The Supreme Court and India’s Data Protection Law: India’s First Constitutional Audit of Informational Power

The Supreme Court’s scrutiny of the Digital Personal Data Protection Act, 2023 is often being framed as yet another privacy versus transparency debate. But that framing is too narrow, and perhaps even misleading.

What is unfolding is not merely a challenge to a statute. It is, in essence, India’s first constitutional audit of the digital administrative state.

For decades, constitutional law in India evolved around physical governance, land, speech, liberty, and state power in tangible spaces. The DPDP Act, however, represents a different kind of law. It governs invisible infrastructures: databases, algorithms, digital identities, and information asymmetries. By examining this law, the Supreme Court is being asked to answer a deeper question: how should constitutional accountability operate when governance itself becomes data-driven?

The DPDP Act is not simply a privacy statute; it is India’s first comprehensive attempt at information governance. It determines who can collect data, who can access it, and crucially, who can refuse disclosure.

The constitutional challenge therefore forces a reframing: privacy is no longer just about protecting individuals from surveillance; it is about defining the architecture of informational power.

If the twentieth century constitutional battles were about controlling coercive power, the twenty-first century battles are about controlling informational power.

The Supreme Court’s scrutiny recognizes this shift, even if implicitly.

One of the most under-discussed aspects of the DPDP framework is how it strengthens what might be called the “data executive”, the administrative machinery that manages, processes, and regulates information flows.

Modern governance increasingly operates through datasets rather than directives. Welfare delivery, financial regulation, digital identity systems, and law enforcement are now mediated by data processing ecosystems.

The concern raised by critics is not merely about exemptions or RTI amendments; it is about whether the law grants disproportionate discretion to this emerging data executive without equivalent constitutional safeguards.

If traditional constitutionalism was about limiting the police power of the state, digital constitutionalism must grapple with limiting its informational power.

At the heart of the challenge lies a deceptively simple question: can privacy be invoked in a manner that structurally narrows transparency?

The Court is examining amendments introduced through the DPDP framework that affect disclosure of personal information under the Right to Information regime. These changes, particularly to the disclosure framework, are being challenged for removing the earlier balancing test that allowed information to be released when justified by larger public interest.

Petitioners argue that the shift effectively replaces a nuanced equilibrium with a near-blanket bar, diluting the right to information and free speech protections.

Critics warn that stripping the “larger public interest” safeguard could weaken two decades of transparency jurisprudence and push the system toward opacity.

The Supreme Court has declined to stay the provisions but acknowledged the complexity, choosing instead to subject the issue to deeper constitutional scrutiny.

There is an almost poetic symmetry here.

The DPDP Act was born out of the constitutional recognition of privacy as a fundamental right, a doctrine crystallized by the Supreme Court in 2017.

Now, less than a decade later, the Court is being asked whether the legal offspring of that doctrine has expanded beyond its intended boundaries.

In other words, the Court is revisiting the consequences of its own constitutional imagination.

Public debate often frames the dispute as privacy versus transparency. But the Constitution Bench referral signals something deeper: the Court is being asked to define who controls the narrative of governance in a datafied state.

Transparency laws were designed to make power visible. Privacy laws were designed to protect individuals from exposure.

When privacy becomes a justification for withholding information about public decision-making, the architecture of accountability itself begins to shift.

India’s administrative law tradition historically leaned toward disclosure as a democratic safeguard. The RTI regime symbolized a move toward radical openness, embedding public interest as a core test.

The challenge to the DPDP amendments suggests a possible inversion, where privacy becomes the default rationale for withholding information, even in contexts involving public officials or public activity.

Whether this shift is justified or excessive is precisely what the Constitution Bench must determine.

What makes this moment unprecedented is that two fundamental rights are not merely in tension, they are potentially redefining each other.

The right to privacy, rooted in dignity and autonomy, now intersects with the right to information, rooted in democratic accountability.

The Court’s task is to ensure that neither right becomes absolutist in a way that distorts the constitutional balance.

This case represents India’s first major test of digital constitutionalism, the process of adapting constitutional principles to governance mediated by data. The DPDP Act is not just a regulatory statute; it is an attempt to define informational power in the modern state.

The Constitution Bench will effectively determine whether India’s privacy framework strengthens individual liberty without weakening institutional transparency.

If privacy becomes a tool that allows institutions to evade scrutiny, democratic accountability could suffer. If transparency overrides privacy without restraint, individual dignity could be compromised.

The Court’s challenge is to prevent extreme while preserving the constitutional equilibrium envisioned in Part III.

Ultimately, the Supreme Court is not merely reviewing legislative drafting choices. It is engaging in constitutional self-reflection, asking whether the evolution of privacy jurisprudence has created unintended consequences for democratic openness.

The question before the Bench is therefore profound: Can a right designed to protect citizens from power become a doctrine that shields power from citizens?

The answer will shape not only the future of the DPDP Act but the trajectory of India’s constitutional democracy in the digital age.