The relationship between the Right to Information (RTI) and privacy represents one of the central tensions in modern democratic governance.
RTI seeks:
Privacy seeks to protect:
Right to Know + Transparency
vs
Right to Privacy + Dignity + Informational Autonomy
Neither RTI nor privacy is an absolute value.
Good governance requires:
Maximum lawful transparency with minimum unnecessary intrusion into personal life.
The Supreme Court's nine-judge Constitution Bench in:
Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)
recognised privacy as a:
Fundamental Right.
Privacy was held to be intrinsic to:
Article 21
and connected with the freedoms protected under Part III of the Constitution. The Court also made clear that privacy is not absolute. :contentReference[oaicite:0]{index=0}
Article 21 ↓ Life + Personal Liberty ↓ Privacy ↓ Dignity + Autonomy + Informational Control
The citizen's right to receive information from public authorities has strong constitutional roots in:
Article 19(1)(a)
The Supreme Court has repeatedly associated freedom of speech and expression with the public's right to know.
RTI → Democratic transparency.
Privacy → Individual liberty and dignity.
Article 19(1)(a) vs Article 21
The Constitution does not require an automatic victory of one right over the other in every case.
Privacy is not limited to:
Physical space or physical secrecy.
It also includes:
Informational privacy.
Informational privacy concerns an individual's ability to exercise control over information about oneself.
Informational Privacy
This is the central statutory provision connecting RTI and personal information.
The current Section 8(1)(j) provides for exemption of:
"information which relates to personal information".
This wording was substituted through Section 44(3) of the Digital Personal Data Protection Act, 2023.
The relevant amendment provision came into force on:
13 November 2025.
India Code records the 13 November 2025 commencement of Section 44(1) and (3) of the DPDP Act. :contentReference[oaicite:1]{index=1}
Older RTI books may still reproduce the pre-2025 wording of Section 8(1)(j).
For a current-law question:
Use the amended statutory wording first.
Before the 2025 amendment, Section 8(1)(j) contained a more detailed framework concerning:
The statutory text before substitution expressly referred to information having no relationship to public activity or interest or causing unwarranted invasion of privacy unless larger public interest justified disclosure. :contentReference[oaicite:2]{index=2}
This older provision is still highly relevant for understanding the historical development of RTI/privacy jurisprudence.
But:
Historical statutory wording ≠ Current statutory wording.
The amendment creates an important current-law distinction.
Personal Information + Public Activity/Public Interest + Privacy + Larger Public Interest
8(1)(j) → Information which relates to personal information.
In a contemporary answer:
Personal information broadly concerns information relating to an identifiable individual.
The fact that information is held by a public authority does not automatically make it public.
Government departments possess large quantities of personal information.
Examples:
Public Authority Custody ≠ Automatic Public Disclosure.
The applicable RTI privacy and other statutory provisions must be examined.
A person does not lose all privacy merely because they hold public office.
Official decision-making → Strong accountability interest.
Personal medical information → Strong privacy interest.
Public employment does not transform every aspect of a person's private life into public information.
Information concerning:
Information concerning:
The closer information is to the exercise of public power, the stronger the potential accountability interest may be.
Privacy must be balanced against legitimate public interest.
Public interest ≠ Automatic disclosure of all personal data.
Is the personal information genuinely necessary to achieve the public accountability objective?
The Supreme Court in Puttaswamy recognised privacy as a fundamental right but expressly held that it is not absolute. Restrictions must satisfy constitutional requirements. The Court described a framework involving:
:contentReference[oaicite:3]{index=3}
Constitutionally Valid Privacy Restriction
The RTI Act itself recognises exemptions.
Section 8 → Exemptions.
Section 9 → Copyright.
Section 24 → Specified organisations.
RTI ≠ Unlimited access to every record.
Both rights have legal boundaries.
Medical information is highly privacy-sensitive.
Government possession does not automatically eliminate medical privacy.
Medical records generally belong closer to the private sphere than ordinary administrative information.
Potentially sensitive information includes:
Personal financial privacy vs Public accountability.
Where personal financial information is directly connected to suspected corruption or misuse of public office, public-interest considerations may become relevant, subject to current law.
