SC asks MeitY to examine PIL seeking recovery or destruction of stolen personal data of citizens
The Supreme Court of India directed the Ministry of Electronics and Information Technology (MeitY) to examine a PIL by cybersecurity consultant Nitish Kumar seeking a mechanism to recover or destroy stolen personal data of Indian citizens stored on foreign servers. The court dismissed the plea for judicial intervention, citing the technical nature of the issue, and urged Kumar to submit the petition as a supplementary representation to MeitY for administrative action under the Digital Personal Data Protection (DPDP) Act, 2023." "article": "The Supreme Court of India on May 19, 2026, asked the Ministry of Electronics and Information Technology (MeitY) to review a public interest litigation (PIL) filed by cybersecurity consultant Nitish Kumar. The plea sought a robust mechanism to recover or destroy stolen personal data of Indian citizens allegedly stored on foreign servers, citing concerns over transnational crimes enabled by data breaches. The court, led by Chief Justice Surya Kant, refused to entertain the PIL on grounds that it involved technical and administrative issues beyond judicial purview. The bench observed that the Digital Personal Data Protection (DPDP) Act, 2023, required operationalization, but the matter was better suited for MeitY’s expertise. Kumar argued that stolen data, including fingerprints and personal identifiers, was being weaponized for extortion and digital arrests across at least five foreign countries. The court acknowledged the gravity of the concerns but emphasized that without extradition treaties, legal action against foreign entities was limited. It directed Kumar to submit the petition as a supplementary representation to MeitY, urging the ministry to establish a mechanism for data protection and destruction. The plea also called for the formation of a Special Investigation Team (SIT) to monitor data theft investigations. Kumar’s submission highlighted the urgent need for administrative measures to prevent misuse of stolen data, including restructuring or destroying compromised information. The court’s decision underscored the technical complexity of the issue, leaving enforcement to MeitY’s discretion under the DPDP Act framework.
The Supreme Court of India on May 19, 2026, asked the Ministry of Electronics and Information Technology (MeitY) to review a public interest litigation (PIL) filed by cybersecurity consultant Nitish Kumar. The plea sought a robust mechanism to recover or destroy stolen personal data of Indian citizens allegedly stored on foreign servers, citing concerns over transnational crimes enabled by data breaches. The court, led by Chief Justice Surya Kant, refused to entertain the PIL on grounds that it involved technical and administrative issues beyond judicial purview. The bench observed that the Digital Personal Data Protection (DPDP) Act, 2023, required operationalization, but the matter was better suited for MeitY’s expertise. Kumar argued that stolen data, including fingerprints and personal identifiers, was being weaponized for extortion and digital arrests across at least five foreign countries. The court acknowledged the gravity of the concerns but emphasized that without extradition treaties, legal action against foreign entities was limited. It directed Kumar to submit the petition as a supplementary representation to MeitY, urging the ministry to establish a mechanism for data protection and destruction. The plea also called for the formation of a Special Investigation Team (SIT) to monitor data theft investigations. Kumar’s submission highlighted the urgent need for administrative measures to prevent misuse of stolen data, including restructuring or destroying compromised information. The court’s decision underscored the technical complexity of the issue, leaving enforcement to MeitY’s discretion under the DPDP Act framework.
This content was automatically generated and/or translated by AI. It may contain inaccuracies. Please refer to the original sources for verification.