On 18th Feb, the Editors Guild of India (EGI) submitted a written representation to the Ministry of Electronics & Information Technology (MeitY) pointing out how the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) threaten the very existence of journalistic activities in India.
The detailed representation explains how this law, including the provisions on consent-related requirements and obligations for data fiduciaries, which was supposedly implemented to protect data privacy, are becoming a roadblock to journalistic endeavours.
The detailed representation explains how this law, including the provisions on consent-related requirements and obligations for data fiduciaries, which was supposedly implemented to protect data privacy, are becoming a roadblock to journalistic endeavours.
The representation makes it clear that although the DPDPA does not directly target journalists or their activities, it does restrict the processing of personal data, such as its collection, use, and storage that is implicit in nearly all journalism-related activities.
Before we delve into the necessity of regulatory exemption for journalists under the DPDPA, first let’s understand what does this law mean for the media?
What does the Digital Personal Data Protection Act mean for the media?
To give a brief context, the Indian Parliament passed the DPDP Act in August 2023. DPDP Act is the first cross-sectoral law on personal data protection in India and has been enacted after more than half a decade of deliberations. The 2023 act is the second and fourth iterations of the bill that have been submitted in Parliament. In 2018, a committee of specialists created a draft version that was released for public comment. The government’s draft law, which was presented in Parliament in 2019, came next.
However, the government retracted this law and released a new draft, the Digital Personal Data Protection law, for public comment in November 2022. This proposal forms a major portion of the basis for the 2023 law.
Prior to these four versions, the Indian Supreme Court rendered a historic decision in Justice K.S. Puttaswamy and Anr. v. Union of India in 2017. The ruling said that the right to privacy is an integral part of the fundamental right to life in India, which includes the right to informational privacy.
As per the DPDPA, collecting a person’s or data principal’s personal data requires their consent, unless there are specific exemptions as provided by the law, like for employment purposes, medical emergencies, or certain government-related services.
As per the DPDPA, collecting a person’s or data principal’s personal data requires their consent, unless there are specific exemptions as provided by the law, like for employment purposes, medical emergencies, or certain government-related services. These legitimate use cases, specified under Section 7 of the Act, does not cover processing personal data for journalistic activities.
Journalists may utilise data that the data principals willingly submit under Section 7(a) in situations like questionnaire replies and interviews. However, journalists rely heavily on private research, study, investigation, etc. for other types of journalism that involve critical investigative stories, general news reporting, opinion pieces, features, analysis, etc. These types of journalism are ‘remarkably absent in the current list of legitimate uses,’ according to the Guild.
Further, the requirement also means that journalists have to invariably rely upon consent to carry out their operations.
The DPDPA lists out specific obligations for data fiduciaries, such as providing notice for consent to the individual, enabling withdrawal of consent, and processing personal data only for specific purposes for which consent is obtained, among others.
According to the EGI, notifying data principals about the purpose of processing prior to or at the time of seeking consent is not feasible for journalists or media organisations.
According to the EGI, notifying data principals about the purpose of processing prior to or at the time of seeking consent is not feasible for journalists or media organisations. In the case of investigative reporting, the Guild noted, this may even defeat the purpose of undertaking such processing.
Hence, the Guild requested MeitY to ensure that processing of personal data for journalistic purposes is exempted from the application of the DPDPA.
Unpacking the need for journalistic exemption under DPDPA
‘Obtaining consent (including obtaining verifiable consent from the parent or lawful guardian of a child or a person with a disability) presents similar problems. For instance, when a journalist is investigating the parties involved in a fraudulent/Ponzi scheme, reporting on road accidents in a particular city, or publishing information about the achievement of an individual who is a resident of another city, the requirement to provide notice and obtain consent would not only be impractical or infeasible but will likely defeat the purpose of the journalistic endeavour, by causing inordinate delay or impeding the journalist from publishing the news report itself.’
Similarly, requiring journalists to process information only for specified purposes is a challenge that may obstruct research and activities that may uncover new leads or information. The Guild noted that it would be ‘impractical’ for journalists to specify ‘in exact terms’ the purposes for which the personal data is being collected at a nascent stage and ‘unreasonably restrain journalists from fulfilling their professional activities’.
Outlining specific provisions from previous iterations of the data protection bill that exempted journalists from certain obligations, the Guild called for an exemption under Section 17(5) of the DPDPA.
‘An exemption may be necessary to stop the harassment of journalists by inundating them with requests with the aim of blocking or slowing down the investigation or publishing of a piece of news. The financial and human resource implications of compliance with such requests will also frustrate journalistic activity, especially in the case of independent journalists,’ the letter noted.
The Srikrishna Committee Report that accompanied the 2018 Bill, too, recognised that exempting journalistic activity from compliance with the 2018 Bill was necessary for greater public interest. Accordingly, the Personal Data Protection Bill, 2018 exempted processing for a ‘journalistic purpose’. The 2018 Bill categorically defined ‘journalistic purpose’ as any activity intended towards the dissemination through print, electronic, or any other media of factual reports, analysis, opinions, views, or documentaries regarding: news, recent or current events; or any other information that the data fiduciary believes the public, or any significantly discernible class of the public, to have an interest in, which would be absolved from obtaining consent from data principals.
The Personal Data Protection Bill, 2019 and the Data Protection Bill, 2021, contained similar provisions to exempt processing for journalistic purposes.
The Personal Data Protection Bill, 2019 and the Data Protection Bill, 2021, contained similar provisions to exempt processing for journalistic purposes.
This position is notably consistent with other jurisdictions with data protection regimes that provide for exemptions from processing for journalistic purposes. For instance, the European Union’s General Data Protection Regulation (GDPR) enables Member States to provide for exemptions or derogations from certain provisions of the GDPR for journalistic purposes and freedom of expression.
In the same suit, Singapore’s Personal Data Protection Act, 2012 provides an exception for news organisations to collect, use, and disclose personal data without consent solely for its news activity to collect, use, and disclose personal data without consent solely for its news activity.
Despite this, processing for journalistic purposes is not exempt from the obligations under the DPDPA.
The balancing act
The Guild noted that journalistic codes of conduct are outlined in the Press Council of India (PCI), which was founded under the Press Council Act, 1978, and the Code of Ethics and Broadcasting Standards published by the News Broadcasters and Digital Association. These sources offer adequate protections for processing personal data for journalistic purposes.
The Guild emphasised, for instance, that the PCI forbids journalists from violating an individual’s privacy unless it is required for a ‘overriding public interest,’ from taping conversations without the subject’s consent, from getting consent from parents when a minor is involved, and from publishing false information, among other restrictions that have exceptions pertaining to the public interest.
The letter stated that having a second framework for the same processing activities will impose additional compliance burdens on journalists and hinder free speech and expression.
In this context, the notion of public interest is particularly relevant. Certain elements must undoubtedly be included in the concept of the public interest. An element of proportionality is required; it cannot be in the public interest to interfere with an individual’s fundamental rights to privacy and data protection in a disproportionate or thoughtless manner.
If the method of investigation or the details to be published are particularly intrusive or damaging to an individual, a stronger and more case-specific public interest argument will be required to justify that, over and above the general public interest in freedom of expression. Indeed, public interest cannot be reduced to the public’s thirst for information about the private life of others or to the reader’s wish for sensationalism or even voyeurism, as was the case of publishing details of the sexual activities of a public figure.
If the sole aim of an article is to satisfy the curiosity of the readership regarding details of a person’s private life, it cannot be deemed to contribute to any debate of general interest to society. If a media organisation processes personal data for other reasons, such as targeted advertising for commercial purposes, the DPDPA should fully apply.
