DPDP weaponises data, finishes off transparency: Anjali Bharadwaj

A month after the Central Government notified Rules to The Digital Personal Data Protection (DPDP) Act, 2023 (scroll to the bottom to read the FSC note for more on the DPDP Act), marking the full functionality of the law, the threat to transparency in governance and citizens’ right to information is now becoming increasingly discernible.

The tell-tale straw in the wind is that though all the rules that are to be implemented in a staggered manner, among the first ones to be set in motion is the amendment carried out to The RTI Act.

A group of nearly 30 stakeholders including transparency activists, journalists, civil society members among others is gearing up to challenge these amendments under the ‘Roll back RTI Amendments Campaign’. Ashutosh M Shukla* spoke to Anjali Bhardwaj, transparency activist and co-convenor of the National Campaign for Peoples’ Right to Information (NCPRI), which is among the groups that is part of the campaign.

Can you tell us about the ‘Rollback RTI Amendments Campaign’ and the need for it? Will this campaign have any impact considering the law is already amended and rules notified?

The Right to Information has been the most empowering legislation. It has empowered citizens to question the government, expose corruption and human rights violations. We are seeing a systematic push back from the government. This is the second amendment to The RTI Act done by the government. The first was in 2109 in which the independence of Information Commissioners were diluted when the central government empowered itself to change their tenure and appointments. In 2023, the central government amended the RTI Act again through the Digital Personal Data Protection (DPDP) Act. They got it passed when the opposition boycotted the session over the violence in Manipur.

Through the DPDP Act, they amended the RTI Act again and now no personal information can be obtained under RTI. A lot of care was taken when RTI was drafted to ensure that no invasion of privacy happens. People were closely involved while its drafting and a very nuanced provision was made. It was seen that no vicarious information is sought including health details. It further said, unless there is larger public interest involved, such information is exempted.

Now the amendment says all personal information will be exempted. A lot of information with which people hold the government accountable will now not be accessible. So, for example, details of wilful defaulters of bank loans will not be available. The RBI had said no to providing the information but the Courts had ruled that it should be given. Now people will be told that this information cannot be given.

A Special Intensive Revision (SIR) exercise is going on – lists of voters have photographs, addresses… The Election Commission could turn around and say we are being compliant with Data Protection Law by not giving details. Roads and highways that have been constructed, people want to know the name of the contractor doing poor work. This will also not be provided.

This is becoming like the Corruption Protection Act. It is a big blow to the RTI. Even daily use of RTI to monitor details of ration card beneficiaries, Mahatma Gandhi National Rural Employment Guarantee Authority (MNREGA) workers to know if the rightful people are getting benefits will now be going out of their reach. People were using RTI to demand accountability. Hence, we started this campaign.

We do not know if the government will listen because whenever anyone is protesting, the government is putting charges, calling them anti-national. There is no consultation the government did while making this law. It did not involve civil society groups. They only involved Industry people while preparing the DPDP. We intend to take this matter to the court and also among people.

Another thing is that this law is very dangerous not because it only amends RTI, it is weaponizing data. Anyone who collects data of individuals will be called ‘data fiduciary’. Anyone who is compiling data for beneficiaries can be termed as the same. Even journalists will be termed as ‘data fiduciary’.

A recent meeting held on the issue in Delhi stated that DPDP in its present form has a chilling impact on not just activists and journalists but also lawyers, political parties, groups and organisations. Can you elaborate on this?

The DPDP Act puts a lot of responsibility on ‘data fiduciary’. One has to take prior consent of the person whose data is to be used. If they don’t obtain their consent, there can be a complaint. That complaint is dealt with by the Data Protection Board (DPB) controlled by the government. They have been given the right to impose a penalty of up to Rs 250 crores that can even go up to Rs 500 crores.

If a journalist or a fact-finding mission gets details of people, they cannot publish it without taking their consent (of people blamed). If there is corruption in road work and someone analyses that information and publishes names, one will have to take permission from the person who is corrupt. This will make publishing such information impossible because why will a corrupt person give that consent?

The Data Protection Board can impose a penalty. So, effectively, two things are happening, we will not get information under RTI, and if people go out and collect it, they may be called ‘data fiduciary’.

The government wants to have control over data. Even privacy activists are against this because the government can exempt any company on a case-by-case basis. Government could exempt a telecom company or media company. It will bring in arbitrariness.

It can increase quid pro quo and corruption and affect media freedom. The law can be used as a weapon in the name of data protection against anyone who dares to dissent. Anyone whose story they may not like, they can do that.

It is a very dangerous piece of legislation. There is a strong need felt to speak out against this law. The Editors Guild and The Press Club of India have written to the Central Government but no heed was paid to their objections. Instead, they came out with a notification that talks of staggered implementation and the one that amends RTI has already set in.

Under this law, even political parties will become ‘data fiduciary’ because they collect names and phone numbers on social media. In every case of “violation”, they can give a penalty of thousands of crores.

The provisions in the law can be used in mischievous ways. Someone can withdraw consent and a complaint can be lodged against the data fiduciary. Lawyers collect a lot of information to build a challenge in the court. It concerns people across different groups. Media is very worried and citizens are very worried too.

But in the case of journalists or other professions, they take consent before talking to people? How is this different?

If someone files a complaint, stating that the consent was not taken, how will you prove it? There could be someone who does this as mischief or just to create trouble by first giving consent and then complaining. This is a real danger. Now there will be a complaint that can be filed under data protection and it can invite a penalty. This leaves a huge scope for mischief and can particularly harm the work of journalists.

This issue has always been there. Some people have turned around and said they did not speak to the journalist.

Earlier they could file FIR or defamation, now anyone can file the complaint. Anyone speaking against the government will be acted against. In the meeting we had, a lot of people talked about this. The President of The Press Club of India was there, the Editors Guild of India, journalists were there. They even quoted the letter written to the Ministry of Electronics and Information Technology (MeitY) raising their concerns. They were assured by the government that they will address the issues raised by them but nothing came back from the government.

Journalists spoke on the issue of electoral bonds, names of companies, names of donors will become difficult to access or publish. No one can go and give consent to publish their names. From the smallest NGO to the biggest Google, except for someone the government wants to exempt from this, it is a problem for everyone else. The stated need for DPDP was to prevent cyber fraud but what the government has done goes way beyond that and finishes off transparency. It can exempt people if it so likes, and harass if it does not.

What kind of democratic oversight does the DPDP compromise and does it take things back to the old times where both information and transparency were elusive?

Here you cannot have any information at all. You can have your own information. Anyone else’s information is exempt.

Does this mean curtains on Social Audits?

It will deal a huge blow to the people monitoring data. If the government social audit unit is doing it, it may be there. But then such an audit will be government empowered and not a people empowered audit.

Should civil society, journalists, lawyers, political parties, groups and organisations have been more vociferous before the amendments set in? In the staggered implementation of DPDP rules, the amendment to RTI is among the foremost.

It shows the intention of the government and that it wants to curb the rights of people to access information. The first thing they have done is to amend the RTI law. It is a very concerning fact. If the intent was to protect data, why did the government amend the RTI law when so many concerns were being raised around it?

Actual key provisions will be effective 18 months later. What was the rush to amend the RTI Act? There was a campaign as well as advocacy done repeatedly to not dilute RTI. Letters were written repeatedly but they fell on deaf ears. We did not see any action despite strong protests. Repeated protests were done, representations sent from key journalist bodies, civil society groups and even political parties. But the government was hell bent on making these amendments to RTI.

*Ashutosh M Shukla is a Mumbai-based journalist and has reported extensively on RTI and its impact.