Data security has assumed significant importance in the digitized world due to rising cyber crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space?
Approach · directive: “what are the strengths and weaknesses”
What it asks · Assess the Committee's report and draft Personal Data Protection Bill: its strengths (rights-based, consent, regulator, penalties) and weaknesses (State exemptions, localisation, oversight, autonomy).
It asks 3 things — answer each
- Strengths of the Report in protecting personal data: coverage, rights, enforcement
- Weaknesses of the Report: State exemptions, localisation, oversight, transparency and process
- Your view: a verdict and what should change, with what has happened since
Open with · The Supreme Court held privacy a fundamental right in 2017; the Srikrishna Committee (July 2017) reported in July 2018 with a draft Personal Data Protection Bill aiming at 'a free and fair digital economy', and the Aadhaar judgment of 26 September 2018 commended a 'robust regime for data protection'.
Cover
- Strength, coverage: one law for government and private data fiduciaries, with principles of consent, purpose and collection limitation, data minimisation and transparency, and reach over processing linked to business in India.
- Strength, rights: individuals get access, correction, portability and a limited right to be forgotten; fiduciaries owe a duty of fair and reasonable processing, with privacy by design.
- Strength, enforcement: an independent Data Protection Authority, breach reporting, impact assessments for significant fiduciaries, and penalties of up to ₹15 crore or 4 per cent of global turnover.
- Weakness, State exemptions: wide grounds such as security of the State and public order, without prior judicial approval, weaken protection against the State itself, the largest data holder.
- Weakness, localisation: a mandatory local copy of all personal data and local-only storage of 'critical' data raise costs for firms, and may not improve security; the Centre defines what is critical.
- Weakness, gaps: the proposed change to the RTI Act's personal-information exemption may weaken transparency, and the regulator's independence from the executive was questioned.
- Way forward: tighter checks on State access (necessity, proportionality, oversight), a truly independent regulator, workable localisation rules, and public consultation before the Bill is enacted.
Close with · A data protection law is only as strong as its limits on the State; the Court's standard of 'a careful balance between individual interests and legitimate State concerns' is the test the Srikrishna framework and its 2023 successor must keep meeting.
Add value (verified)
- The Supreme Court's privacy ruling, reproduced in its Aadhaar judgment of 26 September 2018, asked the Union Government to put a robust data protection regime in place, with a careful balance between individual interests and legitimate State concerns.Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar), Writ Petition (Civil) No. 494 of 2012, Supreme Court of India, judgment of 26 September 2018 (reproducing the 2017 privacy ruling) ↗“We commend to the Union Government the need to examine and put into place a robust regime for data protection. The creation of such a regime requires a careful and sensitive balance between individual interests and legitimate concerns of the State.”
- The Digital Personal Data Protection Bill, 2023 was passed by the Rajya Sabha on 8 August 2023; it provides obligations of data fiduciaries, rights and duties of data principals, financial penalties, and complaints to a Data Protection Board.IndiaAI (MeitY): Digital Personal Data Protection Bill passed in Indian parliament (10 August 2023) ↗“The Digital Personal Data Protection Bill, 2023, was passed by the Rajya Sabha on Wednesday, 8th August 2023.”
- Under the 2023 Act an aggrieved data principal may complain against a data fiduciary to the Data Protection Board; processing detrimental to children, including tracking and targeted advertising, is not permitted.IndiaAI (MeitY): Digital Personal Data Protection Bill passed in Indian parliament (10 August 2023) ↗“he/she can complain against the Data Fiduciary to the Data Protection Board in a hassle-free manner. The bill also safeguards the personal data of children as well. It does not permit processing which is detrimental to the well-being of children or involves tracking, behavioural monitoring or targeted advertising.”
Question: UPSC's CS (Main) 2018, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·
Model answer· 373words · Minimalist IAS
The Supreme Court held privacy a fundamental right in 2017; the Justice B.N. Srikrishna Committee (July 2017) reported in July 2018 with a draft Personal Data Protection Bill, seeking 'a free and fair digital economy'. The Aadhaar judgment of 26 September 2018 then commended a 'robust regime for data protection'; the report should be judged against that constitutional brief.
Strengths of the Report in protecting personal data
- Coverage: one law binds government and private data fiduciaries alike, built on consent, purpose and collection limitation, data minimisation and transparency.
- Rights: access, correction, portability and a limited right to be forgotten; fiduciaries owe fair and reasonable processing, with privacy by design.
- Enforcement: an independent Data Protection Authority, breach reporting, impact assessments for significant fiduciaries, and penalties up to Rs 15 crore or 4 per cent of global turnover.
Weaknesses of the Report
- State exemptions: wide grounds such as security of the State and public order, without prior judicial approval, leave the largest data holder least constrained.
- Data localisation: a mandatory local copy of all personal data and local-only storage of 'critical' data raise costs without clearly improving security; the Centre alone defines 'critical'.
- Oversight and transparency: the regulator's independence from the executive was questioned, and the proposed RTI Act amendment on personal information could weaken transparency.
- Process: the final text lacked wide public consultation.
| Issue | Strength | Weakness |
|---|---|---|
| Scope | Binds State and private players | Wide State exemptions |
| Regulator | Independent DPA with penalties | Executive-led selection |
| Data flows | Breach reporting, impact assessments | Costly mandatory localisation |
My view: what should change
- Limit the State: exemptions only on necessity and proportionality, with judicial or parliamentary oversight.
- Independent regulator, workable localisation: a DPA insulated from the executive, and localisation confined to genuinely critical data.
- Since then: Parliament passed the Digital Personal Data Protection Bill (Rajya Sabha, 8 August 2023), which became the Digital Personal Data Protection Act, 2023 on Presidential assent on 11 August 2023, with a Data Protection Board, fiduciary duties, principals' rights and penalties; the debate on State exemptions continues.
A data protection law is only as strong as its limits on the State; the Court's standard, 'a careful balance between individual interests and legitimate State concerns', is the test the Srikrishna framework and its successor must keep meeting.
Prepared by Minimalist IAS to the answer standard of Shivam Singh (mentor, 7 years) · facts checked against official sources (how we verify) · updated 3 Oct 2026. UPSC publishes no model answers: compare your structure and coverage with this, then write your own.
