Data security has assumed significant importance in the digitized world due to rising cyber crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space? (UPSC 2018)

In a digitised economy, personal data is a valuable asset and a major vulnerability. The Justice B. N. Srikrishna Committee Report is important because it tried to build a privacy law for India after the right to privacy was recognised as a fundamental right.

• Strengths
  • It gives a strong legal base to personal data protection by treating data handlers as fiduciaries, not mere contract parties.
  • It adopts key principles such as consent, purpose limitation, data minimisation, storage limitation and privacy by design.
  • It creates useful rights for individuals, such as correction, portability and right to be forgotten.
  • It proposes an independent Data Protection Authority and meaningful penalties, which can improve compliance.
  • Its graded approach to personal, sensitive and critical data recognises that not all data need the same level of protection.
• Weaknesses
  • It gives the State wide exemptions for national security and public order, with weak external oversight.
  • The proposed regulator is not fully insulated from executive influence, which may reduce trust and independence.
  • The data localisation push may raise costs for firms, affect cross-border business and create more local storage risks.
  • The term critical personal data was left too vague and largely to executive discretion.
  • It did not adequately reform surveillance laws, so protection against state overreach remained incomplete.

Overall, the Report is a landmark attempt to balance privacy, innovation and State needs. However, its strong architecture is weakened by broad exemptions, regulatory dependence and an over-emphasis on localisation. A robust personal data law must protect citizens without creating avoidable surveillance or compliance burdens.