Act and its Rules, journalists collecting information for investigative reports could be classified as “data fiduciaries.” Non-compliance can attract fines up to ₹250 crore, creating enormous financial risk for pursuing stories that involve personal information. Since investigative journalism often requires examining documents containing personal details—officials’ assets, decisions, contracts—the threat of massive penalties may deter reporters from pursuing such stories. The result could be journalism reduced to publishing government releases rather than holding power accountable. Notably, the DPDP Act provides exemptions for startups but omits similar protections for journalism.
Q4: How does India’s approach compare with the European Union’s GDPR?
A: The European Union’s General Data Protection Regulation (GDPR) takes a more balanced approach, recognising that privacy and transparency can coexist. The GDPR includes specific exemptions for journalistic purposes, acknowledging that the public’s right to know may sometimes override individual privacy interests. It does not create blanket bans but establishes frameworks where processing personal information is permitted when justified by legitimate purposes. This contrasts sharply with India’s DPDP amendment, which removes balancing mechanisms entirely. The GDPR demonstrates that robust data protection need not come at the expense of democratic transparency.
Q5: What precedent will guide the Constitution Bench’s deliberation?
A: A key precedent is the Supreme Court’s 2019 judgment in Central Public Information Officer v. Supreme Court of India, which held that personal information should remain private unless disclosure is necessary for the larger public interest. This judgment recognised that privacy is not absolute and that transparency may sometimes override it—exactly the principle embodied in the RTI Act’s original public interest override. The Constitution Bench must determine whether the DPDP amendment, by removing this override, can stand consistently with this precedent and with the constitutional scheme of democratic accountability. The Court may also need to define, as the Chief Justice suggested, what “personal information” means in this context.
