The Transparency Blackout: Supreme Court Refers DPDP Act to Constitution Bench as Government Dodges AI Regulation

The Collision of Privacy, Transparency, and Tech

India’s technology and privacy regime is currently undergoing its most seismic shift since the Supreme Court recognized the right to privacy in Justice K.S. Puttaswamy v. Union of India. The Digital Personal Data Protection (DPDP) Act, 2023, fully operationalized via the November 2025 Rules, is now facing a dual reality: it is simultaneously the subject of a massive constitutional challenge at the Supreme Court and the government’s chosen crutch for avoiding bespoke Artificial Intelligence (AI) regulation.

This week, a three-judge bench led by Chief Justice Surya Kant, alongside Justices Joymalya Bagchi and Vipul M. Pancholi, referred petitions challenging the constitutional validity of the DPDP Act and the 2025 Rules to a 5-judge Constitution Bench. For practicing lawyers, corporate counsel, and litigators, the implications of these parallel developments are profound. The state is redefining the boundaries of public data, personal privacy, and technological innovation—and it is doing so aggressively.

RTI Act Under Siege: Article 19(1)(a) vs. Article 21

At the heart of the Supreme Court referral is the challenge brought by The Reporters' Collective and journalist Nitin Sethi. Their grievance targets the DPDP Act’s collateral damage: the gutting of the Right to Information (RTI) Act, 2005.

Prior to the DPDP Act, Section 8(1)(j) of the RTI Act provided a nuanced safeguard. Personal information could be withheld, unless a Public Information Officer (PIO) determined that the larger public interest justified its disclosure. It was a balancing test between Article 19(1)(a) (Right to Information) and Article 21 (Right to Privacy).

Section 44(3) of the DPDP Act obliterates this balance. It amends Section 8(1)(j) to create a blanket exemption for any "personal information." No public interest test. No proportionality. If a document contains a bureaucrat's name or an official's personal details, it can be entirely shielded from public scrutiny.

"The regime introduced by Parliament cannot be thwarted at the threshold," the Bench noted, unequivocally refusing an interim stay on the impugned provisions.

The Practitioner’s Takeaway: If you practice administrative law or represent journalists, activists, or civil society, your RTI appeals have just become significantly harder to win. The government has weaponized privacy to build an opaque wall around executive action. Until the 5-judge bench rules, PIOs will use the DPDP Act as an absolute defense against disclosure. You must now pivot your strategy to argue severability—demanding that personal data be redacted under Section 10 of the RTI Act rather than allowing the entire document to be withheld.

The AI Illusion: A Patchwork of DPDP and IP Laws

While the Supreme Court grapples with the DPDP’s impact on transparency, the Ministry of Electronics and Information Technology (MeitY) has made a striking policy declaration: India does not need a separate "AI Act." According to MeitY Secretary S. Krishnan, the government will rely on the existing Intellectual Property (IP) Act (primarily the Copyright Act, 1957, and Patents Act, 1970) working in synergy with the DPDP Act to regulate AI.

This is a dangerous tightrope. The government’s stance suggests that scraping personal data for training Large Language Models (LLMs) will be governed by the consent and legitimate use provisions of the DPDP Act, while scraping proprietary data will be handled by copyright infringement suits.

This approach exposes a fundamental misunderstanding of generative AI. The Copyright Act, 1957, was never designed to address algorithmic text-and-data mining (TDM). Similarly, the DPDP Act regulates "data fiduciaries" and "data principals"—categories that become hopelessly blurred when an AI model hallucinates personal data it ingested years ago.

What this means for IP and Tech Lawyers: You are about to become the de facto regulators of Indian AI. Without a statutory framework like the EU AI Act, the burden falls on private contracts and Terms of Service. If you are advising AI startups, you can no longer rely on vague "fair dealing" defenses under Section 52 of the Copyright Act. You must build robust compliance architectures that simultaneously navigate Section 4 (grounds for processing) of the DPDP Act and copyright licensing regimes. Expect a surge in intellectual property litigation regarding algorithmic scraping in the Delhi High Court over the next 12 months.

The Compliance Crunch: No Stay, No Delay

Perhaps the most immediate news for corporate lawyers is Chief Justice Surya Kant’s refusal to grant an interim stay on the DPDP Act. The 18-month compliance journey, aimed to conclude on May 13, 2027, remains fully in motion. In fact, the Centre is actively considering compressing this timeline for large tech companies, arguing they already adhere to global data norms like the GDPR.

Many corporations have been dragging their feet, hoping the Delhi High Court PILs (such as the one filed by Adv. Chandresh Jain) or the Supreme Court challenges would delay the inevitable.

The bottom line for corporate counsel is brutal: stop waiting.

The penalties under the DPDP Act are draconian—up to ₹250 crore for failure to prevent localized data breaches. The statutory obligations for data fiduciaries are absolute:

• Overhaul all legacy consent notices to meet the "free, specific, informed, unconditional, and unambiguous" threshold (Section 6).
• Establish concrete breach reporting protocols to the Data Protection Board (Section 8).
• Implement mechanisms to honor data subject rights, including the right to erasure (Section 12).

Conclusion

The DPDP Act of 2023 is no longer just a privacy statute; it is the central pillar of India's digital economy, an impenetrable shield against RTI, and the government's makeshift duct tape for AI regulation. As the Constitution Bench prepares to untangle the clash between transparency and privacy, lawyers must navigate a landscape where regulatory enforcement will not wait for judicial clarity. In the intersection of DPDP, IP, and constitutional law, the only certainty is a massive influx of complex, high-stakes litigation.