In a representation to Ashwini Vaishnaw, the Union Minister for Electronics and Information Technology, the Editor’s Guild of India (EGI) has pointed out how the provisions of the Digital Personal Data Protect Act, 2023 (DPDP Act) violate principles enunciated by the Supreme Court-appointed Justice BN Srikrishna Commission report as also threaten the very existence of journalistic activities in India.
Expressing grave concerns at the impact of the recently enacted law on journalistic activities, the EGI, established post-Emergency in 1978[1], The detailed representation explains how this law, ostensibly brought in to “protect data privacy” will, in fact bring journalistic activity to a standstill.
The representation points out that while the DPDPA does not address journalists or their activities, it regulates the underlying processing (e.g., collection, use, storage) of personal data that is inevitable in almost every instance of journalism.
The EGI statement states, “ The enactment of the Digital Personal Data Protection Act, 2023 inadvertently endangers the freedom of the press 1.1 The DPDPA, while a laudable initiative towards protecting the personal data of individuals, if applied indiscriminately to the processing of personal data in a journalistic context, will bring journalism in the country to a standstill. This will have a long-standing impact on the freedom of the press, and the dissemination of information not just in reporting in print, TV, and the internet, but also the mere issuance of press releases by all parties including political parties. 1.2 The continued existence of the press – the fourth pillar of democracy – enables the dissemination of news, thoughts, and opinions and ensures a free and fair democracy. It informs public opinion, promotes civic engagement, and empowers individuals to make informed decisions including political choices. Its centrality is recognised by the Constitution of India (Constitution), which only permits reasonable restrictions on the exercise of the right to freedom of speech and expression.
As the statement points out, the Srikrishna Committee Report also recognised these consequences in noting that the untrammelled dissemination of news, current affairs, and documentaries, especially when they inform, criticise, and analyse issues of public importance, is in the public interest.
Journalistic Conduct regulated by Press Council of India (PCI) norms
The protection of personal data in the course of journalistic activities is built into journalistic conduct, such as those issued by the Press Council of India (PCI), established under the Press Council Act, 1978, Code of Ethics and Broadcasting Standards released by the News Broadcasters and Digital Association. 6.2 Notably, the PCI prescribes safeguards in the context of communalism in the press and cautions against defamatory writings and objectionable investigative reporting, obscenity, and vulgarity in, for example, news stories, or feature reports.
Through this, journalists are barred from (i) intruding upon or invading the privacy of an individual unless outweighed by the genuine overriding public interest; (ii) tape-recording a conversation without that person’s knowledge or consent, except where the recording is necessary to protect the journalist in a legal action, or for other compelling good reason. Journalists are also required to (i) obtain the prior consent of a minor’s parent, if “public interest” overrides the minor’s right to privacy; (iii) to apply due care by not disclosing the real names of persons involved in incidents affecting personal lives; and (iv) refrain from publishing inaccurate, baseless, graceless, misleading or distorted material. 6.3 Given that these codes of conduct, which apply to all journalists, achieve a balance between freedom of expression and the right to privacy applying a second framework to the same processing activities, concerning the same personal data will only create duplicate compliance requirements, impose an unwarranted burden on journalists, and more importantly, impair free speech and expression. This is particularly true since these applicable codes of conduct for journalism provide a more tailored compliance regime in balancing the competing rights at hand.
Concerns over DPDP Act
The newly enacted DPDP Act requires individuals or entities that determine the purpose and means of processing such personal data outside a personal or domestic context, i.e., data fiduciaries, to meet various requirements (e.g., provision of notice and obtaining consent, erasure, etc.). These requirements are undeniably onerous in the context of processing for journalistic purposes. Given the nature of the profession and the implications for fundamental rights involved processing personal data for journalistic purposes is an ideal case and must be an exemption from the provisions of the DPDPA. The DPDPA requires all processing of personal data to proceed on the basis of either consent or certain legitimate uses (e.g., for employment purposes or in the case of a medical emergency) under Section 7 of the DPDPA, which is narrow and specific in nature. Processing personal data for journalistic activities will invariably fall outside these narrow buckets.
