Delhi HC notice to Centre on plea challenging Digital Data Protection Act provisions

In his petition, Jain said Section 17 gives the Centre sweeping powers to exempt itself and its agencies from provisions of the Act, arguing that such unfettered executive discretion violates the right to privacy

The Delhi high court on Wednesday issued notice to the Centre, seeking its response on a petition challenging several provisions of the Digital Personal Data Protection Act (Act) and its Rules, including those concerning the constitution of the Data Protection Board and a clause empowering the Centre to exempt its own agencies from privacy safeguards, asserting that they establish an adjudicatory framework dependent on the executive.

The manner in which these provisions are framed, the petition said, fails to create a right protective privacy framework consistent with the right to equality, personal liberty and instead creates a framework for unchecked executive power and surveillance. (Representational image)

A bench of chief justice DK Upadhyaya and justice Tejas Karia sought the Centre’s response on a petition filed by a man named Dr Chandresh Jain, challenging sections 17 to 21, 23, 29, 33, 34, 36, 37 and 44 of the Act, along with the rules. The Act was enacted by Parliament in August 2023, but only came into operation after the Centre notified the rules in November last year.

Section 17 empowers the central government to exempt certain data fiduciaries, including its own agencies, from provisions of the Act on grounds such as sovereignty, security of the State, and public order. Sections 18 to 21 deal with the establishment and functioning of the Data Protection Board.

Sections 23 and 29 provide for mediation mechanisms and appeals against the Board’s orders before the Telecom Disputes and Appellate Tribunal (TDSAT). Sections 33 to 37 concern the imposition of monetary penalties for non-compliance, while Section 44 authorises the central government to frame rules to implement the Act.

In his petition, Jain asserted that Section 17 grants the Centre sweeping, unbounded and unguided power to exempt itself, its departments and any of its instrumentalities from any or all the provisions of the act and this conferral of unfettered discretion upon the executive to exempt itself from privacy obligations violates the essential requirement of the right to privacy.

Jain, in his petition, further said that the provisions governing the establishment and functioning of the Data Protection Board, read with Section 23 vests adjudicatory and penalty imposing powers in a body whose composition, tenure, service conditions and procedural framework are determined by the executive through delegated rules.

Section 29, by prescribing TDSAT as the appellate forum, the petition said, violates the settled provisions of law that high courts remain the primary forum of judicial review over all tribunals and Section 33-34 permits executive-controlled adjudicators to impose enormous financial penalties carrying severe civil and economic consequences.

“The cumulative effect of the provisions is the creation of an enforcement and adjudication system that is structurally dominated by the executive, substantively vague, procedurally deficient, disproportionately restrictive of fundamental rights and constitutionally incompatible with the requirements of fairness, reasonableness, transparency and judicial independence,” the petition stated.

The manner in which these provisions are framed, the petition said, fails to create a right protective privacy framework consistent with the right to equality, personal liberty and instead creates a framework for unchecked executive power and surveillance.

The matter would be next heard on April 15.