The Editors Guild of India (EGI) has voiced serious concerns about the potential ramifications of the Digital Personal Data Protection Act, 2023 (DPDPA) on the freedom of the press and journalistic activities in the country.
In a letter to the Union Minister for Electronics and Information Technology, Ashwini Vaishnaw, the body has urged the ministry that processing for journalistic purposes is excepted from the application of DPDPA.
“Indeed the tools for doing so are built into the DPDPA itself. Under section 17(5) of the DPDPA, the Government may, before the expiry of five years from the date of commencement of the DPDPA, by notification, declare that any provision of this DPDPA will not apply to any data fiduciary or classes of data fiduciaries for a period specified in the notification,” the letter pointed out.
The guild said an exemption may be necessary to stop harassment of journalists by inundating them with requests with a view of blocking or slowing down the investigation or publishing of a piece of news. The financial and human resource implications of compliance with such requests will also frustrate journalistic activity, especially in the case of independent journalists.
“We request that the Ministry provide a class exemption to data fiduciaries undertaking processing for journalistic purposes under section 17(5) of the DDPA for as long as such purposes subsist,” the letter said.
Such an exemption is particularly justified given that the absence of such a carve-out will have a necessarily adverse impact on the right to freedom of speech and expression, and the right of journalists to carry on their occupation.
The body also highlighted their concerns in detail in their submission.
The concerns are as follows-
1. The enactment of the Digital Personal Data Protection Act, 2023 inadvertently endangers the freedom of the press.
1.1 The DPDPA, while a laudable initiative towards protecting the personal data of individuals, if applied indiscriminately to the processing of personal data in a journalistic context, will bring journalism in the country to a standstill. This will have a long-standing impact on the freedom of the press, and the dissemination of information not just in reporting in print, TV, and the internet, but also the mere issuance of press releases by all parties including political parties.
1.2 The continued existence of the press-the fourth pillar of democracy-enabled the dissemination of news, thoughts and opinions and ensures a free and fair democracy. It informs public opinion, promotes civic engagement, and empowers individuals to make informed decisions including political choices. Its centrality is recognised by the Constitution of India (Constitution), which only permits reasonable restrictions on the exercise of the right to freedom of speech and expression.
1.3 While the DPDPA does not address journalists or their activities, it regulates the underlying processing (e.g., collection, use, storage) of personal data that is inevitable in almost every instance of journalism. The DPDPA requires individuals or entities that determine the purpose and means of processing such personal data outside a personal or domestic context, i.e., data fiduciaries, to meet various requirements (e.g., provision of notice and obtaining consent, erasure, etc.). These requirements are undeniably onerous in the context of processing for journalistic purposes. Given the nature of the profession and the implications for fundamental rights involved, processing personal data for journalistic purposes is an ideal case and must be an exemption from the provisions of the DPDPA.
2. Specific challenges arising from the application of DPDPA to journalistic activities
2.1Consent (necessary under the DPDPA) may be withheld and may lead to selective dissemination of information
2.1.1 The DPDPA requires all processing of personal data to proceed on the basis of either consent or certain legitimate uses (e.g., for employment purposes or in the case of a medical emergency) under Section 7 of the DPDPA, which is narrow and specific in nature.
Processing personal data for journalistic activities will invariably fall outside these narrow buckets. While certain journalistic activities involving interviews, collecting responses to questionnaires, etc., may be covered under Section 7(a) of the DPDPA, which recognises voluntary provision of personal data by the data principal, most other forms of journalism, such as investigative journalism, general news reporting, opinion pieces, analyses, etc., are still largely dependent on private research and investigative study by journalists, which is remarkably absent in the current list of legitimate uses.
2.1.2 Given this, journalists will invariably have to rely upon consent to process any personal data in the course of their journalistic activities. Indeed, the onerous nature of this requirement was critiqued in the Report published by the Committee of Experts under the Chairmanship of Justice B.N. Srikrishna (Srikrishna Committee) titled ‘A Free and Fair Digital Economy:Protecting Privacy, Empowering Indians’ (Srikrishna Committee Report)/ The Committee, which prepared the Personal Data Protection Bill, 2018, noted that mandating consent for processing such personal data would be unfavourable, as the data principal could simply refuse to consent forestalling all such publishing. The fundamental role of the press and its ability to ensure transparency and accountability would thus be severely undermined by the data principal’s ability to simply refuse consent to the processing of their data.
