WHO WATCHES THE WATCHER? WHY THE GOVERNMENT IS BOTH REGULATOR AND BIGGEST DATA COLLECTOR UNDER THE DPDP ACT

Data protection law is usually imagined as a contest between an individual and a company. The Digital Personal Data Protection Act, 2023 (DPDP Act) does not fit that picture well, because the largest holder of personal data in India is the government. Aadhaar, welfare beneficiary lists, tax filings, land records and city camera networks all sit with the State. The same State drafted the Act, will appoint the body that enforces it, and kept for itself some of the widest exemptions in the statute. Scholars noticed this early. Graham Greenleaf described the Act as business and government friendly and consumer hostile, and thought its treatment of State bodies reads like a blueprint for surveillance that is not clearly unlawful. Vrinda Bhandari and Renuka Sane had made the deeper point about the 2018 Bill: where the State is also the regulator, it holds considerable power over the very entities that are supposed to restrain it. This article picks up that thread. It asks how the State’s different roles under the Act reinforce one another, states the Government’s answers fairly before assessing them, and examines the constitutional challenges now pending in the Supreme Court. My view is that some of the Government’s answers are respectable, but most rest on safeguards the Act does not contain.