Government employee records can contain:
Earlier Supreme Court jurisprudence under the former Section 8(1)(j) treated several categories of service and financial information as personal information. This historical jurisprudence remains important, but the statutory wording has since changed. :contentReference[oaicite:4]{index=4}
Public employment ≠ Complete waiver of privacy.
In:
Girish Ramchandra Deshpande v. Central Information Commission
the Supreme Court considered service-related and personal financial information under the then-existing Section 8(1)(j) framework.
The case is important for understanding the earlier judicial approach to:
Do not reproduce the old statutory Section 8(1)(j) wording as the current law.
Third-party personal information can trigger:
Section 11
in addition to the substantive exemption framework.
Citizen requests another person's:
Section 8(1)(j) + Section 11 + Other applicable provisions.
Section 8(1)(j) → Substantive privacy exemption.
Section 11 → Third-party consultation procedure.
Section 11 requires procedural participation in specified cases.
Request ↓ Third-party information identified ↓ Notice ↓ Representation ↓ PIO Decision
Third-party objection ≠ Automatic refusal.
The PIO remains the statutory decision-maker.
Where Section 11 applies:
PIO → Notice to third party.
Third party → Opportunity to make representation.
PIO → Final decision from receipt of RTI request.
5 → Notice
10 → Representation
40 → Decision
Section 10 can help reconcile privacy with transparency.
Government report:
Personal identifiers → Protect.
Aggregate public expenditure → Disclose.
Sensitive Information → Redact.
Non-Sensitive Information → Disclose.
Privacy does not necessarily require withholding an entire record.
Anonymisation can allow disclosure without identifying individuals.
Welfare database:
Individual names → Protect.
District-wise beneficiary numbers → Disclose.
Privacy-Preserving Transparency.
Data minimisation means:
Disclose only the amount of personal information necessary for the legitimate objective.
To show that a welfare programme reached 10,000 people:
Need: → Aggregate figure.
May not need: → Individual phone numbers or bank details.
Better Disclosure.
Digital records increase privacy risks because disclosed information can be:
Physical disclosure → Limited dissemination.
Digital publication → Potentially unlimited redistribution.
Digital governance increases both transparency potential and privacy risk.
The relationship between RTI and data protection has become more important after the 2025 amendment to Section 8(1)(j).
The DPDP Act creates a separate framework for processing digital personal data, while the RTI Act governs access to information held by public authorities.
These are connected but distinct legal frameworks.
As of now, not all DPDP provisions came into force simultaneously. The commencement notification brought Section 44(1) and (3) into force on 13 November 2025, while several operational provisions are scheduled for later commencement. :contentReference[oaicite:5]{index=5}
Citizen → Seeks information from public authority.
Individual → Seeks protection/governance of personal data.
Citizen's Right to Know vs Individual's Personal-Data Protection.
Privacy should not become a blanket shield for corruption.
Private health information → Strong privacy.
Information directly demonstrating misuse of public office → Stronger accountability interest.
The relevance and necessity of information to the public accountability objective matter.
Public expenditure can create a transparency interest.
A government employee receives an official allowance.
Potentially relevant: → Amount and official entitlement.
Not automatically necessary: → Unrelated private family/medical information.
Disclose what is necessary to scrutinise public expenditure.
A public official occupies a dual position:
RTI should focus accountability on the exercise of public power rather than unnecessary exposure of private life.
Information involving corruption can create strong public-interest considerations.
A public contract + Suspected financial irregularity + Public funds
→ Strong accountability interest.
But:
Personal information unrelated to the suspected wrongdoing → May remain protected.
Nexus + Necessity + Public Interest.
Some personal information may become relevant to public health.
Disclose:
Protect:
Environmental information can have significant public value.
Where possible:
Environmental Accountability + Privacy Protection.
Government welfare databases often contain sensitive information.
Aggregate + Anonymise + Audit.
Government systems may process:
Public transparency must not become uncontrolled mass disclosure of identity data.
Children may have heightened vulnerability to disclosure.
Information involving children should be handled with strong privacy sensitivity.
Disability information can be highly personal.
Publish:
Avoid unnecessary:
Employee privacy concerns may include:
May include:
Separate:
Official Capacity from Private Life.
Some records combine:
Private contractor's proposal.
Possible provisions:
One document may require multiple layers of legal analysis.
