The newly enacted Digital Personal Data Protection Act, 2023[1](‘DPDP Act’) has modified the exemption clause (j) of sub-section (1) of Section 8 of the Right to Information Act, 2005 (‘RTI Act’).
While, the erstwhile Section 8(1) (j) of the RTI Act read as under:
(j) information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information:
Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.
The amended clause reads as under:
“(j) information which relates to personal information;”
Thus, the erstwhile Section 8(1) (j), allowed the CPIO and the appellate authority under the RTI Act to disclose personal information if he/she was satisfied that a ‘larger public interest’ exists in disclosing the personal information.
Amendment-from the perspective of CPIO and the appellate authority:
The amended clause, if seen from the perspective of the CPIO and the appellate authority, has become much simpler to implement. The CPIO is no longer required to go into the difficult questions of:
(i) whether the personal information relates to any public activity or interest?
(ii) whether giving of the information would cause unwarranted invasion of the privacy of the individual?
(iii) whether larger public interest justifies the disclosure of such information?
The only issue that is now left to be determined by the CPIO is whether the information is ‘personal’ or not. Even though, the RTI Act does not define the term ‘personal information’, the DPDP Act defines “personal data” as any data about an individual who is identifiable by or in relation to such data[2] and even though, the DPDP Act applies to ‘personal data’ collected in digital form; or (ii) in non-digital form and digitized subsequently[3] and the RTI Act make no such categorization of the ‘form’ of personal information, rather it provides that information can be in any form[4], the CPIO can now, take the help of the definition of personal data in the DPDP Act to determine whether an information is a ‘personal information’ or not. The definition of personal data as provided in the DPDP Act is so broad and wide ranging, that any kind of information/data identifying/relating to an identity of an individual would become non-disclosable.
The enactment of DPDP Act has therefore, simplified the work of the CPIO in dealing with RTI Applications where ‘personal information’ has been sought.
Amendment-from the perspective of the RTI Applicant:
When, seen from the perspective of the RTI Applicant, the pre-amended clause (j) of sub-section (1) of Section 8 of the Right to Information Act, 2005, provided an opportunity to the RTI Applicant to claim that even though the information sought is of a personal nature, since, it is being sought in larger public interest, therefore it should be disclosed by the CPIO.
The Applicant could, therefore, contest the denial of disclosure of personal information by the CPIO on the ground that there is a larger public interest in seeking the personal information and could challenge this denial before the appellate authorities under the RTI Act and if required, could also approach the High Court, which, if persuaded and satisfied that an element of larger public interest is involved, could direct the CPIO to disclose the personal information in the larger public interest.
With the clause being modified, the Applicant now, does not have this additional ground of obtaining personal information from the CPIO in larger public interest. The only ground that is available to him/her now, is to claim that the information sought by him is not of a personal nature, hence CPIO cannot deny. However as discussed above, the definition of personal data in DPDP ACT is so broad and wide ranging, that, any kind of personal information would become non-disclosable.
Probably, the legislature in balancing the two fundamental rights of the right to privacy and the right to information, felt that the right to privacy requires a much stricter implementation and the authorities under the RTI Act should not have any ground whatsoever to disclose an individual’s personal information, that they may have in their custody. That, the personal information should remain personal and private, particularly, when the DPDP Act has been enacted to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto[5].
If, the amendment was not made, then, the provisions of the DPDP Act relating to protecting of personal data could have also got diluted.
[1] Received the President’s assent on 11.8.2023
[2] Section 2(t) of the Digital Personal Data Protection Act, 2023
[3] Section 3(a) of the Digital Personal Data Protection Act, 2023
[4] Section 2(f) of the RTI Act 2005 defines the term of ‘information’ as: “(/) ‘information” means any material in any form, including records, documents, memos, e-rnails, opinions, advices, press releases, circulars, orders, logbooks. contracts, reports, papers, samples, models, data material held in any electronic form and information relating to any private body which can be accessed by a public authority under any other law for the time being in force;
[5] Preamble to the Digital Personal Data Protection Act, 2023