Alok Kumar is an LL.M. candidate specializing in Constitutional and Administrative Law at Chanakya National Law University, Patna.
Indian federalism scholarship has conventionally focused in three spheres: fiscal federalism (tax devolution, Finance Commission awards, the GST Council), administrative federalism (All-India Services, Article 356, governor’s discretion), and, more recently, “competitive federalism” in the context of investment and ease-of-doing-business rankings. What remains almost entirely absent from this literature is a fourth sphere which is digital federalism, categorically deals with the allocation, in practice if not in constitutional text, of regulatory authority over data, digital infrastructure, and artificial intelligence between the Union and the States.
This gap is logically significant because digital regulation does not fit in the Seventh Schedule as it is not aligned with inherited categories of the said schedule. The Constitution’s three-list (seventh schedule) under Article 246 was designed for an industrial-era division of subjects such as communications, health, land, police, and courts have historically resolved overlaps through doctrines such as pith and substance, as held in State of Bombay v. F.N. Balsara (1951) and the primacy of the Union List under Article 246(1). Data, however, never became a subject that ever got contemplated as belonging to a single List; it is a substrate that runs underneath nearly every List II and List III subject such as health records, land titles, ration databases, police FIRs, school enrolment. This piece of writing argues that the Union has used a narrow textual hook — Entry 31 of List I, covering telecommunications and “other like forms of communication” in tandem with the residuary power under Article 248, to construct an entirely centralised regulatory regime for data, digital governance, and AI, without any Seventh Schedule amendment and largely without any institutionalised bargaining forum for the States.
Assume a revenue official operates a browser and logs into portal for entering the details of a plot of land i.e., its area, details of owner, or any such details. Under the Indian Constitution, both agriculture (Entry 14) and land records management (Entry 45) fall squarely within the State List’s exclusive purview (VII Schedule). Although this official works directly under the state government and receives his salary from State funds, the data he registers flows into a centralized architecture over which his state administration has no say. The underlying database scheme, the underlying server infrastructure, and the operational standards were all mandated without approval from the State Assembly as state has no role in such national digital infrastructure. Ultimately, the entries he logs feed into a nationwide repository, with an irony that it leaves the very department that generated the data in a position where it must seek permission to access its own records. From a formal legal standpoint, no constitutional boundaries have been breached. The courts have not invalidated any statutes, the entries under List II remain untouched, and the core distribution of legislative powers in Article 246 stands exactly as drafted in 1950. Nevertheless, the real power over State matters has quietly drifted away from local authorities—transferred not through legislative acts or constitutional amendments, but through digital design and technical infrastructure.
Silence on the part of constitution
Article 246 in tandem with the Seventh Schedule, the competency of the legislature is exhaustively divided into the Union List (100 subjects), State List (61 subjects, after the 101st Amendment’s GST related deletions), and Concurrent List (52 subjects). The residuary power over subjects not enumerated anywhere vests in Parliament under Article 248 read with Entry 97 of List I, the Supreme Court has read expansively by expanding the power of union even without state concurrence. Digital personal data, artificial intelligence, and “digital public infrastructure” appear nowhere in the Seventh Schedule, because there is lack of revisitation of the seventh schedule and lack the amendment to incorporate the new subjects. Parliament has therefore legislated on these subjects by using the way of pith and substance, as falling within Entry 31 (posts, telegraphs, telephones, wireless, broadcasting, and other like forms of communication) or by relying on the residuary power given to the union.
In Union of India v. H.S. Dhillon (1971), the Supreme Court categorically held that if a subject is not within the State List, Parliament is competent to legislate upon such matter and that Entry 97 may be invoked as an independent source of power without first exhausting Entries 1 to 96. On this reasoning, the Information Technology Act, 2000 and the emerging apparatus of data regulation are traced to the residuary field.
However, the residuary power is meant to be a backstop, not a first port of call. Calcutta Gas Co. v. State of West Bengal (1962) held that every legislative entry should be read broadly as its language allows and it should also have nexus with purposive interpretation, means the state should have more control over the subjects which are more associated with them. Taken seriously, that instruction resolves most “data” disputes long before Entry 97 comes into play. A farmer database is, at bottom, about agriculture — Entry 14 of List II. A land-parcel ID is about land tenure and records — Entries 18 and 45 of List II. A hospital-management system is about public health and hospitals — Entry 6 of List II. A crime-tracking network is about policing — Entry 2 of List II. There is a stronger response to the silence than this, and it is textual rather than inferential. Entry 45 of the Concurrent List covers “Inquiries and statistics for the purposes of any of the matters specified in List II or List III.” The framers did anticipate that governments would need to gather structured information about State subjects they simply chose not to leave that power to inference. They placed it on the Concurrent List, meaning both Parliament and the State legislatures can act, subject to the usual repugnancy rule in Article 254.
