SC directs MeitY to examine plea on safeguarding Indians’ stolen data

The Supreme Court has asked the government to consider a PIL as a representation seeking a robust mechanism to recover or destroy the personal data of Indians allegedly stolen and stored on foreign servers.

A bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and Vipul M Pancholi was hearing a PIL filed by Nitish Kumar, a cybersecurity consultant, on Tuesday, when it made the request to the Ministry of Electronics and Information Technology (MeitY).

While refusing to entertain the PIL on grounds that it pertained to information technology and hardly anything to do with legal aspects, the CJI asked the petitioner to approach the government with his grievances.

Ball in MeitY’s court

The plea sought the court’s intervention to operationalise the Digital Personal Data Protection (DPDP) Act, 2023, and to mitigate the rise of “digital arrests” and extortion linked to data breaches.

Also read: Activists slam MeitY’s IT Rules consultation with ‘spare’ civil society participation

While acknowledging the gravity of the concerns raised, the CJI-led bench observed that the issues were “highly technical” and required administrative and technological expertise rather than judicial intervention at this stage.

“The issue being highly technical in nature, it seems to us that an effective course will be to approach the Ministry of Electronics and IT. Let this plea be given as a supplementary representation. They shall consider it,” the bench said.

Petitioner’s argument

Kumar, who argued the case, submitted that the data stolen by entities in at least five foreign countries was being weaponised against Indians. He highlighted that sensitive information, including fingerprints and personal identifiers, was being used to facilitate transnational crimes like digital arrests.

Also read: AI Impact Summit: AI will create more jobs than it replaces, says MeitY secretary

The bench said, “Unless there’s an extradition treaty” the accused cannot be brought here to face the law. “If we cannot bring the data back, we can at least restructure and save it,” the petitioner said.

The plea sought a direction to the Centre to recover or destroy stolen personal data from foreign jurisdictions. It also sought immediate operationalisation of the Digital Personal Data Protection Act, 2023 and constitution of a Special Investigation Team (SIT) to monitor data theft investigation.

Plea disposed of

Disposing the plea, the bench granted the petitioner liberty to submit the petition as a supplementary representation to MeitY.

Also read: Centre proposes bringing users posting news content on social media under IT Rules: Report

“The petitioner is said to have brought the matter to the notice of the Union through representations as to how a comprehensive mechanism can be operationalised for the future protection of data and for destruction of such data which has been stolen to prevent misuse,” it said.

(With agency inputs)