Data PrivacyImpact of the Digital Personal Data Protection Act, 2023 on Journalism and the News Industry at Large

INTRODUCTION

“Freedom of the press is a precious privilege that no country can forego” – Mahatma Gandhi.

The Editor’s Guild of India (“EGI”) vide a representation dated February 16, 2024, to the  Ministry for Electronics and Information Technology, put forward their opinion that the provisions of the Digital Personal Data Protection Act, 2023 (“DPDPA”) threaten the effective existence of journalism activities in India.

The main concern underlined in the EGI’s representation is regarding the fact that the DPDPA provisions mandate informed and rescindable consent prior to the processing of personal data. The exceptions to the pre-requisite are covered under Section 7 of the DPDPA titled “certain legitimate uses”. These narrow and specific exceptions allow unconsented processing for Government or research purposes, however one crucial exception which has been left out is Journalistic activities.

A committee report titled, “A free and fair Digital Economy: Protecting Privacy Empowering Indians” published by the committee of reports under the chairmanship of Justice B.N. Srikrishna noted in its report that the mandatory consent for processing of personal data for journalistic or press purposes would be highly unfavorable as the data principal could out-rightly refuse to provide consent pursuant to which, the fundamental role of the press in ensuring transparency would be severed.

In this article, we look into the reasoning behind the representation and study the provisions of the DPDPA and international privacy laws vis-à-vis journalistic requirements.

STATUS QUO OF ‘LEGITIMATE USES’ UNDER DPDPA

As per Section 7 of the DPDPA, a Data Fiduciary may process personal data only wherein the Data Principal has voluntarily given her consent to the Data Fiduciary for the specified purpose and she has not indicated in any manner that she does not consent for her data to be used for the specified purposes.

 The other exceptions for data processing under Section 7 includes data processing for start or any of its instrumentalities, for fulfilling of obligation under any law for the time being in force or for compliance of any judgment or decree or order, for responding to a medical emergency or for taking measures to provide medical treatment or health services, for taking measures to ensure safety during a disaster, for prevention of corporate espionage, maintenance of confidentiality of trade secrets etc.

At present only a limited number of activities such as conducting interviews and response collection vide questionnaires etc. are covered under the purview of Section 7(a) of the DPDPA . However, other essential practices of data extraction for the means of journalism, such as, investigative stints, general news reporting, opinion pieces, and analysis largely rely upon private independent research projects and investigative stints which, as the DPDPA stands now, have become impossible or illegal.

IMPORTANCE OF DATA PROCESSING IN JOURNALISM

Although DPDPA does not directly address journalism or related activities, it aims to govern the underlying processing i.e., collection, storage and usage of personal data which is pretty much the core of data journalism and has substantial presence in every instance of journalism.

Data processing with respect to journalism means transforming cold, hard data into compelling narratives and sewing them into stories to engage, inform and provoke thought. Journalists use data just not for the sole reason of analyzing or visualizing it, rather they compile large and seemingly unrelated data sets to flush out the narratives or intentions which are not disclosed in public.

This is essential to hold powerful people and corporations accountable which eventually acts as a remedy for information asymmetry and helps in providing independent interpretations of official information.

The expert committee constituted to draft the Data Protection Bill, 2018 (“2018 Bill”), i.e., the Srikrishna Committee, exempted data processing for journalistic purposes or complying with the provisions of the 2018 Bill in the view of greater public interest except for the processing of data in a fair and reasonable manner which respects the privacy of the data principal.

The applicability of DPDPA provisions shall classify journalists and news organizations as Data Fiduciaries and cast over them a plethora of obligations such as providing notice to process data wherever the processing is based on consent and mandatorily obtaining consent from the Data Principal. Further, the consent so obtained shall only be used for the specified purpose meaning those who opt out of journalistic research/investigation cannot be scrutinized. Such obligations have put an embargo on the concept of journalistic or press freedom.

The DPDPA, by virtue of Section 36, empowers the Central Government to extract from any Data Fiduciary to furnish any information that it may seek. Journalism works on connections and trust, trading of sensitive information is based solely on the condition of anonymity. Journalists and news organisations required to mandatorily comply with the provisions related to data processing which will pose to be a great threat to the anonymity that might push away informants, tips, and double agency, and thus stifling the industry of insights.

GENERAL DATA PROTECTION REGULATION ON PROCESSING OF DATA FOR JOURNALISTIC PURPOSES

Article 85 of the General Data Protection Regulations (“GDPR”) provides for processing and freedom of expression and information, which states that the member states shall, by law, reconcile the right to the protection of personal data with the right to freedom of expression and information including the processing of journalistic purposes.

The Article aims to dial down the tussle between freedom of expression and the right to data protection and targeted to codify the general need to balance between these two fundamental rights.

It provides a broad framework to tighten or loosen the scope of journalistic exemption and circumstances on which it applies by allowing the member states to provide for exemptions or derogations from a certain class of provisions (relating to for instance, having a lawful reason for using data, providing privacy information and comply with individual rights people have about their data) of the GDPR for the sole of purpose of journalism and freedom of expression.

Similarly, Singapore’s Personal Data Protection Act, 2012 provides for an exception for news organizations to collect, store, process and disclose data without needing consent for the purpose of conducting its reporting and journalism activities.

AMLEGALS REMARKS

The absence of the exception allowing data processing for journalism activities in the DPDPA, raises a lot of questions in the context of journalism. While the DPDPA aims to protect individual data privacy, unfortunately it fails to address the requirements of journalistic data processing.

DPDPA’s broad obligations on consent, limited data processing and individual rights can clearly act as a hurdle for journalistic activities. Journalism, considered the fourth pillar of democracy, needs a separate consideration under the DPDPA considering that the lifeblood of any news reporting is data.

The expansion of the purview of Section 7 of the DPDPA should include investigative journalism, general news operating, opinion pieces and analysis in the list of legitimate uses even with the application of reasonable restrictions which could grant the press their much-needed freedom.

– Team AMLEGALS assisted by Ms. Dhwani Tandon

For any queries or feedback feel free to reach out to mridusha.guha@amlegals.com or jason.james@amlegals.com