A Bengaluru-based Right to Information (RTI) activist has approached the Supreme Court, challenging provisions of the data protection framework, arguing that recent changes could undermine transparency and accountability in governance.
Venkatesh Nayak, also Director of the Commonwealth Human Rights Initiative (CHRI), has filed the petition in his personal capacity, seeking a judicial review of certain provisions of the Digital Personal Data Protection Act, 2023 and related rules notified in 2025.
Nayak told TNSE that there are “serious anomalies” in the law that, if left unaddressed, could have long-term consequences for democratic oversight. “In its current form, the law can become another major impediment to journalists, as their ability to keep information sources confidential may be adversely affected,” he said.
His petition particularly contests amendments to the Right to Information Act, 2005 through Section 44 of DPDP Act. The revised provision broadens the exemption for “personal information,” potentially allowing authorities to deny access to a wide range of data.
He argued that the earlier law required officials to apply a three-part test before withholding information -- assessing whether the data related to public activity, whether disclosure would constitute an unwarranted invasion of privacy, and whether larger public interest justified release.
The amendment, he contends, removes these safeguards and creates what he calls a “blanket bar” on disclosure. The petition warns that the new framework could shield information about beneficiaries of welfare programmes from public scrutiny under the pretext of privacy protection.
“Entire swathes of information relating to delivery of public services may become inaccessible, weakening social audits and accountability,” Nayak said. He also expressed concern that RTI users and activists would find it difficult to seek accountability, as personal information contained in government records could become secret “by default”
Filed as a public interest petition, the plea contends that the contested provisions violate citizens’ fundamental right to information. It challenges provisions granting exemptions to government agencies from data protection obligations, which could enable surveillance without adequate safeguards, the structure and appointment process of the Data Protection Boar. It alleges executive control over a body performing quasi-judicial functions and lack of statutory clarity in defining what constitutes a ‘significant’ data breach, which the plea says leaves room for arbitrary enforcement.