Naavi's Podcast
An Introduction to the raise of the new Profession "Independent Data Auditor"
Naavi's Podcast
Section 44(3) amendment does not adversely impact RTI Rights
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Naavi discusses how the amendment proposed under DPDPA for Section 8(1)(j) of RTI act has no adverse impact on the Rights under the Act and at the same time was inevitable consequent to change of law in 2027 and 2023
So I want you to imagine for a second, like just picture that you live in a house made entirely out of crystal clear, bulletproof glass.
SPEAKER_00Okay. Sounds a bit weird, but I'm with you.
SPEAKER_01Right. Well, from the outside, it's this absolute marvel of public accountability. I mean, your neighbors can see exactly what you're doing 24-7.
SPEAKER_00Right. So no secrets, no shadowy corners where, you know, bad behavior or corruption can hide.
SPEAKER_01Exactly. It's the ultimate transparent society. But then evening rolls around. You just want to eat your dinner, maybe walk around in your pajamas.
SPEAKER_00Yeah. Suddenly that total transparency feels an awful lot like a prison.
SPEAKER_01Exactly. You want to put up some thick curtains. And the dilemma here is when you reach up to hang those curtains, are you trying to hide a crime or are you literally just trying to get dressed in peace?
SPEAKER_00Aaron Powell And that tension, that exact tension between the absolute necessity of public accountability and the fundamental human need for privacy is well, it's one of the hardest things for any society to manage.
SPEAKER_01Yeah. And when a country actually tries to encode that delicate balance into enforceable law, the mechanics get incredibly complicated.
SPEAKER_00Oh, absolutely. And the public debate gets very heated.
SPEAKER_01Aaron Powell, which brings us to the core of what we're exploring with you today. Welcome back to another deep dive. Today we're cutting straight through the dense, tangled legal jargon of a highly contested piece of digital legislation currently unfolding in India.
SPEAKER_00Yeah, and we have a really fascinating, highly detailed source for this. It's a post from Naavi.org written by Vijaya Shankar Not.
SPEAKER_01Right. He's a veteran cyberlaw specialist.
SPEAKER_00He is, and he's writing this basically as a real-time countdown because we're looking at exactly 364 days until India's Digital Personal Data Protection Act, the DPDPA, becomes fully operative.
SPEAKER_01Aaron Powell The clock is ticking really loudly on this one.
SPEAKER_00Aaron Powell It is, and the stakes couldn't be higher. I mean, the Supreme Court of India was actually scheduled to hear a major constitutionality challenge against this very act just yesterday.
SPEAKER_01Oh wow. Yesterday.
SPEAKER_00Aaron Ross Powell Yeah. But as it often happens with these massive constitutional benches dealing with, you know, a huge backlog of fundamental rights cases, the hearing got delayed.
SPEAKER_01Aaron Powell Right. So the legal machinery is paused for a second.
SPEAKER_00Aaron Powell Exactly. But the public uproar over this new privacy law, that's only getting louder. Trevor Burrus, Jr.
SPEAKER_01It really is. It's this massive collision of journalism, bureaucracy, and fundamental rights. And the source material we're using today is deeply critical of how certain political and media entities are handling all this legislation.
SPEAKER_00Aaron Powell Yeah. Specifically, it touches on the actions of 120 MPs from the INDIA block who have actively urged the repeal of a specific section of this act. Trevor Burrus, Jr.
SPEAKER_01Right. And before we dive in, we need to make it absolutely clear to you, the listener, we are not taking sides, nor are we endorsing any left-wing or right-wing political viewpoints. Our sole goal today is to impartially report on the content provided in this source material and help you understand the core ideas being debated.
SPEAKER_00Aaron Powell Because the real goal here is to look at the mechanical gears of the law, right? Strip away all the political rhetoric and just see how these provisions actually work in practice.
SPEAKER_01Exactly. So what does this all mean? Why is a law meant to protect privacy suddenly under attack for allegedly destroying transparency? Let's look at how this battle is playing out in the public eye right now, because as we know, public perception completely shapes legal reality.
SPEAKER_00It really does.
SPEAKER_01And our source, Navi, he kicks things off by fiercely critiquing a specific article published in the Economic Times. It was written by Sirach Shapi and Induban.
SPEAKER_00Yeah, the article is titled Battle over India's First Privacy Law, likely to begin in SC by May End. And Navi takes serious issue with the framing of that piece.
SPEAKER_01Okay, let's unpack this. Yeah. What exactly is his problem with the framing?