While certain journalistic activities involving interviews, collecting responses to questionnaires, etc., may be covered under Section 7(a) of the DPDPA, which recognises voluntary provision of personal data by the data principal, most other forms of journalism, such as investigative journalism, general news reporting, opinion pieces, analyses, etc., are still largely dependent on private research and investigative study by journalists, which is remarkably absent in the current list of legitimate uses.
Explains the representation, given this, journalists will invariably have to rely upon consent to process any personal data in the course of their journalistic activities.
In fact, the onerous nature of this requirement was critiqued in the Report published by the Committee of Experts under the Chairmanship of Justice B.N. Srikrishna (Srikrishna Committee) titled ‘A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians’ (Srikrishna Committee Report)/ The Committee, which prepared the Personal Data Protection Bill, 2018, noted that mandating consent for processing such personal data would be unfavourable, as the data principal could simply refuse to consent forestalling all such publishing. The fundamental role of the press and its ability to ensure transparency and accountability would thus be severely undermined by the data principal’s ability to simply refuse consent to the processing of their data.
As the EGI’s representation to MEITY points out, the Srikrishna Committee Report that accompanied the 2018 Bill, too, recognised that exempting journalistic activity from compliance with the 2018 Bill was necessary for greater public interest. Accordingly, the Personal Data Protection Bill, 2018 (2018 Bill), prepared by the Srikrishna Committee, exempted processing for a ‘journalistic purpose’ from complying with all provisions of the 2018 Bill, except for the duty to process personal data in a fair and reasonable manner that respects the privacy of the data principal, and the obligation to implement reasonable security safeguards.3 The 2018 Bill defined ‘journalistic purpose’ as any activity intended towards the dissemination through print, electronic, or any other media of factual reports, analysis, opinions, views, or documentaries regarding:
- news, recent or current events; or
- any other information that the data fiduciary believes the public, or any significantly discernible class of the public, to have an interest in, which would be absolved from obtaining consent from data principals.4
The Personal Data Protection Bill, 2019 (introduced in the Parliament) and the Data Protection Bill, 2021 (prepared by the Joint Parliamentary Committee on data protection), contained similar provisions to exempt processing for journalistic purposes.
This position is notably consistent with other jurisdictions with data protection regimes that provide for exemptions from processing for journalistic purposes. For instance, the European Union’s General Data Protection Regulation (GDPR) enables Member States to provide for exemptions or derogations from certain provisions (e.g., have a lawful reason or basis for using data, provide privacy information, comply with individual rights that people have about their data, etc.) of the GDPR for journalistic purposes and freedom of expression.5 Similarly, Singapore’s Personal Data Protection Act, 2012 provides an exception for news organisations to collect, use, and disclose personal data without consent solely for its news activity to collect, use, and disclose personal data without consent solely for its news activity.
Despite this, processing for journalistic purposes is not exempt from the obligations under the DPDPA.
It may be possible to argue that Section 17(1)(c) of the DPDPA, which permits processing in the interest of prevention, detection, investigation, or prosecution of any offence or contravention of any law, would exempt processing for a specific kind of journalism: investigative journalism. However, the lack of a broad exemption that applies to all journalistic activity (as envisaged under prior iterations of this law and international statutory frameworks) and the absence of any clear guidance for this exemption severely hampers the ability of journalists to investigate, report, and publish any articles or reports of journalistic import. It is, therefore, crucial that an exemption be made available to cover processing related to journalistic purposes.
Unfortunately, India will be the sole modern democracy without an exemption for journalistic activities, which could severely impair the fourth pillar of democracy. Moreover, India is currently ranked 161 out of 180 countries in the World Press Freedom Index maintained by Reporters Without Borders below other Asian countries like Pakistan, Afghanistan, Sri Lanka, and Cambodia, and risks falling further down in the ranking if the DPDPA is enacted in its present form states the representation.
The detailed representation may be read here:
[1] Editors Guild of India [“EGI”] is an organisation established in 1978 to protect freedom of the press and to raise the standards of editorial leadership of newspapers and magazines. Since it’s establishment, EGI have consistently defended the freedom of speech and expression of publishers and the right to information of the citizens of India.
Related:
Concerned over arrest of TV journalist working for Republic Bangla: Editor’s Guild
FIR against editors, Prabhat Khabar, Editor’s Guild voices concern
Press Club of India condemns FIR against Editor’s Guild of India (EGI), criminalising journalism