The Privacy Paradox: Supreme Court’s DPDP-RTI Stance and the Draconian 3-Hour AI Takedown Rule

A Year of Reckoning for Digital Rights and Intermediary Liability

If the first quarter of 2026 is any indicator, the Indian technology and privacy law landscape is undergoing a radical, state-centric metamorphosis. For practicing tech lawyers and constitutional litigators, the writing on the wall is clear: privacy is being weaponized to dilute public transparency, while intermediary safe harbors are being systematically dismantled under the guise of regulating Artificial Intelligence.

Two monumental developments from February 2026 dictate this new reality. First, the Supreme Court’s February 16 decision to refer the challenges against the Digital Personal Data Protection (DPDP) Act’s amendments to the Right to Information (RTI) Act to a larger bench—crucially, without staying the operation of the law. Second, the Ministry of Electronics and Information Technology’s (MeitY) February 10 amendment to the IT Rules, 2021, slashing the takedown window for AI-generated content to a mere three hours.

The DPDP-RTI Collision: Privacy as a Shield for State Secrecy

The Supreme Court’s refusal to stay the DPDP Act’s operation while referring the RTI amendments to a larger bench is a severe blow to transparency advocates and a massive shift for administrative law practitioners.

To understand the gravity, we must look at the statutory mechanics. Section 44(3) of the DPDP Act, 2023, amends Section 8(1)(j) of the RTI Act, 2005. Previously, Section 8(1)(j) exempted personal information from disclosure unless the Public Information Officer (PIO) was satisfied that the larger public interest justified it. It also contained a powerful proviso: information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.

The DPDP Act obliterates this nuance. It enforces a blanket ban on the disclosure of "personal information" under the RTI Act, entirely removing the public interest test. By refusing to stay this provision, the Supreme Court has effectively green-lit a regime where the government can deny almost any RTI request involving a bureaucrat, politician, or tender applicant by simply citing "personal data."

The intersection of the DPDP Act and the RTI Act is no longer a balance of competing rights; it is a statutory override where state opacity triumphs over citizen transparency under the noble banner of data protection.

For lawyers advising clients on public interest litigation, tender disputes, or investigative journalism, the traditional RTI route is now severely compromised. The burden has shifted entirely to the applicant to prove that the requested data does not fall within the expansive definition of "personal data" under Section 2(t) of the DPDP Act.

The 3-Hour AI Takedown: The Death of Meaningful Human Review

While the state shields itself, it has tightened the noose around intermediaries. The February 10 amendment to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 targets "synthetically generated information" (deepfakes, AI-generated audio/video). It reduces the mandatory takedown window upon receiving a grievance from 72 hours to an astonishingly brief 3 hours.

From a practice perspective, this is a compliance nightmare. Maintaining safe harbor immunity under Section 79 of the Information Technology Act, 2000 is the bedrock of any intermediary’s operations in India. A 3-hour window makes human legal review physically impossible, especially outside of business hours.

What does this mean for your tech clients? You must advise them to implement aggressive, automated algorithmic takedown systems. The inevitable result of this rule is a massive chilling effect on free speech. Intermediaries will shoot first and ask questions later, taking down legitimate satire, political commentary, and lawful synthetic media rather than risking their safe harbor status. The law is ostensibly designed to fight deepfakes, but its practical application forces platforms into acting as hyper-vigilant private censors.

Consent and the APAAR Ruling: A Warning Shot for EdTech

While the state navigates its own exemptions, the Supreme Court’s August 3, 2026, direction regarding the APAAR (Automated Permanent Academic Account Registry) scheme demonstrates that the judiciary expects strict DPDP compliance from private players handling state-mandated data.

The Court mandated that APAAR consent forms must include a clear opt-out option, reiterating that the handling of student data remains strictly subject to the DPDP Act. Any disclosure to private entities (like EdTech platforms) is only permissible if explicitly authorized by law and backed by valid consent.

This aligns with the stringent requirements of Section 6 of the DPDP Act. Consent can no longer be buried in Terms of Service. It must be free, specific, informed, unconditional, and unambiguous. For corporate lawyers, this means the era of pre-ticked checkboxes and bundled consent is officially dead. Withdrawal of consent must be as frictionless as providing it. If you have not audited and overhauled your clients' UI/UX for consent acquisition, they are sitting on a regulatory time bomb.

The Road Ahead for Tech Law Practice

We are witnessing a dual-track legal regime. The state is expanding its exemptions (as seen in the RTI amendments and broad state processing powers under the DPDP Act), while imposing impossible algorithmic deadlines on private intermediaries.

Lawyers must pivot their strategies. Intermediary compliance is no longer just about drafting robust grievance redressal policies; it requires advising on the deployment of automated moderation tools and the constitutional risks of over-censorship. Data privacy advisory must move beyond drafting privacy policies to fundamentally altering how businesses collect, store, and eventually delete data (including post-mortem data inheritance and Digi Yatra integrations).

2026 is the year the DPDP Act stops being theoretical. The litigation it spawns will redefine the fundamental right to privacy and free speech in India for a generation.