SPEAKER_00Well, the Economic Times article heavily quotes several senior law partners from major firms. I mean, they quote Hardeep Sakdeva from AZB and Partners, Arjit Benjamin from ProSaw Law, and Rajas R. Chitnis from Chitness Desai Law Firm. In the Indian legal landscape, these are heavyweight names.
SPEAKER_01Right. So to a casual reader, dropping those massive corporate legal names makes it sound like the entire legal establishment is throwing its weight behind the public interest litigations, the PILs that are trying to scrap the new privacy law.
SPEAKER_00Exactly. It creates this sense of immense institutional momentum against the DPDPA.
SPEAKER_01But is that actually what those lawyers were saying?
SPEAKER_00What's fascinating here is what Navi calls journalistic misuse. Because when you actually read the direct quotes from those lawyers in the article, they aren't endorsing the premise of the petitions at all.
SPEAKER_01Wait, really? They aren't saying the law should be scrapped.
SPEAKER_00Not at all. They are simply observing that the petitions are deeply significant because they place India's entire digital governance architecture under judicial scrutiny.
SPEAKER_01Oh, I see.
SPEAKER_00Yeah, observing that a court case is historically important is very, very different from hoping the petitioners actually win.
SPEAKER_01Wait, hold on though. Let me push back on that a bit. If 120 MPs are demanding a repeal and advocacy groups like the Reporters Collective are actively fighting this in the Supreme Court, isn't the media just reporting on a fire that's clearly burning?
SPEAKER_00I mean, yes, the fire is there.
SPEAKER_01Right. Like if the lawyers say the case is important and the journalists build a story around the fear of the law, aren't they just doing their jobs? It feels a bit like a referee stepping onto a field and declaring, hey, this is a really important championship match, and the media running with it saying the ref wants a specific team to lose.
SPEAKER_00That's a good analogy. The underlying conflict is completely real, sure. But selectively quoting to build a narrative of consensus is what Navi is critiquing here. He argues the article creates a false reality by omission. Like it entirely leaves out the legal counterarguments.
SPEAKER_01Aaron Powell What kind of counterarguments?
SPEAKER_00Well, for instance, organizations like the FDPPI, that's the foundation of data protection professionals in Indy, they filed intervention petitions.
SPEAKER_01Aaron Powell And an intervention petition is just to clarify for everyone when a third party steps into a lawsuit to basically say, hey, the court needs to hear our perspective before deciding.
SPEAKER_00Aaron Powell Right, exactly. And the FDPPI's petition fundamentally dismantles the petitioner's arguments about mass surveillance. So by presenting only the fears of unrestricted state access without even mentioning the data protection professionals who are arguing the exact opposite.
SPEAKER_01Aaron Powell You completely skew the public's understanding of the legal reality.
SPEAKER_00Trevor Burrus Exactly.
SPEAKER_01Trevor Burrus Okay, so if the media is amplifying this fear of like a transparency blackout, what is the actual legal pin holding that fear together? What's the specific law they're mad about?
SPEAKER_00Aaron Powell It basically all comes down to one tiny, highly controversial deletion in the new law. The battleground is tightly focused on section 44 of the DPD petition.
SPEAKER_01Section 43.
SPEAKER_00Yeah. The petitioners claim this section amends the existing Right to Information Act, the RTI, in a way that allows a blanket denial of any information request involving personal data.
SPEAKER_01Aaron Powell Wow. A blanket denial. That sounds intense. So how did we get here?
SPEAKER_00Aaron Powell To understand the mechanics of this clash, we really have to look at the timeline. So the Right to Information Act was passed way back in 2005. Right. And it was a landmark revolutionary piece of sunshine legislation. It really empowered citizens to demand answers from the state.
SPEAKER_01Aaron Powell But things have changed since 2005.
SPEAKER_00Trevor Burrus Drastically. Indian law shifted. I mean, the tectonic plates moved in 2017 with the Supreme Court's Putaswamy judgment.
SPEAKER_01Ah, right. That was the nine-judge bench that officially elevated privacy to a fundamental right under the Indian Constitution, right? Trevor Burrus, Jr.
SPEAKER_00Precisely. And a fundamental right sits at the absolute top of the legal food chain. It overrides older statutory frameworks.
SPEAKER_01Aaron Powell Okay, so you can't just apply a 2005 transparency standard when privacy has been elevated to a fundamental constitutional level in 2017.
SPEAKER_00Trevor Burrus, Jr. Right. The new DPDPA was drafted to reflect that elevated status.