Third-party documents can contain:
Section 8(1)(j) + Section 9 + Section 11 + Section 10.
Privacy, copyright and RTI are distinct legal questions.
Some records may involve both:
8(1)(a) + 8(1)(g) + 8(1)(j) + Section 10.
Different exemptions can apply to different parts of the same record.
Section 4 requires proactive disclosure but remains subject to RTI exemptions.
Proactive Disclosure + Privacy-by-Design.
Publish:
Protect where necessary:
Before placing information online, public authorities should assess:
Online publication has a much wider dissemination effect than controlled physical access.
AI systems can analyse and infer sensitive personal information.
Publishing large datasets can unintentionally enable inference about individuals even after direct identifiers are removed.
Anonymisation must consider not only direct identifiers but also re-identification risks.
Open data can improve:
But open datasets can create:
Open by default ≠ Personal-data open by default.
A privacy-based RTI refusal can be challenged before the Information Commission.
The Commission is part of the statutory review structure.
Constitutional courts can review privacy-related RTI disputes.
Article 19(1)(a) → Right to Know.
Article 21 → Privacy.
A strong analysis should ask:
Public Benefit + Necessity + Proportionality vs Privacy Harm.
Major challenges include:
Develop coherent administrative practices across:
Disclose only what is necessary.
Redact sensitive personal details.
Publish aggregate information wherever possible.
Build privacy safeguards into government information systems.
Training should cover:
Develop consistent approaches to privacy-related disputes.
Protect:
Article 19(1)(a) → Right to Know.
Article 21 → Privacy.
Section 8(1)(j) → Current personal-information exemption.
Section 10 → Severability.
Section 11 → Third-party procedure.
Section 4 → Proactive disclosure subject to exemptions.
DPDP framework → Personal-data governance.
PIO ↓ FAA ↓ Information Commission ↓ Judicial Review where appropriate.
Modern RTI-Privacy Governance.
Privacy is not a fundamental right because it is not expressly named in Article 21.
❌ Wrong.
The Supreme Court recognises privacy as a fundamental right under Article 21.
Privacy is an absolute right.
❌ Wrong.
The Supreme Court has held that privacy is not absolute. :contentReference[oaicite:8]{index=8}
Every government-held personal record must be disclosed under RTI.
❌ Wrong.
Government possession does not automatically eliminate privacy protection.
Government employees have no privacy rights.
❌ Wrong.
Public employment does not eliminate private-life protections.
Section 11 is the personal-information exemption.
❌ Wrong.
Section 11 is primarily a third-party consultation mechanism.
Third-party objection automatically prevents disclosure.
❌ Wrong.
The PIO remains the decision-maker under the statutory framework.
Section 8(1)(j) still contains the old pre-2025 wording.
❌ Wrong under current law.
The provision was substituted and the new wording came into force on 13 November 2025.
The entire DPDP Act came into force on 13 November 2025.
❌ Wrong.
Its provisions have staggered commencement dates. :contentReference[oaicite:9]{index=9}
Public interest always defeats privacy.
❌ Wrong.
Privacy is a constitutional interest and current statutory rules must be applied.
Privacy always defeats transparency.
❌ Wrong.
Public accountability and other lawful interests may require disclosure depending on the applicable framework.
Removing a person's name always makes data anonymous.
❌ Wrong.
Other data points can permit re-identification.
Digital publication has the same privacy impact as physical inspection.
❌ Wrong.
Digital publication can enable large-scale copying, indexing and linkage.
The relationship between RTI and privacy reflects a fundamental tension in democratic governance: citizens require information to hold public authorities accountable, while individuals require protection from unnecessary intrusion into their personal lives. The Supreme Court has recognised privacy as a fundamental right under Article 21, while the RTI framework contains statutory protections for personal information.
The DPDP Act, 2023 substituted Section 8(1)(j), with the amendment provision coming into force on 13 November 2025. Therefore, older judicial and coaching formulations must be distinguished from the current statutory text.
RTI and privacy should not be viewed as mutually exclusive rights. The governance objective is maximum lawful transparency without unnecessary intrusion into personal life. In the digital era, this requires combining constitutional privacy, RTI law, responsible data governance and privacy-preserving technology.
