Is India about to lose freedom and become a surveillance state?

The parliament has passed the Digital Personal Data Protection (DPDP) Bill 2023.

Critics identify the bill’s potential for widening censorship, increasing surveillance of journalists and their sources, and undermining Right to Information (RTI) legislation.

The Editors Guild of India (EGI) and DIGIPUB a foundation formed by digital-only news organisations, echoed similar concerns over the DPDP Bill, 2023, saying it carries various provisions that can have an adverse impact on press freedom.

The Bill could be used to widen the government’s existing powers of censorship because clause 37(1) (b) will allow the Union government to “censor content on vague and unspecified grounds ‘in the interest of the general public’”.

This will increase censorship powers well beyond what is presently provided for under Section 69A of the Information Technology Act, 2000, and may even be unconstitutional for going beyond the reasonable restrictions on free expression enumerated under Article 19(2) of the Constitution of India.

There is a lack of exemptions for journalists from certain obligations of the law, where the reporting on certain entities in public interest may clash with their right to personal data protection.

Certain provisions of the Bill, Clause 44(3) for instance, unreasonably widen the scope of exemptions available to Public Information Officers of government ministries and departments to reject RTI applications under Section 8(1)(i) of the Right to Information Act, 2005, on the simple basis that the information sought ‘relates to personal information’.

While exemptions provided to the government and its instrumentalities are near-absolute, the Data Protection Board [DPB] to be constituted thereunder has not been provided sufficient independence and rulemaking powers, but since all members of the DPB will be appointed by the Union government, its independence remains in doubt.

Bypassing democratic processes, such as transparency in the public consultation process as well as lapses in parliamentary procedure in tabling the Bill before the Parliamentary Standing Committee, have contributed to the drafting of a Bill that provides significantly lower protections than those envisaged initially by the Justice BN Srikrishna Expert Committee and by the Supreme Court in its landmark Privacy Judgment of Justice K.S. Puttaswamy v. Union of India.

The Bill, ostensibly to promote data protection, has failed to make any provisions that bring about the surveillance reform that is urgently needed, and in fact creates an enabling framework for surveillance of citizens, including journalists and their sources.

While clause 17(2) (a) allows the Union Government to issue a notification exempting any “instrumentality of the State” from the provisions of this Bill, thereby out of the ambit of data protection restrictions, including internal sharing and processing of data, Section 17(4) allows the government and its instrumentalities to retain personal data for an unlimited period of time.

Additionally, under Section 36, the Government can ask any public or private entity (Data Fiduciary) to furnish personal information of citizens, including journalists and their sources.

The Indian government also passed a Press and Registration of Periodicals (PDP) Bill, 2023 on August 3, replacing the colonial-era Press and Registration of Book Act, 1867.

While the government claims the legislation will streamline media business practices, and amend punitive sections in its predecessor legislation, media defenders say the bill may expose media outlets deemed ‘noncompliant, terroristic, or seditious’ to intervention by authorities, such as India’s security forces.