SPEAKER_01Aaron Powell But according to the critics, Section 443 of the new law acts like a total wrecking ball to the old standard. Because under the old 2005 RTI rules, specifically Section 81J, a government official could refuse to release personal info unless they felt the disclosure was justified by a larger public interest. Yeah. Or if they decided it wouldn't cause an unwarranted invasion of privacy. But the new privacy law comes in and completely deletes those specific phrases. The qualifiers are just gone.
SPEAKER_00They are. Larger public interest and unwarranted invasion were completely stripped from that specific subsection.
SPEAKER_01Aaron Powell But wait, removing larger public interest sounds incredibly dangerous. I mean, if you're rewriting a transparency law, isn't that the exact phrase you want to keep?
SPEAKER_00It seems like it on the surface.
SPEAKER_01Right. It sounds like the government is intentionally removing the one standard that forces corruption out into the light. Why wouldn't you want an official to weigh the public interest?
SPEAKER_00Aaron Powell Because of the reality of who is actually making that decision. You have to remember the law doesn't exist in a vacuum, it exists on the desk of a public information officer or PIO.
SPEAKER_01Okay, let's picture this PIO.
SPEAKER_00Think about who this person is. This is a mid-level government bureaucrat, maybe sitting in a municipal office in a tier two city, just staring at a massive stack of paperwork.
SPEAKER_01Right. They're just trying to get through their Tuesday.
SPEAKER_00Exactly. They are not constitutional scholars. They don't have decades of judicial expertise to run a complex multifactor proportionality test on fundamental rights before their lunch break.
SPEAKER_01Aaron Powell So under the old law, they were basically just guessing what larger public interest meant on a case-by-case basis.
SPEAKER_00Aaron Powell Yes. And under the new DPDPA, the stakes for guessing wrong are apocalyptic for them. Aaron Powell How so? Because the new privacy law has teeth, real teeth. If a PIO misinterprets larger public interest and wrongly releases a citizen's personal data, they expose their organization, which the law views as a data fiduciary to massive, crushing financial fines. Quote from who? From the newly established Data Protection Board. And beyond the institutional fines, the PIO personally could face severe disciplinary action for violating a citizen's fundamental right to privacy.
SPEAKER_01Oh, wow. Okay, that paints a very different picture. You're basically asking a desk worker to act like a Supreme Court justice, weighing the abstract concept of extent of harm against extent of public interest.
SPEAKER_00Right.
SPEAKER_01If they guess wrong and release the data, they could ruin their career and cost their department millions. So obviously they're going to default to denying every single request.
SPEAKER_00And that is an obvious central argument right there. It is completely untenable to impose that kind of judicial burden on a bureaucrat.
SPEAKER_01Yeah, that makes total sense.
SPEAKER_00Deleting those vague phrases wasn't some grand conspiracy to hide information. It was a practical necessity. It was about removing an impossible burden from public servants who are now forced to operate under the strict, punitive privacy mandates of the new law.
SPEAKER_01But wait, if you remove that standard from the bureaucrat's desk, how does anyone ever get information? Right. I mean, here's where it gets really interesting based on the source material, because you read that they deleted larger public interest, and you naturally assume transparency is just dead. Trevor Burrus, Jr.
SPEAKER_00Yeah, that's the headline everyone panicked over.
SPEAKER_01Aaron Powell Right. But the source points out that the 2005 RTI Act actually had overlapping, redundant clauses built into it from the start.
SPEAKER_00Aaron Powell Yes. This is the crucial mechanical detail that gets completely lost in all the public outrage. Yes. Section 44 of the three of the new law amended Section 81J of the RTI Act, but it completely ignored another section right next to it. Which is Section 82 of the RTI Act.
SPEAKER_01Trevor Burrus And what is Section 82?
SPEAKER_00Section 8.2 explicitly states that notwithstanding any exemptions, even the Official Secrets Act, which is huge, a public authority may allow access to information if the public interest in disclosure outweighs the harm to the protected interests.
SPEAKER_01Trevor Burrus, Jr. Wait, wait, wait. The exact same standard public interest outweighing harm is literally still sitting right there in the law.
SPEAKER_00Trevor Burrus It never left. It was duplicated in the original 2005 drafting. The new law simply cleaned up a messy, redundant clause in subsection one that was forcing desk workers to make legal judgments while leaving the core principle in Section 82 completely intact.
SPEAKER_01Wow. That drastically changes the narrative. It completely dismantles the idea that the new law creates a blanket ban on transparency.
