SC declines PIL on foreign-held Indian data, directs petitioner to MeitY

The Supreme Court of India asked MeitY to treat a PIL on stolen personal data as a representation, saying the issue was highly technical. The plea sought implementation of the DPDP Act, destruction of leaked data on foreign servers, and stronger safeguards against cybercrime

New Delhi: The Supreme Court on Tuesday asked the Ministry of Electronics and Information Technology (MeitY) to consider a PIL as a representation seeking a robust mechanism to recover or destroy the personal data of Indians allegedly stolen and stored on foreign servers. A bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and Vipul M Pancholi was hearing a PIL filed by Nitish Kumar, a cybersecurity consultant.

While refusing to entertain the PIL on grounds that it pertained to information technology and had hardly anything to do with legal aspects, the CJI asked the petitioner to approach the government with his grievances. The plea sought the court’s intervention to operationalise the Digital Personal Data Protection (DPDP) Act, 2023, and to mitigate the rise of “digital arrests” and extortion linked to data breaches.

---

While acknowledging the gravity of the concerns raised, the CJI-led bench observed that the issues were “highly technical” and required administrative and technological expertise rather than judicial intervention at this stage.

“The issue being highly technical in nature, it seems to us that an effective course will be to approach the Ministry of Electronics and IT. Let this plea be given as a supplementary representation. They shall consider it,” the bench said.

Kumar, who argued the case, submitted that the data stolen by entities in at least five foreign countries is being weaponised against Indians. He highlighted that sensitive information, including fingerprints and personal identifiers, is being used to facilitate transnational crimes like digital arrests.

The bench said “Unless there’s an extradition treaty” the accused cannot be brought here to face the law.
“If we cannot bring the data back, we can at least restructure and save it,” the petitioner said. The plea sought a direction to the Centre to recover or destroy stolen personal data from foreign jurisdictions.

It also sought immediate operationalisation of the Digital Personal Data Protection Act, 2023 and constitution of a Special Investigation Team (SIT) to monitor data theft investigation. Disposing the plea, the bench granted the petitioner liberty to submit the petition as a supplementary representation to MeitY.

“The petitioner is said to have brought the matter to the notice of the Union through representations as to how a comprehensive mechanism can be operationalised for the future protection of data and for destruction of such data which has been stolen to prevent misuse,” it said.