When State Knows Everything
Priyanshi Raj & Bhoomi Shree
9 Sept 2026 10:00 AM IST

There is a particular irony in a data protection statute becoming the instrument that narrows a citizen's access to information about the state. Section 44(3) of the Digital Personal Data Protection Act, 2023 does exactly this. It rewrites Section 8(1)(j) of the Right to Information Act, 2005, and in doing so, it does not merely tweak an exemption clause it removes the balancing exercise that has anchored India's transparency regime for two decades. Three writ petitions currently pending before a Constitution Bench of the Supreme Court ask whether this rewriting is constitutionally permissible. The answer will determine whether India's citizens retain a meaningful right to know, or whether “personal information” becomes the all-purpose curtain behind which governance retreats from scrutiny.
What Section 44(3) Actually Does
Before the amendment, Section 8(1)(j) of the RTI Act exempted personal information from disclosure only where it had no relationship to any public activity or public interest, or where disclosure would cause an unwarranted invasion of privacy. Crucially, even where that threshold was met, the Public Information Officer or the appellate authority still had to ask whether the larger public interest justified disclosure. This was not an abstract nicety. It was the mechanism by which asset declarations of public servants, disciplinary records, subsidy disbursal data, and tender documents were prised out of a reluctant bureaucracy over the RTI Act's twenty-year history.
Section 44(3) deletes the public interest override. Personal information is now exempt, full stop, unless it falls into narrow carve-outs. The effect is not incremental. It converts a proportionality test administered case by case into a categorical bar administered at the point of the request. A Public Information Officer no longer needs to weigh accountability against privacy; she needs only to characterise the information sought as “personal,” a term the DPDP Act itself leaves largely undefined for this purpose. That gap between an undefined trigger and an absolute consequence is precisely where the constitutional trouble begins.
The Litigation and Where It Stands
Three petitions filed by RTI researcher Venkatesh Nayak, by The Reporters Collective Trust, and by the National Campaign for People's Right to Information have challenged the amendment on the ground that it defeats the right to information guaranteed under Article 19(1)(a), and that it does so without the safeguards Article 14 and Article 21 would otherwise demand. On 16 February 2026, a bench led by Chief Justice Surya Kant issued notice and referred the matter to a five-judge Constitution Bench, acknowledging that the case raises complex and constitutionally sensitive questions about how privacy and transparency are to coexist. Significantly, the Bench declined to stay the amendment pending adjudication, which means the blanket exemption has been operative for months while the constitutional question remains open. The Chief Justice's own framing that the Court would need to “iron out creases” and arrive at a workable definition of personal information is telling. It suggests the Court itself does not see the current formulation as a stable resting point, even as it allows that formulation to govern real RTI applications in the interim.
Senior counsel appearing for the petitioners have pointed the Court toward its own five-judge precedent in Central Public Information Officer, Supreme Court of India v. Subhash Chandra Agarwal (2019), where the Court held that the correct approach to Section 8(1)(j) was a structured balancing exercise, not a categorical exclusion. That precedent did not treat privacy and transparency as mutually exclusive; it treated them as competing constitutional values requiring case-specific reconciliation. Section 44(3), on this reading, does not harmonise RTI with post-Puttaswamy privacy jurisprudence so much as it discards the balancing methodology that jurisprudence itself endorsed.
The Government's Defence, and Its Limits
The Union's position is that Section 3 of the DPDP Act preserves RTI disclosures because it exempts information that any law requires to be made public. This argument has a circularity problem: the RTI Act is precisely the law whose disclosure mandate has just been narrowed by Section 44(3). Pointing to Section 3 to reassure petitioners that RTI disclosures survive is of limited comfort when the amendment under challenge is the provision that shrank what the RTI Act requires to be disclosed in the first place. The government's second line of defence that the amendment merely aligns RTI with the constitutional status of privacy assumes that pre-2023 Section 8(1)(j) was somehow indifferent to privacy. It was not. It built privacy protection into the same clause as the public interest override, which is exactly the “harmonious construction” model that expert bodies, from the A.P. Shah Committee in 2012 to the Srikrishna Committee in 2018, had recommended retaining. Neither committee, nor the Joint Parliamentary Committee that examined the 2019 draft data protection bill, proposed severing the public interest test altogether.
Why “Crisis” Is Not Hyperbole
The word crisis is often used loosely in legal commentary, but here it captures something specific: a structural mismatch between where the burden of proof now sits and where the constitutional right actually lives. Article 19(1)(a) has long been read, since State of U.P. v. Raj Narain and reaffirmed in subsequent RTI jurisprudence, to include a citizen's right to know how the state functions. That right does not evaporate merely because Parliament has amended a subordinate exemption clause; it constrains how far that clause can travel. The present amendment tests that constraint by shifting the default from disclosure-unless-private to non-disclosure-unless-otherwise-provided, inverting two decades of statutory architecture through a data protection statute that was never advertised, during its passage, as an RTI amendment.
The institutional fallout is already visible and is not speculative. Public Information Officers, now personally exposed to data protection liability for wrongful disclosure but facing no comparable exposure for wrongful denial, have an obvious incentive to over-withhold. Independent reporting on Central Information Commission appeal data for 2026 suggests a marked rise in rejections citing personal information grounds, consistent with what one would predict from the incentive structure Section 44(3) creates. Journalists investigating the use of public funds now face the additional risk of being characterised as data fiduciaries for the purposes of their own reporting, with the DPDP Act's penalty ceiling running into hundreds of crores a figure calibrated for corporate data breaches, not for a reporter seeking a beneficiary list under a welfare scheme. None of this required a single adverse court ruling. It follows from the ordinary risk calculus of officials and institutions operating under the amended provision as it stands today, unstayed.
A Comparative Aside
India is something of an outlier in refusing to write an explicit transparency carve-out into its data protection statute. Jurisdictions that legislated privacy and freedom-of-information regimes in tandem generally built the interface between the two into the privacy statute itself, rather than leaving it to be inferred later through litigation. The absence of any such carve-out in the DPDP Act is not an oversight; it is the product of a legislative process in which the RTI amendment was folded into a data protection bill and passed with a matter of an hour's debate, without the sustained parliamentary scrutiny that a direct amendment to a transparency statute would ordinarily attract. A crisis produced by that kind of procedural shortcut is not easily cured by judicial interpretation alone, however carefully calibrated; it also calls for Parliament to revisit the amendment through a process that treats the RTI Act's architecture as worthy of amendment on its own terms.
What the Constitution Bench Should Not Avoid
The temptation before a Constitution Bench in a case framed as pitting two fundamental values against each other is to look for language that appears to honour both without disturbing the amendment's structure. That would be a mistake. Subhash Chandra Agarwal already supplies the doctrinal tool the Bench needs: a two-step proportionality inquiry that asks first whether the information genuinely engages a privacy interest, and second, only where it does, whether disclosure is nonetheless justified by the public interest. Restoring that structure into Section 8(1)(j), whether by reading down Section 44(3) or by directing Parliament to reinstate the override, would not require the Court to subordinate privacy to transparency. It would simply require the Court to insist that the government's own precedent, and its own committees' recommendations, be followed rather than legislated around.
Until that happens, the amendment remains in force, and every RTI applicant who is told that information about the exercise of public power is “personal” and therefore off-limits experiences the crisis in real time, one rejected application at a time. That is not a hypothetical constitutional question awaiting a Constitution Bench's leisure. It is an ongoing redistribution of power between citizen and state, occurring under cover of a statute that was sold as protecting the citizen from the state.
Authors are 4th year Law students at CHRIST (Deemed to be University), Delhi NCR Campus. Views are personal.

