In a surprising, though not wholly unexpected, turn of events, a group of 21 publishers challenged the Digital Personal Data Protection Act, or the DPDPA, in court. Their primary contention is that the law does not exempt entities undertaking journalistic activities from obtaining individuals’ consent before using their personal information for a story.
This puts journalists in an absurd position: they would have to seek permission from the very people they are trying to investigate. Consider a news publisher looking into allegations of financial fraud. Under this framework, the publisher could be required to obtain consent from the person under investigation before examining their financial records. Few people would willingly consent to an investigation that could expose their own wrongdoing. In effect, the DPDPA makes investigative journalism all but impossible.
However, the problems with the DPDPA extend well beyond the trammels it places on journalistic freedom. As an omnibus law, the DPDPA affects not only news publishers and journalists, but also other businesses across various sectors. Its obligations impose high costs on these businesses, potentially resulting in a massive economic blunder for India.
The costs associated with the DPDPA’s obligations can be divided into two categories. The first is the cost of compliance—the resources and systems needed to meet its requirements. This broadly includes mapping where personal information is collected, stored and shared, implementing notice and consent requirements, and introducing systems to enable correction and erasure of data.
A perusal of first-year compliance-cost estimates from companies devoted to facilitating compliance with the DPDPA indicates that these costs range from Rs 10 lakh to Rs 1.5 crore for start-ups or Small and Medium-sized Enterprises (SME), Rs 35 lakh to Rs 2.5 crore for a mid-sized company, and Rs 1.5 crore to Rs 18 crore for a large business.
There is no nationwide figure for the average first-year turnover of a start-up or MSME. However, a survey of 330 firms in Shivamogga, Karnataka, revealed that their average first-year revenue was approximately Rs 12.2 lakh. To put this in perspective, even the lowest estimated compliance cost of Rs 10 lakh would amount to more than 80 per cent of the average first-year revenue reported in this survey.
The second is the opportunity costs associated with diverting resources toward compliance and away from innovation and restricting routine business activities. Teams that may ordinarily be developing new products or improving existing ones will instead have to spend time building systems for compliance. For young companies with limited resources, this means less scope for innovation and qualitative product improvements or development.
Also read: Punjab’s tree protection law has a 35 cm loophole
Wider structural flaws
The opportunity costs emanating from restrictions on routine business activities across sectors bring us back to the controversy over the absence of an exemption from consent for journalists. Such exemptions are a standard feature of privacy laws and typically extend to legitimate business activities such as marketing. Without them, routine operations become unnecessarily onerous for both businesses and consumers.
Imagine a scenario where a business you regularly buy products from has to seek your consent merely to showcase a new offering. Not only would you be fatigued and irritated by repeated requests for consent, but the business would also find it difficult to showcase and create awareness about its products.
Unfortunately, the DPDPA provides no exemption from consent for such activities, which not only creates challenges for businesses looking to market new products to existing customers, but also creates a problematic catch—22 for those attempting to acquire new ones. A business cannot reach out to a prospective customer without processing some personal data, such as their phone number or email address.
However, under the DPDPA, it cannot use that information for marketing without first obtaining consent. Consequently, the DPDPA would have the likely effect of wiping out D2C online marketing, making it harder, for smaller firms in particular, to grow and generate revenue.
Defending this law would be easier if it addressed state surveillance, which is the primary privacy threat citizens worry about. But the DPDPA encompasses wide-ranging exemptions for law enforcement, and gives the government leave to introduce exemptions for other government agencies as well. The DPDPA also empowers the government to issue a notification exempting Micro, Small, and Medium Enterprises (MSMEs) and start-ups from serving consent notices. However, it is unclear whether this exemption saves them from the opportunity costs arising from the lack of exemptions to consent.
These are just some of the questions Parliament should have asked when the law was tabled in 2023. Although an earlier draft was released for public consultation in 2022, the revised version introduced in Parliament was not subjected to another round of public scrutiny.
The petition filed by news publishers therefore presents a critical opportunity to revisit the DPDPA’s wider structural flaws. The absence of consent exemptions under the DPDPA is not merely a problem for journalists – its consequences extend across the economy, imposing substantial costs on businesses and constraining their ability to innovate, acquire customers and grow. The petition should therefore serve as a starting point for a wider reconsideration of the DPDPA’s economic implications.
Meghna Bal is an Advisor at Koan Advisory and Director of the Esya Centre. Shweta Venkatesan is a Fellow at the Esya Centre. Views are personal.
This article is part of ThePrint-Koan Advisory series that analyses emerging policies, laws and regulations in India’s technology sector. Read all the articles here.
(Edited by Saptak Datta)