The DPDP Act hits the Constitutional Wall and Delhi HC Drops a 'Fair Dealing' Bombshell on AI

The Honeymoon is Over for India’s Tech Law Regime

If you are advising data fiduciaries or IP holders right now, tear up your standard operating procedures. The Supreme Court of India and the Delhi High Court have just thrown massive curveballs into how we practice technology, privacy, and copyright law. The Digital Personal Data Protection (DPDP) Act, 2023 is facing an existential constitutional crisis at the Supreme Court, while the Delhi High Court has made a prima facie observation on AI training that could entirely rewrite Indian copyright jurisprudence.

For practitioners, the message is clear: the statute books are currently a mere suggestion. The real law is being hammered out in interim orders and constitutional benches right now.

DPDP v. RTI: The Supreme Court’s Limbo

Let’s start with the Supreme Court referring the challenges against the DPDP Act to a larger bench. The crux of the battle lies in Section 44(3) of the DPDP Act, which quietly gutted the Right to Information (RTI) Act, 2005.

Before the DPDP Act, Section 8(1)(j) of the RTI Act allowed the disclosure of personal information if the Public Information Officer (PIO) felt the larger public interest justified it. Section 44(3) of the DPDP Act deleted this public interest caveat, creating a blanket exemption against disclosing any personal data. Petitioners, including the NCPRI and Venkatesh Nayak, rightly argue this violates Articles 14, 19, and 21 of the Constitution by prioritizing an absolute right to privacy over the fundamental right to information.

“The Supreme Court’s refusal to stay the DPDP Act while simultaneously referring its most contentious provisions to a larger bench leaves corporate India and public authorities in a state of perilous limbo.”

What this means for your practice: Do not advise your clients to hit pause on DPDP compliance. The Court expressly refused to stay the Act's operation. However, if you represent public authorities or media houses, prepare for aggressive litigation over the masking and deletion of public records. The friction between a citizen's right to know and a data principal's right to privacy is going to be the most heavily litigated public law issue of the decade.

EdTech Beware: The APAAR Ruling Kills Coerced Consent

While the constitutional bench gears up, the Supreme Court has already begun enforcing the spirit of the DPDP Act in the education sector. In a critical intervention regarding the CBSE’s APAAR (Automated Permanent Academic Account Registry), the Court directed the Centre to include a mandatory opt-out/refuse option for parents, heavily restricting third-party data sharing.

This is a landmark moment for Section 9 (Processing of personal data of children) and Section 12 (Right to withdraw consent) of the DPDP Act. The State and EdTech companies have long relied on "bundled" or "deemed" consent—essentially telling students, "Give us your data or you can't use our platform."

The Supreme Court has effectively outlawed this. By treating the entire APAAR data lifecycle as subject to strict DPDP scrutiny, the Court has signaled that consent architectures must be genuine, granular, and reversible. If you are drafting privacy policies for EdTech clients, you must immediately audit their consent forms. If there isn't a glaring, easy-to-use "Opt-Out" button that doesn't penalize the child's core educational access, your client is a sitting duck for regulatory action.

ANI v. OpenAI: Stretching 'Fair Dealing' to its Breaking Point?

Moving from privacy to intellectual property, the Delhi High Court has dropped a jurisprudential bomb in the ANI v. OpenAI litigation. The Court made a prima facie observation that the storage and ingestion of ANI’s copyrighted literary works for training Large Language Models (LLMs) might fall under the protection of Section 52(1)(a) of the Copyright Act, 1957.

This is a staggering observation. Section 52(1)(a) protects "fair dealing" with any work for the purposes of private or personal use, including research. To suggest that ingesting terabytes of copyrighted news to build a commercial, multi-billion-dollar LLM constitutes "fair dealing" for "research" is a massive judicial leap.

Unlike the US, which has a broad, flexible "Fair Use" doctrine, India’s "Fair Dealing" is an exhaustive, closed list of exceptions. Historically, Indian courts have interpreted Section 52 strictly. If this prima facie view holds during trial, it will single-handedly turn India into a safe haven for AI developers, while completely stripping content creators and news agencies of their leverage to demand licensing fees from tech giants.

“If LLM training is deemed 'fair dealing' under Section 52(1)(a), IP lawyers will need to entirely rethink digital copyright enforcement. The traditional licensing model for digital archives will collapse overnight.”

The Phantom Board

Looming over all of this is the glaring operational void: the Data Protection Board (DPB). Despite being established in law, reports indicate the Board remains severely understaffed and practically non-functional. We have a robust, highly contentious data protection law, but no cop on the beat.

This means the initial interpretation of the DPDP Act isn't coming from regulatory guidelines or DPB adjudications—it is coming straight from the High Courts and the Supreme Court via writ petitions and PILs. For lawyers, this translates to a highly volatile, litigation-heavy environment. Advise your clients to build conservative, highly defensible data and IP architectures today, because when the judicial hammer finally falls, it will fall hard.