2.2 The infeasibility and impracticality of requiring journalists to adhere to other obligations under the DPDPA
2.2.1 As journalists and media organisations will likely be considered data fiduciaries under the
DDPA, they will be required to adhere to its provisions, including obligations to:
Provide notice where processing is based on consent and obtain consent: Journalists and media organisations would consequently have to notify data principals of the proposed processing prior to or at the time of requesting consent. As indicated above, purpose specification (a necessary component of such a notice), particularly at a nascent stage in a journalistic context is infeasible, and may (in the case of investigative journalism) even defeat the purpose of undertaking such processing. Obtaining consent (including obtaining verifiable consent from the parent or lawful guardian of a child or a person with a disability) presents similar problems. For instance, when a journalist is investigating the parties involved in a fraudulent / Ponzi scheme, reporting on road accidents in a particular city, or publishing information about the achievement of an individual who is a resident of another city, the requirement to provide notice and obtain consent would not only be impractical or infeasible but will likely defeat the purpose of the journalistic endeavour, by causing inordinate delay or impeding the journalist from publishing the news report itself.
(b) Requirement to process information only for specified purposes: The standards of specificity required for processing personal data should not apply to journalistic activities, which are often exploratory in nature. Often, uncovers new leads or directions through such research and processing of personal information. It would be impractical for a journalist to specify in exact terms the purposes for which the personal data is being collected at such a nascent stage, and unreasonably restrain journalists from fulfilling their professional activities. While the DPDPA contemplates an exemption for processing personal data for research purposes, this exemption is (i) open-ended and subject to standards that are yet to be prescribed; (ii) only available where the personal data is not used to ‘take a decision specific to the Data Principal’, a phrase that is not defined in the DPDPA and will likely encompass the decision to publish an article or news report about or involving a data principal. Accordingly, this exemption is unlikely to be available for processing personal data for journalistic purposes.
(c) Enable withdrawal of consent to continued processing and erasure upon request:
The DPDPA mandates deletion of personal data where a data principal withdraws consent unless the retention is necessary for compliance with any other law. ‘ Imposing this obligation on journalists would have wide-reaching implications, requiring them to even delete notes containing personal data. In the absence of a requirement to retain this personal data, journalists will be left with no option but to cease processing (which includes storage) and ultimately erase such personal data, making post-facto validation of a news report or article impossible.
(d) Power of Central Government to call for any information: Section 36 of the DPDPA
empowers the Central Government to require the Board and any data fiduciary or intermediary to furnish any information that it may seek. Preserving the confidentiality of sources is integral to investigative journalism, as journalists often rely on such informants for sensitive information. Journalists acting as data fiduciaries are not exempted from this provision. This will likely deter potential informants from coming forward with necessary information for fear of their anonymity being compromised, thereby having a deliberating impact on journalism at large (We can drop this also)
2.2.2 The requirements under the DPDA when applied to journalists are unduly erroneous, impractical, and infeasible for journalists, in light of the distinct practices involved in journalism when compared to other professions.
3. Exemptions under previous iterations of the data protection law
3.1 Save for the draft Digital Personal Data Protection Bill, 2022, all prior iterations of India’s data protection law – The Personal Data Protection Bill, 2018, the Personal Data Protection Bill, 2019, and the Data Protection Bill, 2021 – specifically exempted processing for journalistic purposes from complying with most of the corresponding provisions in those drafts, including the obligation to provide notice and obtain consent.
3.2 The Srikrishna Committee Report that accompanied the 2018 Bill, too, recognised that exempting journalistic activity from compliance with the 2018 Bill was necessary for greater public interest. Accordingly, the Personal Data Protection Bill, 2018 (2018 Bill), prepared by the Srikrishna Committee, exempted processing for a ‘journalistic purpose’ from complying with all provisions of the 2018 Bill, except for the duty to process personal data in a fair and reasonable manner that respects the privacy of the data principal, and the obligation to implement reasonable security safeguards. The 2018 Bill defined ‘journalistic purpose’ as any activity intended towards the dissemination through print, electronic, or any other media of factual reports, analysis, opinions, views, or documentaries regarding:
(i) news, recent or current events; or
(ii) any other information that the data fiduciary believes the public, or any significantly discernible class of the public, to have an interest in, which would be absolved from obtaining consent from data principals.
3.3 The Personal Data Protection Bill, 2019 (introduced in the Parliament) and the Data Protection Bill, 2021 (prepared by the Joint Parliamentary Committee on data protection), contained similar provisions to exempt processing for journalistic purposes. This position is notably consistent with other jurisdictions with data protection regimes that provide for exemptions from processing for journalistic purposes. For instance, the European Union’s General Data Protection Regulation (GDPR) enables Member States to provide for exemptions or derogations from certain provisions (e.g., have a lawful reason or basis for using data, provide privacy information, comply with individual rights that people have about their data, etc.) of the GDPR for journalistic purposes and freedom of expression.” Similarly, Singapore’s Personal Data Protection Act, 2012 provides an exception for news organizations to collect, use, and disclose personal data without consent solely for its news activity.
