Relevance: GS II (Polity & Governance) | Source: The Hindu

1. What is the News?

• The SC Scrutiny: The Supreme Court is currently checking the Digital Personal Data Protection (DPDP) Act, 2023 and its latest 2025 Rules.
• The Conflict: Experts say the new law is being used as a shield by the government to hide information that should be public.
• The Goal: The Court wants to decide where a public official’s “private life” ends and where the “public’s right to know” begins.

2. What is the DPDP Act, 2023?

The DPDP Act is India’s first major law to protect your digital information.

• Consent is King: Companies or the government cannot use your data without your clear “Yes.”
• Data Principal: That’s you—the owner of the data.
• Data Fiduciary: The entity (like an app or a bank) that handles your data.
• The Penalty: If your data is leaked, the government can fine companies up to ₹250 Crore. However, this money goes to the government, not the victim.

3. The Big RTI Problem

• The Blanket Ban: Earlier, the Right to Information (RTI) allowed people to see the personal details of public officials (like their degrees or assets) if it was in the “public interest.”
• The Change: The DPDP Act changed the RTI rules. Now, there is a total ban on sharing any “personal information.”
• The Worry: Activists fear this will help corrupt officials hide their records, as almost anything can be called “personal data.”

4. Key Concerns for Students

• Government Exemptions: The government can excuse its own agencies (like the police or CID) from following these privacy rules in the name of “national security.”
• Mass Surveillance: There are fears the state could use these powers to track citizens’ data without enough checks and balances.
• No Compensation: If a company loses your private photos or bank details, the government takes the fine, but you (the victim) get nothing to cover your loss.

UPSC Value Box

With reference to the Digital Personal Data Protection (DPDP) Act, 2023, consider the following statements:

1. The Act defines the “Data Principal” as the individual to whom the personal data relates.
2. The Act has removed the “public interest” exception that previously allowed the disclosure of personal data under the RTI Act.
3. The penalties collected for data breaches under this Act are distributed among the affected citizens as compensation.

Which of the statements given above is/are correct?

(a) 1 and 2 only

(b) 2 and 3 only

(c) 1 and 3 only

(d) 1, 2 and 3