Delhi HC Issues Notice On Plea Against State Exemptions, Blocking Powers Under DPDP Act

The Delhi High Court has sought the response of the Union Government on a public interest litigation challenging the constitutional validity of several provisions of the Digital Personal Data Protection Act, 2023, with the plea contending that the statute, while purporting to safeguard informational privacy, creates an institutional framework that enables excessive executive control, confers sweeping exemption powers upon the State, weakens the independence of the adjudicatory mechanism, and has a chilling effect on free speech and journalistic activity, thereby infringing Articles 14, 19(1)(a) and 21 of the Constitution and violating the basic structure doctrine.

A Division Bench comprising Chief Justice Devendra Kumar Upadhyaya and Justice Tejas Karia issued notice on the petition and called for the Centre’s response.

The Court’s order came in a writ petition under Article 226 that raises a structural challenge to the architecture of the data protection regime, particularly assailing Sections 17 to 21, 23, 29, 33, 34, 36, 37 and 44 of the Act along with the corresponding Rules.

The plea asserts that these provisions cumulatively establish an adjudicatory and enforcement mechanism that is executive-dependent, permit opaque and wide-ranging exemptions, and confer blocking and censorship powers without adequate procedural safeguards.

The challenge is anchored in the Supreme Court’s nine-judge Bench judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, which recognised the right to privacy as a fundamental right and affirmed informational self-determination and dignity as core constitutional values.

It is contended that the impugned provisions dilute this guarantee by enabling the State to exempt its own instrumentalities from the operation of the Act on broadly worded grounds such as sovereignty, security of the State and public order.

Section 17, in particular, is assailed as conferring unguided and unbounded discretion on the executive to exempt any data fiduciary, including government agencies, from the obligations of the law, thereby permitting the State to place itself outside the privacy framework it has enacted.

A significant limb of the challenge concerns the constitutional status, composition and independence of the Data Protection Board of India.

The petition contends that the Board performs essential judicial and quasi-judicial functions, including conducting inquiries, summoning parties, adjudicating complaints, determining breaches, imposing penalties that may extend up to Rs. 250 crore, and issuing binding directions, yet remains entirely under executive control in matters of its establishment, appointments, tenure, service conditions, administrative functioning and removal.

Such an arrangement, it is argued, is contrary to the settled constitutional position laid down in Union of India v. R. Gandhi, Madras Bar Association v. Union of India (2014 and 2021), and Rojer Mathew v. South Indian Bank Ltd., where the Supreme Court held that tribunals discharging judicial functions must be insulated from executive dominance and that any such control violates the principles of separation of powers and judicial independence, which form part of the basic structure.

The appellate mechanism under Section 29 has also been questioned on the ground that it designates the Telecom Disputes Settlement and Appellate Tribunal as the appellate forum and provides a direct statutory appeal to the Supreme Court thereafter, thereby excluding the jurisdiction of High Courts.

This, according to the plea, runs contrary to the Constitution Bench ruling in L. Chandra Kumar v. Union of India, which affirmed that judicial review by High Courts under Articles 226 and 227 constitutes part of the basic structure and cannot be ousted in respect of decisions of tribunals.

The petition further challenges the amendment introduced to Section 8(1)(j) of the Right to Information Act, 2005 through Section 44(3) of the DPDP Act. It is contended that the amendment undermines the established balance between the right to information and the right to privacy and curtails the institutionally recognised framework of transparency without adequate legislative justification.

The plea asserts that the RTI Act is a comprehensive and self-contained statute and that altering its substantive provisions through a different enactment, without a direct and reasoned legislative exercise, has serious implications for access to information, press freedom and accountability.

Concerns have also been raised regarding Section 37, which empowers the Central Government to block access to digital platforms and intermediaries.

The provision is alleged to be broader than the blocking power under Section 69A of the Information Technology Act, 2000 and to operate without comparable procedural safeguards, publication requirements, recording of reasons, opportunity of hearing, or proportionality assessment, thereby enabling censorship without judicial oversight.

The plea states that these provisions, when read together, create a regime of surveillance-enabling powers, executive-controlled adjudication and restrictions on informational flow that affect more than a billion digital users in the country.

It also contends that the statutory design has implications for journalistic source protection and could have a chilling effect on investigative reporting and the free dissemination of information.

The Digital Personal Data Protection Act was enacted by Parliament in August 2023 and became operational following the notification of the corresponding Rules in November last year.

The petition characterises the present challenge as raising foundational questions concerning privacy, transparency, digital governance and the constitutional requirement of an independent adjudicatory mechanism in India’s first comprehensive data protection law.

Case Title: Dr. Chandresh Jain v. Union of India & Ors.

Bench: Chief Justice Devendra Kumar Upadhyaya and Justice Tejas Karia.