SC asks MeitY to review PIL on stolen personal data of citizens
text_fields
New Delhi: The Supreme Court of India on Tuesday directed the Ministry of Electronics and Information Technology (MeitY) to treat a Public Interest Litigation (PIL) as a formal representation seeking a stronger mechanism to recover or destroy stolen personal data of Indian citizens allegedly stored on foreign servers.
A Bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and Vipul M Pancholi was hearing a PIL filed by cyber security consultant Nitish Kumar. The Court declined to entertain the petition on judicial grounds, observing that the issues raised were predominantly technical in nature and fell within the domain of administrative and technological expertise rather than immediate judicial intervention.
Instead, the Bench advised the petitioner to approach the government, specifically MeitY, with his grievances. It ordered that the plea be submitted as a supplementary representation for consideration by the Ministry.
The petition had sought directions for the operationalisation of the Digital Personal Data Protection Act, 2023, along with measures to address the rising incidents of so-called “digital arrests” and extortion linked to data breaches. It also called for the constitution of a Special Investigation Team (SIT) to monitor investigations into data theft.
Kumar argued that stolen personal data, including sensitive identifiers such as fingerprints, is being accessed and used across at least five foreign jurisdictions, allegedly enabling transnational cybercrimes. He submitted that such misuse is increasingly being weaponised against Indian citizens.
The Bench observed that unless extradition treaties exist, bringing offenders to India for prosecution would not be feasible under current legal frameworks. It noted that while the concerns were serious, the appropriate response lay in policy and technical action.
Responding to the Court’s observations, the petitioner stated that even if data cannot be retrieved from abroad, systems should be developed to restructure safeguards and prevent further misuse.
The Court disposed of the PIL, granting liberty to the petitioner to submit it as a detailed representation before the Ministry of Electronics and Information Technology (MeitY). It noted that the issues raised relate to the future protection of personal data and possible destruction of stolen data to prevent its misuse.
With PTI inputs