Supreme Court asks MeitY to investigate PIL to restore or destroy stolen personal data of citizens on foreign servers

A bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and Vipul M Pancholi was hearing a PIL filed by Nitish Kumar, a cyber security consultant. File | Photo credit: The Hindu

The Supreme Court on Tuesday (May 19, 2026) asked the Ministry of Electronics and Information Technology (MeitY) to consider a PIL as a representation seeking a robust mechanism to restore or destroy personal data of Indians allegedly stolen and stored on foreign servers.

A bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and Vipul M Pancholi was hearing a PIL filed by Nitish Kumar, a cyber security consultant.

While the CJI refused to entertain the PIL on the ground that it related to information technology and had almost nothing to do with legal aspects, the CJI asked the petitioner to take his grievances to the government.

The plea sought court intervention to implement the Digital Privacy Act 2023 (DPDP) and mitigate the rise in “digital arrest” and extortion linked to data breaches.

While acknowledging the seriousness of the concerns raised, the CJI-led panel noted that the issues were “highly technical” and required administrative and technological expertise rather than judicial intervention at this stage.

“This matter is highly technical in nature and it seems to us that the effective course of action will be to approach the Ministry of Electronics and IT. Let this plea be filed as a supplementary submission. They will consider it,” the Bench said.

Arguing the case, Mr. Kumar said data stolen by entities in at least five foreign countries is being used as a weapon against Indians.

He highlighted that sensitive information, including fingerprints and personal identifiers, is being used to facilitate transnational crimes such as digital arrests.

The Bench said, “In the absence of an extradition treaty”, the accused cannot be brought before the law. “If we can’t get the data back, we can at least restructure and save it,” the petitioner said.

The request sought to direct the center to restore or destroy stolen personal data from foreign jurisdictions.

He also sought the immediate operationalization of the Digital Privacy Act, 2023 and the formation of a Special Investigation Team (SIT) to monitor data theft investigations.

After allowing the plea, the bench allowed the petitioner to file a petition as a supplementary representation of MeitY.

“The petitioner is reported to have brought the matter to the notice of the Union by way of representation as to how a comprehensive mechanism can be put in place for the future protection of data and for the destruction of such data that has been stolen to prevent its misuse,” it said.

Published – 19 May 2026 13:40 IST