All rules under the Data Act (DPDPA), including questions, apprehensions and queries revolving around pre-censorship that curbs freedom of press are taking one back in time to the dark days of Emergency. As things stand, the Centre, the ministry, its officers and staff pose a threat to Article 19(1)(a) in particular, and to the Constitution of India, in general.

New pre-censorship: Blocking news site

A journalist body rights contends “Repeated non-compliance can ultimately attract blocking under the IT Act, read with Section 37 DPDPA (blocking for data-protection reasons). Will MEITY commit to seeking prior judicial authorisation before any news site is disabled?

Secondly, journalists can forget public interest reporting and kill small newsrooms. What is the quantifiable threshold of non-compliances before blocking action is initiated? When deciding penalties, Section 33 directs the Board to consider factors such as the “nature, gravity and duration” of the breach. Given that honest public-interest reporting may involve leaked data, how will proportionality be guaranteed so fines do not have a chilling effect on smaller newsrooms and individuals engaged in journalistic activity?

Third points to killing journalism through two enactments: MEITY obtaining DPDPA’s consent and meeting requirements with statutory privileges under the Press and Registration of Periodicals Act and the Working Journalists (Conditions of Service) Act remain a source for debate.

The fourth point is about getting attacked in the name of the Information Technology Act. Given that the Central Government has been empowered to block information/content under Section 69A of the IT Act, what is the purpose behind including Section 37(1)(b) that creates another parallel blocking regime that further empowers the Central Government to issue blocking directions under the DPDPA framework?

Scribes cannot pay heavy penalty:

Every rule is dangerous due to the penalty clause. The society should realise that a real threat is from the proposed penalty clause of Rs 250 crore, which can go up to Rs 500 crore against an individual or entity if the DPDP Board appointed by the government deems fit. This effectively can close the gates of information, journalism and freedom of speech and expression. In short, it will kill a significant part of the Constitution.

Child ‘Data Act’:

There is a ‘child data’ law, though adults suffer. Implementation of the ‘child data’ law can be draconian. Generally, rules under a statute (an Act) should not create substantive legal problems. They are expected to help ease the difficulties in understanding and implementation of the law.

But then, Draft Rule 10(1) forces outlets to obtain age-verified parental consent before processing a child’s data. How should people involved in journalistic activity or media organisations cover issues affecting minors in real-time without breaching this rule?

Revealing sources:

Media has always debated about protecting resources of reporting. It is not just an ethical question but a serious criminal point. The flashpoint is in ‘revealing sources’ and it gives sweeping powers to the Union Government. Journalist bodies and activists fear that clauses granting the government broad powers could be misused to unmask confidential sources. Besides pre-censorship, together with ‘compelling the resource of reporting the news’ will be more draconian than the ‘1975 Emergency’ phase.

Since ages ‘revealing sources’ were protected as ethical and legal principles in democracies. Exceptions can only be in some compelling legal situations. Journalists’ sources are revealed when their identities are exposed, either through their own voluntary disclosure or by being forced by legal authorities, which can happen in court if the information pertains to a crime or other legal proceedings. Sources are revealed when legal protections are absent, or when a journalist cannot or will not use legal or technological methods to keep them anonymous. Source protection is vital, as without it, people would be deterred from sharing public interest information with journalists.

Members from the Press Club of India (PCI) and the Indian Women Press Corps (IWPC) have raised worries over the consequences of the Digital Personal Data Privacy (DPDP) Act. 2023, and the rules thereof. The Ministry of Electronics and Information Technology (MeiTy) is yet to reply to media representations and the serious apprehensions. This is how threats to journalism emanate from the Data Act. The press bodies’ pointed out: Clause (c) of sub-section (7) under Section 28 and Section 36 give the Data Protection Board and the Central Government sweeping powers to call for “any data, book, document, register, and book of account or any other document.”

Now, investigative journalism largely relies on “source-based information” or leads provided by whistleblowers. Given the wide range of powers that have been vested in the Data Protection Board, it can very well demand a person involved in journalistic activity or media organisation to reveal the “source”.

In that case, what are the protections available to a person involved in journalistic activity and media organisations from revealing a “source” under the Act?

No editorial independence?

Draft Rule 6(g) demands “appropriate technical and organisational measures to ensure effective observance of security safeguards” and can be enforced by the Board. What limits will be set so that inspections do not morph into newsroom searches, jeopardising editorial independence remains unknown?

Whistle-blower and a bleak future!

Draft Rule 7 obliges a data fiduciary to alert every affected person after a leak. If a whistle-blower leaks wrongdoing inside a company, PSU, government department, etc., must the person involved in journalistic activity or the newsroom notify the very officials under investigation, thereby exposing its source?

Consent management:

The draft rules allow the Board to suspend or cancel a consent manager’s registration and compel information disclosure. If a media-run consent tool is de-registered, is there an appeal platform, and how will the ongoing subscriptions be maintained?

Draft Rule 6 requires encryption, extensive logging and one-year log retention. What financial or technical assistance will be offered to small, independent outlets that cannot afford enterprise-grade infrastructure?

Section 7(b) allows data processing by the state to provide state benefits. Rule 5 explicitly lets the State reuse personal data to deliver subsidies without consent, subject only to minimal standards. What safeguards will prevent such “lawful” data-sharing from being repurposed to identify or retaliate against critical journalists?

Why is it only in India?

“Worldwide, such laws exempt journalists, and our endeavour is also to ensure that this Act also exempts the professional work of journalists. We are hoping to seek an appointment with the minister concerned for a meeting at the earliest to take forward the joint decisions taken at the open meeting on the matter,” stated Gautam Lahiri, president of PCI, on X. The Press Club of India and 21 media organisations have submitted a joint memorandum to Union Minister Ashwini Vaishnaw, urging the exclusion of journalistic work from the Digital Personal Data Protection (DPDP) Act. In addition, the civil society should study the detailed press notes of PCI and IWPC, which seek the Ministry of Electronics and Information Technology (MeiTy) to address the serious problems stemming from the DPDP Act.

(The writer is a ormer Central Information Commissioner, and presently Professor, School of Law, Mahindra University, Hyderabad)