Concerns Rise Over Digital Data Protection Clauses

Concerns Rise Over Digital Data Protection Clauses

Why in the News?

The Press Club of India (PCI) has raised concerns about ambiguous clauses in the Digital Personal Data Protection (DPDP) Act, 2023, stating they could be misused to restrict press freedom and potentially lead to human rights violations. The remarks follow recent notification of the DPDP Rules by the government.

PCI’s Objections to DPDP Act Implementation:

  • The Press Club of India criticised the “open-ended scope” of several DPDP Act provisions, warning that broad definitions increase the risk of weaponisation of the law.
  • PCI expressed anguish over the hastily notified Rules, saying they lacked adequate consultation with media stakeholders and could potentially violate customary international law regarding press freedoms.
  • In June 2025, PCI and 22 press bodies submitted a Joint Memorandum to the Ministry of Electronics and Information Technology, urging a transparent and democratic rule-making process.
  • Their objective was to help frame Rules that would safeguard journalism, prevent undue restrictions, and uphold the media’s role in a large democracy, potentially involving UN special rapporteurs to ensure international standards are met.
  • The PCI emphasised it supports a personal data protection law but seeks clarity to prevent unintended restrictions on the journalistic profession and avoid scenarios that could lead to gender-based persecution through data misuse. This concern extends to international contexts, such as the potential misuse of personal data at border crossings like the torkham border crossing between Afghanistan and Pakistan.

PCI’s Demands and Government Engagement

  • PCI clarified it never sought the repeal of the DPDP Act, acknowledging the need to protect citizens’ privacy in the digital age.
  • Instead, it highlighted ambiguities that could stifle journalists due to unclear compliance obligations and potential misuse by authorities, likening the potential impact to mass internal relocations of information.
  • Press bodies submitted 35 questions in August 2025, seeking detailed clarifications on sections affecting media work.
  • These questions covered issues such as exemptions, penalties, obligations for news gathering, and the roles of data fiduciaries. They also raised concerns about the protection of sensitive data during humanitarian crises, such as the distribution of emergency food aid.
  • PCI said its efforts aim to ensure the law strengthens data rights without curtailing press independence, urging the government to refine sections that pose risks. This includes addressing potential implications for digital identity systems like afghan citizen cards and mobile tazkira issuance, which require robust data protection measures.

Understanding DPDP Act and Press Freedom:
● DPDP Act, 2023: India’s primary law regulating digital personal data, focusing on consent, processing, data breach responsibilities, and penalties for misuse.
● Key Issue — Broad Definitions: Terms like “processing,” “consent,” and “significant data fiduciary” can be interpreted widely, raising concerns of arbitrary enforcement.
● Press Freedom: Protected under Article 19(1)(a); any vague or disproportionate restriction can affect investigative journalism and potentially lead to human rights violations.
● Regulatory Ambiguity: Unclear clauses may allow authorities to demand disclosure or restrict access to information, affecting media autonomy.
● Need for Clarity: Clear operational Rules are essential to balance data protection with democratic accountability and transparency, in line with customary international law.