The Evolution of Personal Information Disclosure Framework The Digital Personal Data Protection Act (DPDP Act) of 2023 has introduced significant modifications to the disclosure of personal information under India's Right to Information (RTI) Act, fundamentally altering the transparency framework that has existed since 2005. This legislative change represents a critical shift in balancing the right to information with privacy concerns, affecting the accessibility of government-held data that contains personal elements. The amendment specifically targets Section 8(1)(j) of the RTI Act, which previously contained nuanced provisions for handling personal information requests while preserving public interest considerations. These changes have substantive implications for citizens seeking information, public information officers implementing the law, and the broader democratic accountability framework in India.

The original Section 8(1)(j) of the RTI Act included a carefully calibrated approach to personal information. It exempted from disclosure “information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information”. Additionally, it contained a crucial proviso stating that “information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person”. This formulation created a balanced framework that protected privacy while allowing disclosure in cases of overriding public interest.

The DPDP Act has fundamentally transformed this provision, replacing the entire clause with a succinct exemption: “information which relates to personal information”. This amendment eliminates two critical safeguards from the original provision. First, it removes the “public interest override” that allowed disclosure of personal information when justified by larger public interest considerations. Second, it eliminates the proviso ensuring citizens could access information available to Parliament or State Legislature. The simplification of the clause creates what privacy experts and RTI activists describe as a blanket exemption for all information with personal elements, regardless of its connection to public activities or interests.

The implementation of this amendment was formalized when Parliament passed the DPDP Bill in August 2023, with Section 44(3) specifically amending the RTI Act's personal information exemption clause. This legislative action followed several years of debate about the appropriate intersection between data protection and information access rights. The Justice A P Shah Committee had specifically recommended against using data protection laws to exempt personal information accessible under the RTI Act back in 2012. Similarly, in 2018, the Justice Srikrishna Committee had recommended only limited amendments to prevent disclosure that would cause grave harm, such as bodily harm, loss of property or reputation, identity theft, or discriminatory treatment. However, the final amendment went considerably further than these expert recommendations.

From the perspective of Central Public Information Officers (CPIOs) and appellate authorities, the amendment significantly simplifies their decision-making process. Under the previous framework, CPIOs needed to evaluate three critical aspects when handling requests for information containing personal details: whether the information related to public activity or interest, whether disclosure would cause unwarranted privacy invasion, and whether larger public interest justified disclosure despite privacy concerns. The amended provision eliminates this nuanced assessment, allowing information officers to deny any request involving personal information without further consideration of contextual factors.

For RTI applicants, the amendment represents a substantial narrowing of access rights. Previously, applicants could contest the denial of personal information by demonstrating larger public interest in disclosure, and could pursue this argument through appeals to higher authorities including High Courts. The removal of the public interest override eliminates this avenue for seeking important information that may have personal components but significant public implications. Citizens have effectively lost the right to access the same information that Parliament or State legislatures can access, creating an unprecedented information asymmetry between governmental bodies and the citizens they serve.

The amendment introduces considerable tension between two fundamental constitutional rights in India: the right to information (derived from Article 19(1)) and the right to privacy (recognized under Article 21 in the Justice K.S. Puttaswamy judgment). While both rights deserve protection, critics argue that the current amendment fails to strike an appropriate balance, instead prioritizing privacy to the significant detriment of transparency. The RTI Act has been widely recognized as one of India's most empowering democratic legislations, helping citizens hold public officials accountable and access information critical to protecting their constitutional rights. The blanket exemption for personal information threatens to undermine this function.

Additionally concerning is how the definition of terms in the DPDP Act may further restrict information access. The Act's definition of “person” extends beyond individuals to include entities like corporations, Hindu Undivided Families, and even the State itself. When combined with the amended RTI exemption, this expansive definition could potentially allow authorities to withhold information about public officials, government contractors, or corporate entities under the guise of protecting “personal information”. This represents a significant departure from the original intent of the RTI Act, which was designed to enhance governmental accountability and transparency.

The impact of these changes is already materializing in practice. According to critics, this amendment could convert the RTI from a “Right to Information” into a “Right to denial of information”. Public authorities may increasingly refuse to disclose information related to potential corruption or maladministration by classifying it as personal information. The amendment is particularly concerning because it applies to the entire spectrum of personal information without any qualifying conditions, unlike the previous version which required considering whether the information related to public activities or whether disclosure served the public interest.

Privacy experts and RTI activists have raised significant concerns about the amendment, describing it as “neither the right to privacy nor the right to information”. The removal of the public interest override is particularly troubling, as it eliminates a crucial mechanism for balancing competing rights. Many argue that the amendment goes well beyond what is necessary to protect legitimate privacy interests while significantly undermining transparency rights.

The timing and manner of the amendment have also drawn criticism. Rather than addressing any identified issues with the RTI Act directly through amendments debated on their own merits, the changes were implemented through a separate data protection legislation. This approach limited focused debate on the implications for transparency and accountability. Furthermore, the amendment diverged from recommendations provided by multiple expert committees that had studied the intersection of privacy and transparency rights.

The amendment to Section 8(1)(j) of the RTI Act through the Digital Personal Data Protection Act represents a fundamental shift in India's information access landscape. By removing both the public interest override and the provision ensuring citizens can access information available to Parliament, the amendment creates a blanket exemption for personal information that significantly restricts the scope of the RTI Act. While protecting personal privacy is important, many experts and activists argue that the current amendment fails to strike an appropriate balance between privacy and transparency, potentially undermining democratic accountability in significant ways.

Going forward, it will be essential to monitor how this amendment is implemented in practice and its impact on information access. Possible approaches to addressing concerns could include introducing new legislative amendments that restore some form of public interest override, developing administrative guidelines that interpret “personal information” narrowly, or judicial interpretations that balance privacy and transparency rights in accordance with constitutional principles. The tension between data protection and information access will likely remain a critical area of debate in India's evolving democratic framework.