In Homer’s epic Odyssey, the sacred tenet of Xenia (Zeus’s Law) is given divergent interpretations. Penelope suffers silently, abiding by its customs to shelter and feed suitors in the absence of her husband Odysseus. Meanwhile, the cyclops Polyphemus violently flouts the code by devouring Odysseus’s crew. This subjective application of a foundational rule carries profound consequences for all involved.
India today is witnessing a comparable struggle over a statutory interpretation surrounding the Digital Personal Data Protection (DPDP) Act of 2023. It is uncommon for a statute to face rigorous constitutional scrutiny before its operational enforcement.
Yet, recent developments have thrust the DPDP Act into a critical intersection between the Right to Information (RTI) Act of 2005 and state law-enforcement practices.
Two flashpoints—the deployment of facial recognition technology at Jantar Mantar and legislative amendments to Section 8(1)(j) of the RTI Act—have highlighted the challenge of balancing individual privacy rights with state obligations and civic transparency.
The deployment of advanced surveillance systems at the Jantar Mantar protest site of students has re-ignited the debate over the reasonable expectation of privacy in public spaces.
The Delhi Police deployed Mobile Command and Control Vehicles alongside Ikshana, an AI-enabled surveillance van equipped with 360-degree cameras and automated facial recognition capabilities linked to criminal databases.
Law enforcement authorities maintain that such tools are indispensable to ensuring public order, deterrence and real-time identification of known offenders.
This practice has been challenged through a public interest litigation (PIL) in the Delhi high court. The petition contends that filming citizens during routine activities such as resting, eating or receiving medical aid amounts to “continuous, indiscriminate and intrusive mass surveillance.”
Petitioners argue this creates an unconstitutional chilling effect on the fundamental rights to peaceful assembly and free expression (Article 19), as well as the right to privacy and personal dignity (Article 21) under which India’s DPDP Act was instituted.
Section 17(1) of the DPDP Act explicitly exempts government agencies from key data processing restrictions when preventing, detecting, investigating or prosecuting legal offences. However, state surveillance is bound by a three-pronged standard established in the Justice K.S. Puttaswamy (Retd.) vs Union of India (2017) judgement.
The first test is legality: state action must be backed by an existing and clear legislative framework. Second, legitimate aim: the action must serve a genuine public interest or national security objective. Third, proportionality: the nature and extent of the intrusion must be proportional to the objective, so it can be done only if less intrusive means are unavailable.
RTI and personal information on public officials: A parallel shift has taken place regarding the disclosure of public officials’ data. Historically, Section 8(1)(j) of the RTI Act exempted personal information from mandatory disclosure, unless a public information officer (PIO) or appellate body determined that the “larger public interest” justified its release.
This mechanism was reinforced by the Supreme Court in CPIO, Supreme Court of India vs Subhash Chandra Agarwal (2019). In determining whether the asset declarations of judges could be disclosed under the RTI Act, it held that these constitute personal information, requiring a “careful balancing procedure” under Section 8(1)(j) to weigh public accountability against individual privacy.
The DPDP Act significantly amends this balance by deleting the “larger public interest” exception and its accompanying legislative proviso from Section 8(1)(j). By establishing an absolute exemption for personal data, the amendment removes the discretionary balancing test articulated in the Subhash Chandra Agarwal case, insulating personal records from disclosure under RTI.
Navigating the strait—privacy revisited: Like Odysseus navigating the perils between Scylla and Charybdis, modern data privacy governance requires steering between unchecked surveillance on one side and administrative opacity on the other. Finding an equilibrium needn’t be a zero-sum game.
Surveillance guardrails: International benchmarks such as the EU General Data Protection Regulation (GDPR) illustrate that public-space monitoring can coexist with privacy through strict guardrails, including data minimization, retention timelines and independent audit logs.
Harmonize public and personal information: While the amended Section 8(1)(j) shields public servants from bad-faith harassment or arbitrary doxing, administrative jurisprudence (or possible amendment) can still delineate between purely personal data and official records (such as public procurement, tenders and institutional decisions) to preserve civic transparency by relying on the established principle of “diminished expectation of privacy.”
Odysseus’s ‘homecoming’ was fraught with challenges, but these made him a better man. The ongoing constitutional challenges before the judiciary will serve as critical stress tests. Through judicial refinement and the framing of delegated rules, the DPDP Act may achieve a calibrated balance between technological utility, democratic transparency and fundamental privacy rights, all before it finally arrives home next year.
The author is an independent privacy lawyer.