SPEAKER_00If we connect this to the bigger picture, there is no blanket ban. What the new law does is shift who makes the decision.
SPEAKER_01Okay, walk me through that. Let's look at the mechanics of how this plays out now.
SPEAKER_00Sure. So an activist files an RTI request for a list of names. The PIO, terrified of privacy fines, denies it under the new strict rules.
SPEAKER_01Which we expect them to do.
SPEAKER_00Right. But the activist isn't stopped there. They appeal. The case moves up the chain to an information commission or eventually to a high court judge.
SPEAKER_01Someone who actually possesses the judicial expertise to weigh these complex fundamental rights.
SPEAKER_00Exactly. The judge applies section 8.2 of the RTI Act. They look at the evidence, they run the proportionality test, and if they decide the public interest in exposing corruption truly outweighs the privacy harm, they issue a court order to release the data.
SPEAKER_01Aaron Powell Okay, but what happens to our terrified bureaucrat? Do they get fined for releasing it now?
SPEAKER_00No, they're completely safe. Releasing data under a direct court order falls under legitimate use, according to Section 7 of the DPDPA.
SPEAKER_01Oh, that's brilliant.
SPEAKER_00Yeah, so the bureaucrat is protected from fines, the vital data is released through proper judicial channels, and the fundamental right to privacy isn't left to the whims of a municipal desk worker. The burden is officially shifted from the bureaucracy to the judiciary.
SPEAKER_01Mechanically, that makes total sense. But okay, let's step into the shoes of the people actually filing these public interest litigations. We're talking about veteran investigative journalists here, right? Like Venkadesh Nayak and Gita Seishu.
SPEAKER_00Right.
SPEAKER_01Their entire argument is that corruption thrives in the dark. They need personal data as a flashlight. So if a journalist is trying to prove that a minister diverted government contracts or welfare funds to their own brother-in-law, or like a list of cronies, how can they possibly prove that without getting their hands on the actual unredacted names on the beneficiary list? Don't they legitimately need that data to do their jobs?
SPEAKER_00It's a highly compelling scenario, it really is. And Navi offers a very structured mechanical counterargument to it. First, we have to separate the official from the public.
SPEAKER_01Okay, how so?
SPEAKER_00When we talk about exposing a corrupt politician or a civil servant, the personal information of the official themselves can absolutely be obtained.
SPEAKER_01Because they work for the public.
SPEAKER_00Exactly. Because they are a government official, their professional actions, their decisions, and related data fall under information made publicly available by virtue of their office. They cannot use the DPDPA as a shield to mask their public duties.
SPEAKER_01Aaron Powell Okay, so the minister's data, their sign-offs, their official actions, that's all fair game. But what about the list of people receiving the money, the actual beneficiaries?
SPEAKER_00Aaron Powell That is where the line is drawn. Imagine a government welfare program with the list of, say, a thousand beneficiaries. Okay. A journalist suspects three of those people are phantom accounts created by a corrupt official to siphon money. If the journalist uses the RTI to demand the entire unredacted list be broadcast to the public, they are violating the fundamental privacy rights of 997 completely innocent, economically vulnerable people just to catch three bad actors.
SPEAKER_01Yikes. Yeah, that's a lot of collateral damage.
SPEAKER_00Navi argues that giving a free license to expose the personal data of everyday citizens based on a mere suspicion of corruption is basically a cure worse than the disease.
SPEAKER_01But the journalist still needs to catch those three bad actors. What is the pathway here? Does the new law just tell them to give up and go home?
SPEAKER_00Not at all. And this is where we have to look at how the DPDPA handles exemptions. The law makes a very strict distinction between a profession-based exemption and a purpose-based exemption.
SPEAKER_01Interesting.
SPEAKER_00Yeah. The New Privacy Act does not grant blanket exemptions based on your job title. You do not get to bypass the fundamental right to privacy just because you hold a press card. Just like doctors or lawyers don't get a blanket pass to mishandle data.
SPEAKER_01Aaron Powell Which makes logical sense. Because if you exempt entire professions, anyone could claim to be a freelance journalist just to scrape data, and the privacy law essentially becomes a sieve.
SPEAKER_00Aaron Powell Exactly. So instead, the DPDPA provides purpose-based exemptions. And one of the most critical is a specific exemption for research. Genuine investigative journalists can use this.
SPEAKER_01Aaron Powell How does that work?
SPEAKER_00Under the research exemption, they can request aggregated, de-identified, or heavily redacted information.
SPEAKER_01Aaron Powell So they get the data, but the specific names are stripped out.