3.4 Despite this, processing for journalistic purposes is not exempt from the obligations under the DDPA. It may be possible to argue that Section 17(1)(c) of the DPDPA, which permits processing in the interest of prevention, detection, investigation, or prosecution of any offence or contravention of any law, would exempt processing for a specific kind of journalism: investigative journalism. However, the lack of a broad exemption that applies to all journalistic activity (as envisaged under prior iterations of this law and international statutory frameworks) and the absence of any clear guidance for this exemption severely hampers the ability of journalists to investigate, report, and publish any articles or reports of journalistic import. It is, therefore, crucial that an exemption be made available to cover processing related to journalistic purposes.
4. Unfortunately, India will be the sole modern democracy without an exemption for journalistic activities, which could severely impair the fourth pillar of democracy. Moreover, India is currently ranked 161 out of 180 countries in the World Press Freedom Index maintained by Reporters Without Borders below other Asian countries like Pakistan, Afghanistan, Sri Lanka, and Cambodia, and risks falling further down in the ranking if the DPDPA is enacted in its present form.
5. Implications of the DPDPA on fundamental rights under the Constitution of India
(Constitution)
5.1 The paramount legal obstacle posed by the DPDPA is to the fundamental freedoms of journalists, particularly to their freedom of occupation, as well as every citizen’s right to access information under Articles 19(1)(g) and 19(1)(a), respectively, of the Constitution.
5.2 Violation of Article 19(1)(g) of the Constitution
Article 19(1)(g) of the Constitution protects the right to practise any profession or carry on any occupation, trade, or business. Journalists invariably handle personal data in the course of carrying out their occupation, be it through conducting research, investigating a lead, or publishing articles based on such personal data on a daily basis. These activities that lie at the heart of the occupation are unreasonably restricted by the DPDPA, which imposes obligations upon them that are often impractical or infeasible or negate the very journalistic activity sought to be achieved through undertaking such processing, making the requirements under the DPDPA violative of every Article 19(1)(g).
5.3 Violation of Article 19(1)(a) of the Constitution
India has recognised the right to receive information as a derivative of the fundamental right of freedom of speech and expression guaranteed under Article 19(1)(a) of the Constitution.’ The exercise of these rights in the context of journalism involves: i) every journalist’s right to freedom and expression, including their right to receive information; and (ii) every citizen’s right to acquire information. Access to information is essential in a democratic nation, empowering citizens with critical information, and enabling them to consequently make informed choices. These rights are rendered meaningless if journalists are effectively forestalled from processing personal data without first complying with impractical and to express their views.
5.3.1. The press in India serves as a crucial bridge connecting citizens with information, ensuring transparency and accountability in governance as a watchdog of society. If journalists are required to adhere to the various prerequisites to processing personal data under the DPDPA, it would inevitably disrupt journalistic reporting in the country due to the highly onerous and, in some cases impossible, obligations this would entail. Such an impediment to journalistic reporting will necessarily violate journalists’ and other citizens’ right to information under Article 19(1)(a) of the Constitution.
5.3.2. The Srikrishna Committee Report also recognised these consequences in noting that the untrammelled dissemination of news, current affairs, and documentaries, especially when they inform, criticise, and analyse issues of public importance, is in the public interest.
6. Existing frameworks that govern journalists provide sufficient safeguards, and processing for journalistic purposes should necessarily be exempted from complying with the provisions of the DPDPA
6.1 The protection of personal data in the course of journalistic activities is built into journalistic conduct, such as those issued by the Press Council of India (PCI), established under the Press Council Act, 1978, Code of Ethics and Broadcasting Standards released by the News Broadcasters and Digital Association.
6.2 Notably, the PCI prescribes safeguards in the context of communalism in the press and cautions against defamatory writings and objectionable investigative reporting, obscenity, and vulgarity in, for example, news stories, or feature reports. Journalists are barred from (i) intruding upon or invading the privacy of an individual unless outweighed by the genuine overriding public interest; ii) tape-recording a conversation without that person’s knowledge or consent, except where the recording is necessary to protect the journalist in a legal action, or for other compelling good reason. Journalists are also required to (i) obtain the prior consent of a minor’s parent, if “public interest” overrides the minor’s right to privacy; (iii) to apply due care by not disclosing the real names of persons involved in incidents affecting personal lives; and (iv) refrain from publishing inaccurate, baseless, graceless, misleading or distorted material.
6.3 Given that these codes of conduct, which apply to all journalists, achieve a balance between freedom of expression and the right to privacy applying a second framework to the same processing activities, concerning the same personal data will only create duplicate compliance requirements, impose an unwarranted burden on journalists, and more importantly, impair free speech and expression. This is particularly true since these applicable codes of conduct for journalism provide a more tailored compliance regime in balancing the competing rights at hand.