Editors Guild asks govt to exempt journalists from certain clauses of data protection act

The Editors Guild of India has submitted a representation to the ministry of electronics and information technology asking the Union government to exempt journalists from certain clauses of the Digital Personal Data Protection Act 2023 (DPDPA) as they violate the freedom of expression guaranteed under article 19 of the Constitution.

The letter expresses the grave concerns about the impact of the recently enacted DPDPA on journalistic activities. Parliament passed the act last year and it will come into force once the Centre notifies dates.

The letter states that the enactment of the DPDPA inadvertently endangers freedom of the press, and if applied indiscriminately to the processing of personal data in a journalistic context, will bring journalism in the country to a standstill. “This will have a long-standing impact on the freedom of the press, and the dissemination of information not just in reporting in print, TV, and the internet, but also the mere issuance of press releases by all parties including political parties.”

“While certain journalistic activities involving interviews, collecting responses to questionnaires, etc, may be covered under section 7(a) of the DPDPA, which recognises voluntary provision of personal data by the data principal, most other forms of journalism, such as investigative journalism, general news reporting, opinion pieces, analyses, etc, are still largely dependent on private research and investigative study by journalists, which is remarkably absent in the current list of legitimate uses,” guild president Anant Nath wrote in the letter to Union electronics and IT minister Ashwini Vaishnaw on Friday.

The letter notes that while the DPDPA does not address journalists or their activities, it regulates the underlying processing (e.g., collection, use, storage) of personal data that is inevitable in almost every instance of journalism. The DPDPA requires individuals or entities that determine the purpose and means of processing such personal data outside a personal or domestic context, i.e., data fiduciaries, to meet various requirements (e.g., provision of notice and obtaining consent, erasure, etc.).

These requirements are undeniably onerous in the context of processing for journalistic purposes. Given the nature of the profession and the implications for fundamental rights involved, processing personal data for journalistic purposes is an ideal case and must be an exemption from the provisions of the DPDPA.

According to the guild, the across-the-board requirement for journalists to obtain consent before publishing data relating to any person in their reports is unnecessarily restrictive and impractical.

The letter underscored that the Srikrishna Committee, which drafted the Personal Data Protection Bill 2018, “noted that mandating consent for processing such personal data would be unfavourable, as the data principal could simply refuse to consent, forestalling all such publishing. The fundamental role of the press and its ability to ensure transparency and accountability would thus be severely undermined by the data principal’s ability to simply refuse consent to the processing of their data”.

It added: “For instance, when a journalist is investigating the parties involved in a fraudulent/ Ponzi scheme, reporting on road accidents in a particular city, or publishing information about the achievement of an individual who is a resident of another city, the requirement to provide notice and obtain consent would not only be impractical or unfeasible but will likely defeat the purpose of the journalistic endeavour, by causing inordinate delay or impeding the journalist from publishing the news report itself."

In his letter, Nath also pointed out the infeasibility and impracticality of requiring journalists to adhere to other obligations under the DPDPA. “The requirements under the DPDPA when applied to journalists are unduly onerous, impractical, and infeasible... in light of the distinct practices involved in journalism when compared to other professions,” he wrote.

The guild pointed out in the letter that the protection of personal data in the course of journalistic activities is built into journalistic conduct, such as those issued by the Press Council of India (PCI), established under the Press Council Act 1978, Code of Ethics and Broadcasting Standards released by the News Broadcasters and Digital Association.

The letter pointed out that notably, the PCI prescribes safeguards in the context of communalism in the press and cautions against defamatory writings and objectionable investigative reporting, obscenity, and vulgarity in, for example, news stories, or feature reports.

“Journalists are barred from (i) intruding upon or invading the privacy of an individual unless outweighed by the genuine overriding public interest; (ii) tape-recording a conversation without that person’s knowledge or consent, except where the recording is necessary to protect the journalist in a legal action, or for other compelling good reason. Journalists are also required to (i) obtain the prior consent of a minor’s parent, if “public interest” overrides the minor’s right to privacy; (iii) to apply due care by not disclosing the real names of persons involved in incidents affecting personal lives; and (iv) refrain from publishing inaccurate, baseless, graceless, misleading or distorted material.”

The guild has sought, before the law comes into force, “a class exemption to data fiduciaries undertaking processing for journalistic purposes under section 17(5) of the DPDPA for as long as such purposes subsist”.

“We strongly urge the Ministry of Electronics and Information Technology (Ministry) to ensure that processing for journalistic purposes is exempted from the application of the DPDPA. Indeed, the tools for doing so are built into the DPDPA itself. Under section 17(5) of the DPDPA, the Government may, before the expiry of five years from the date of commencement of the DPDPA, by notification, declare that any provision of this DPDPA will not apply to any data fiduciary or classes of data fiduciaries for a period specified in the notification,” Nath requested in his letter.