SPEAKER_00Trevor Burrus, Jr. Right. They might get the dates of the transactions, the district codes, the monetary amounts, they analyze the trends, they follow the metadata and say, look, 40% of these government contracts all went to the same tiny PIN code on the exact same day. Oh, okay. They do their research and build their case without making the identities of 997 innocent citizens public.
SPEAKER_01Aaron Powell Okay. But eventually, to publish the front page story, they're going to need those three specific names. I mean, they need the unredacted proof to nail the corrupt official. Trevor Burrus, Jr.
SPEAKER_00And that takes us right back to the courtroom. Once the journalist has built their case using the de-identified data, they go to a judge. They file an affidavit showing the suspicious pattern. They say, Your Honor, the metadata shows massive fraud, and we need the unredacted names behind these three specific transactions to expose it.
SPEAKER_01Aaron Powell And the judge decides.
SPEAKER_00Yes. The judge reviews the evidence privately in camera, agrees that the public interest overwhelmingly justifies exposing those three individuals and issues the order. The corruption is exposed, the journalists get their story, and the 997 innocent citizens never have their privacy violated.
SPEAKER_01That is a phenomenal breakdown of the mechanics. I mean, it really clarifies why Naavi states that the PILs filed by the reporters collective and others deserve to be rejected. He believes they are fundamentally misinterpreting how the law is designed to work.
SPEAKER_00Yeah, they're basically standing at the front door demanding a master key to every room in the house when the law was carefully designed to only provide a lockpick that requires a judge's permission to use.
SPEAKER_01And that fundamental misunderstanding is why he's so critical of the Economic Times article. Because publishing a piece that amplifies the fear of a master key being taken away, without explaining that the lockpick system was intentionally built to protect innocent people, it does a disservice to the public's understanding of their own rights.
SPEAKER_00It really does.
SPEAKER_01Which brings this entire complex legal debate right back home to you, the listener. Because at the end of the day, this deep dive is not just a theoretical spat between high-powered lawyers in Delhi and investigative journalists. It's about your data. Exactly It's about ensuring that just because your name, your home address, or your financial status happens to be sitting on a government server somewhere, it doesn't mean it can be casually exposed to anyone who files a piece of paper asking for it. It protects your crystal glass house with those curtains while still maintaining a rigorous judicially sound avenue to catch actual corruption.
SPEAKER_00It is a beautifully intricate system when it works, but and there is a there's a lingering detail in the source material that really complicates this entire framework. Uh-oh.
SPEAKER_01What is it?
SPEAKER_00This raises an important question. As much as we've talked about protecting data from unwarranted requests, Navi mentions a quote from the Minister of Electronics and Information Technology, Ashwini Vaishnau, that introduces a massive wildcard.
SPEAKER_01Aaron Powell You're talking about the provision regarding section three of the DPDPA.
SPEAKER_00Yes. The minister pointed out that Section 3 provides explicit exemptions for personal data that is, quote, made or cause to be made publicly available by individuals or entities under legal obligations.
SPEAKER_01Cause to be made publicly available. Wow. That is a fascinating and honestly a slightly terrifying legal phrase.
SPEAKER_00It really is.
SPEAKER_01Because it leaves us with an absolutely massive gray area regarding our own agency. Like think back to our metaphor of the glasshouse and the curtains. If the law entirely exempts data that you cause to be made public because of a legal obligation, where is the line drawn on your fundamental rights? Trevor Burrus, Jr.
SPEAKER_00It highlights the ultimate paradox of living in a heavily regulated modern state, doesn't it?
SPEAKER_01It does. Let's play this out. Say you buy a piece of property, you are legally obligated by the government to register that deed. Or you start a business and have to register for a license. Or you get married and have to file a public notice under certain marriage acts. The state mandates that you do this. That mandatory registration automatically causes your personal data to become a public record. Have you, by simply participating in society, inadvertently stripped away your own fundamental right to privacy over that specific data under this very privacy act?
SPEAKER_00It's the ultimate legal catch 22. I mean, the state demands the data be public to function, but the privacy law says it can only protect data you haven't made public.
SPEAKER_01You didn't want to open the curtains. The law forced you to open the curtains, and now the privacy act comes along and says, well, the curtains are already open, so we can't help you. Right. Does that mean data brokers can scrape that government registry and build a profile on you with zero consequences? It is a profound, incredibly complex gray area. And it's almost certainly one the Indian courts will ultimately have to decide in the years to come. It is definitely something to think about the next time you find yourself filling out a mandatory government form.