Lack of state Autonomy
The Digital Personal Data Protection Act, 2023 (DPDP Act) a Union law (to regulate the governance of digital personal data) and received Presidential assent on 11th August 2023. However, the operative machinery remained dormant till 2025. In 2025, Digital Personal Data Protection Rules, got notified in the official Gazette of India on 13th November 2025, which brought three-stage implementation timeline running to 13th May 2027. Phase I brought into immediate effect the provisions establishing the Data Protection Board of India (DPB) a wholly comprehensive central adjudicatory body with no state-level bench, chapter, or appellate structure and empowered to levy penalties of up to ₹250 crore in the situations of significant data breaches.
Three main parts of the Act show how it impacts federalism.
One set of rules for everyone: The Act treats any organization that collects data as a “data fiduciary,” whether it is a private tech company, a Union ministry, or a local government body. Because of this, a state health department running a public healthcare program (a topic reserved for States under Entry 6 of List II) must follow the exact same Central rules for consent, user notices, and data leak reports as a private company.
Centralized control over disputes: The Data Protection Board (DPB) handles all violations and enforcement across the country. Since the Union government selects all its members and controls its setup under Central Rules, State governments get no say in choosing board members, setting up local branches, or resolving disputes—even when the data leak happens within a State-run portal like land records or public food distribution.
Unequal exemption powers: The Union government holds the exclusive authority to excuse certain government bodies from following these strict data rules for reasons like national security or public order. State governments do not have this power to grant exemptions, meaning the Central executive decides who gets a pass while State departments remain strictly bound by the law.
Shift from cooperative federalism to digital federalism
In a similar vein of central architecture, the e-governance stack consisting of Aadhaar linked authentication, DigiLocker, cloud hosted by NIC (MeghRaj), state e-district portals, and the National Data and Analytics Platform (NDAP) have all been designed and are hosted by central authority, where states act as an implementing or executing users rather than co-formulator of standards. Here comes a contextual analogy between fiscal federalism and digital federalism, as GST council is an apt model of joint decision capacity, where the states hold their two thirds of the vote and has the power to shape or block the central proposals. But in case of stated digital architecture, states are just an onboard as users and emphatically bound by terms of participation which they never negotiated. So, this shows that state has no role, just because of architectural supremacy of central authority, irrespective of the fact that such matters are under the exclusive purview of state list.
The state autonomy is, eroded as centre governs artificial intelligence through a centralized, top-down model that completely sidesteps State governments. Instead of passing a comprehensive AI law through Parliament, a process that would at least allow State representatives in the Rajya Sabha to debate the rules, the Union Government relies almost entirely on Central executive power by using non-binding guidelines alongside updates to existing Central laws, like the IT Act and the DPDP Act, to set mandatory rules for issues like deepfakes and AI safety.
The State List: A Digital Rethink
To categorically show that the union power gets enlarged in the era of digital world (in exclusive matters of state list) due to lack of amendment to the appropriate provisions of the constitution. Some of which are as, Entry 14 of state list deals with agriculture but the national digital architecture like AgriStack, Digital Crop Survey, Farmers ID’s linked to Aadhar, Entry 18 which delas with land, land tenures, landlord-tenant relations are being governed by the Bhulekh portals which is designed by the central authorities, Entry 6 which deals with public health, hospital and dispensaries through Ayushman Bharat digital mission, health ID’s, etc.
The discourse of digital federalism needs an accessible solution which can be done by revisiting of the 7th schedule by inserting express entry on data and information into the list III i.e., concurrent list. Alike GST Council which ensured state participation, a data council must get incorporated which shall have the involvement of both state and centre. Provide for State-level data protection authorities or regional benches within the DPDP framework, and give States a role in appointments to the Data Protection Board. State should assert the autonomy, otherwise without assertion it is difficult to vindicate.
Leave a Reply