Why we must protect journalists’ sources

The Digital News Publishers Association (DNPA) has filed a petition in the Supreme Court challenging the provisions of the Digital Personal Data Protection Act, 2023, and the Rules framed under it. One of the several grounds cited by the DNPA is the disclosure of confidential journalistic sources. This ground is of great value as it strikes at the freedom of the press, which is an essential ingredient of the freedom of speech and expression guaranteed under Article 19(1)(a) of the Constitution.

The provision under scrutiny is Section 36 of the DPDP Act, which states: “The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for”. 

The “Board” refers to the Data Protection Board of India, established under Section 18 of the Act. The Board receives and inquires into complaints and imposes monetary penalties if necessary. Journalists are concerned that every source leaves call records and metadata with telecom companies and platforms. A single requisition to one of them could identify an informant without the journalist ever knowing. 

Section 36 must be read with Section 7. The provision specifies the legitimate uses for which a Data Fiduciary (DF) may process a Data Principal’s (DP) personal data. Section 17 deals with exemptions under the Act. The DNPA argues that Sections 7 and 17 do not recognise an exemption for journalistic and news publishing activity. Therefore, it violates Articles 14, 19(1)(a), 19(1)(g) and 21 and constitutes an unreasonable restriction not enumerated under Article 19(2). The State cannot curtail the fundamental right to freedom of speech and expression on grounds other than those expressly set out under Article 19(2). 

A specific concern emerges from this. Investigative journalism and reporting on matters of public importance would be rendered ineffective if a journalist has to issue notice and explain their purpose of processing personal data, and obtain free, specific, informed, unconditional and unambiguous consent. The DNPA apprehends that such obligations would hamper timely reporting as they impose disproportionate logistical burdens on its member digital news publishers (DNPs): “They would impede the ability of DNPs to report and publish news promptly and adversely affect the timelines, reach and efficacy of digital news content”. 

They argue that the Act violates Article 14 as the state and its instrumentalities are permitted to process personal data in the discharge of statutory functions under Section 7. No similar recognition is provided to journalists and news publishers processing personal data in furtherance of the citizens’ right to know under Article 19(1)(a).

The DNPA has argued that the absence of an exemption for journalistic activity constitutes pre-censorship, which is constitutionally impermissible. Further, persons who are the subjects of critical or investigative reportage may invoke the right to withdraw consent and the right to erasure under Sections 6 and 12. These rights lack any public interest safeguard. Coupled with the hefty penalties (up to Rs 250 crore), these provisions would burden or deter publishers from undertaking or continuing investigative reporting. 

Rule 23 adds a gag. The authorised officer can forbid the recipients from revealing data requests when doing so could prejudice India’s sovereignty and integrity or the security of the State.

The petition argues that such a demand requires neither a written order with reasons nor a judge’s approval. The person whose data is surrendered need not be told. By comparison, interception under the Information Technology Act requires at least an order with reasons recorded in writing.

Precedents

In Goodwin v the United Kingdom (1996), William Goodwin was fined £5,000 for contempt when he refused to reveal his source. Goodwin worked at The Engineer, a British magazine, and received information about a secret plan by a company, Tetra Ltd., to raise a £5 million loan while it expected a loss of £2.1 million that year. Goodwin sought to verify the information with the company and received an injunction preventing publication. The company went beyond and sought to force Goodwin to reveal his source for his unpublished story. The High Court, the Court of Appeal, and the House of Lords directed Goodwin to share his notes from the telephone conversation with the leaker, whom Tetra presumed was an employee. Goodwin refused and was fined for contempt. 

Six years later, the European Court of Human Rights (ECtHR) held that the order violated Goodwin’s freedom of speech and expression. The Court noted: “Without such protection, sources may be deterred from assisting the press in informing the public on matters of public interest”. Because the injunction had, in any case, prevented publication, the Court found that Tetra’s remaining interest in identifying the informant was insufficient to outweigh the “potentially chilling effect” of a disclosure order.

Since then, the ECHR has turned the principle into procedure in three judgements: In Sanoma Uitgevers B.V. v. the Netherlands (2010), it held that a “review by a judge or other independent and impartial decision-making body” must be undertaken before a journalist is compelled to disclose a source. In Telegraaf Media Nederland Landelijke Media B.V. and Others v. the Netherlands (2012), the Court required the same prior review before intelligence agencies could put journalists under surveillance to trace their sources. Big Brother Watch and Others v. the United Kingdom (2021) extended it to bulk interception, requiring independent authorisation for any search term associated with a journalist.

The Supreme Court of India echoed the ECHR’s finding in Goodwin in the Pegasus case where journalists, opposition politicians, and activists alleged that Israeli spyware had compromised their phones. 

On 27 October 2021, a Bench of CJI N.V. Ramana and Justices Surya Kant and Hima Kohli refused to let the Union’s national-security appeal close the matter. It ordered an independent technical inquiry, observing that protecting journalistic sources is “one of the basic conditions for the freedom of the press”. The Order does not cite Goodwin, but the phrasing closely follows it. The Court has, however, not yet laid down any procedural safeguards.

The depositions before the Pegasus Technical Committee made it clear that the targets were mainly investigative journalists, while the Technical Committee report remains sealed, CJI. Ramana had confirmed that five out of the 29 phones submitted to the committee had malware, but this “did not mean that it was Pegasus”. The case is still pending in the Supreme Court, five years after the order. The case was last heard on 29 April 2025. A Bench of Justices Surya Kant and N.K. Singh observed that there was “nothing wrong” with a country possessing spyware for security, and that the real question was against whom it is used. 

A separate petition seeking rules on seizing journalists’ devices, Foundation for Media Professionals v. Union of India (2022), still awaits the guidelines the Court asked the Union to frame in November 2023.

A statute book without a shield

The Bharatiya Sakshya Adhiniyam, 2023 (BSA), which replaced the Indian Evidence Act, 1872 (IEA), protects communications between husband and wife under Section 128; between lawyer and client under Section 132; and evidence concerning the affairs of the State under Section 129. Section 125 of the IEA protects a police officer from being forced to disclose the source of information about an offence, and Section 131 of its successor preserves that immunity. 

Section 15(2) of the Press Council Act, 1978 bars only the Press Council itself from compelling a journalist to name a source. The Telecommunications Act, 2023 provides accredited journalists with only a shallow guarantee against the interception of their press messages. Freelance journalists are entirely outside it. The Law Commission in its 93rd Report (1983) and its 185th Report (2003) advised that courts should be prohibited from compelling journalists to reveal sources of information. Parliament rewrote the evidence law in 2023 without accepting either suggestion.

Without a law to interpret, courts have considered every claim on its own terms. In Jai Parkash Aggarwal v. Vishambhar Dutt Sharma (1986), the Delhi High Court ruled that the press does not have an unconditional privilege and that a court can order disclosure when it serves justice. It reaffirmed that position in Asish Mohapatra v. Slowform Media Pvt. Ltd. (2024), which leaves the conclusion to each judge’s discretion, exercised only after the source has already been put in jeopardy.

How others drew the line

Democracies that safeguard sources well have a clear protocol: before handing anything over, an independent body intervenes between the State and the journalist. In 2012 and 2013, the London police obtained call records of journalists at The Sun on a senior officer’s authorisation, hoping to identify who had leaked a police log detailing a confrontation involving a government minister. In News Group Newspapers Ltd and Others v. Commissioner of Police of the Metropolis (2015), the Investigatory Powers Tribunal held that the regime lacked effective safeguards, since no independent judge stood between the police and the data. Under the Investigatory Powers Act, 2016, such an authorisation now has no effect until a Judicial Commissioner approves it. 

Democracies that protect sources less well have stumbled towards the same ideal on an ad hoc basis, under easily manipulated conditions. Since 2010, France has allowed source secrecy to be breached only when an overriding public-interest imperative requires it. The rule is still being tested, as was true for the journalist Ariane Lavrilleux, who was detained in September 2023 by the French authorities over her article on an intelligence operation in Egypt. An investigating judge dismissed the case in October 2025, but the Paris Court of Appeal reopened it in July 2026. Elsewhere, the European Media Freedom Act requires prior judicial or independent authorisation before anyone can take measures to identify a source. Canada’s 2017 statute requires the party seeking disclosure to prove necessity, and Sweden’s law goes further by banning any public authority from even inquiring into a source’s identity. 

What the Court can do

“Innocent citizens have their rights,” CJI Surya Kant observed at the first hearing, adding that “A balance has to be struck.” That balance appears to change once a source’s identity is recognised as personal data, because revealing a whistleblower to the State then violates the right to privacy that Justice K.S. Puttaswamy (Retd.) v Union of India (2017) located within Article 21. The judgement also mandates safeguards against abuse that Section 36 lacks.

Senior Advocate Madhavi Divan, representing the association, described the case as the first comprehensive challenge by traditional media organisations. A shield reserved for such organisations would repeat the Telecommunications Act’s accreditation test, which protects only correspondents the government has accredited. Even the 1983 Law Commission suggested that protection should also apply to occasional journalists whose sources are as vulnerable as those of a national daily. The protection must attach to news-gathering work, regardless of who does it.

The petition urges the Court to consider the Pegasus order while construing Section 36. Read down, Section 36 could require prior authorisation from a judicial authority, with reasons recorded, before any requisition likely to disclose a journalist’s source, and the gag under Rule 23 could be limited in duration and made subject to review. Such applications can be heard in chambers, just like warrant applications. The Court has done this before in People’s Union for Civil Liberties v Union of India (1996), where it called telephone tapping “a serious invasion of an individual’s privacy” and laid down guidelines to regulate it.

Section 36 will take effect in May 2027, giving the Court the power to decide the issue before the first requisition is made on a telecom company or a platform. The Pegasus order recognised source protection as a fundamental plank of press freedom, while Puttaswamy recognised informational privacy, including a source’s identity, as a facet of Article 21. The law of evidence has been protecting the State’s own informers since 1872. What remains missing is process: no source should be revealed until a court or independent body has heard the matter.