Maarg Manthan · Topic 14.27

Contemporary Debates: Big Data and Privacy, Cybercrime and Security

Science & Technology › IT, Telecommunications and Computers · Topic 14.27

Big data, privacy, cybercrime and security form one of the main debates of the digital age. Big data means very large and varied data sets, described by volume, velocity and variety, that are analysed to find patterns and used in advertising, welfare, health and policing. The same data raises concerns about privacy, profiling and surveillance. In August 2017 a nine judge bench of the Supreme Court in K S Puttaswamy versus Union of India held that privacy is a fundamental right under Article 21. India then passed the Digital Personal Data Protection Act, 2023. Cybercrime, such as phishing, online fraud, ransomware, identity theft and deepfakes, is rising, and the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, the Indian Cyber Crime Coordination Centre and the 1930 helpline form the response.

5 min read · UPSC Prelims · Science & Technology · IT, Telecommunications and Computers

At a Glance

Privacy ruling Puttaswamy, August 2017
Data law DPDP Act, 2023
Cybercrime helpline 1930
Portal cybercrime.gov.in
Core tension Security versus privacy
Exam link UPSC Prelims, Science & Technology: IT, Telecommunications and Computers

Where Does It Fit?

This topic follows the account of E-Kranti. As government services and payments move online, it covers the rights and risks that come with data and the legal and institutional response in India. Previous topic: Code for India and E-Kranti Initiative. Next topic: Spectrum Policy and Mobile Spectrum Management in India.

What Are the Main Issues in Big Data and Privacy?

Issue	Details
Big data features	Volume, velocity and variety, often with veracity and value added. Sources include phones, sensors, social media and transactions
Uses	Targeted welfare, disease tracking, traffic management, credit scoring, advertising and crime prediction
Right to privacy	Puttaswamy (August 2017): privacy is intrinsic to life and liberty under Article 21 and part of Part III, with tests of legality, necessity and proportionality
DPDP Act, 2023	Gives rights to data principals and duties to data fiduciaries, requires consent, sets up a Data Protection Board, and allows penalties. Rules were notified later in stages
Concerns	Profiling, discrimination, surveillance, data breaches and consent that is not informed
Data localisation	Debate about storing data inside the country for security and law enforcement versus costs and free flow
Exemptions	The 2023 Act lets the Government exempt agencies for security, which critics say is too wide

What Are the Main Forms of Cybercrime and Responses?

Phishing and vishing: fake messages or calls that trick a person into giving passwords or one-time passwords
Financial fraud: UPI and card fraud, fake loan apps, investment scams and digital arrest scams
Ransomware: malware that locks data and demands payment, as in Ransomware Threats
Identity theft: misuse of personal details to open accounts or take loans
Cyberbullying and stalking: online harassment, which is punishable under the criminal law
Deepfakes: AI made fake audio or video used for fraud and defamation
Legal base: the Information Technology Act, 2000 with sections such as 66C, 66D and 67, and the Bharatiya Nyaya Sanhita, 2023, as in Cyber Law in India
Institutions: CERT-In, the Indian Cyber Crime Coordination Centre, the National Cyber Crime Reporting Portal and the 1930 helpline, with state cyber police stations

What Else Should You Remember?

Data fiduciary and principal: the entity that decides how data is used and the person whom the data is about
Consent managers: registered entities that help people to give and withdraw consent
Children’s data: the Act requires verifiable parental consent for children below 18 and bars tracking and targeted ads aimed at children
Right to be forgotten: the Act gives a right to correction and erasure of data
Penalties: the Act provides large penalties for breaches, with a maximum penalty of up to Rs 250 crore for failure to keep security safeguards
Earlier attempts: the Srikrishna Committee report of 2018 and a bill withdrawn in 2022
Aadhaar and privacy: the Aadhaar judgment of 2018 is covered in Biometrics and Virtual Reality
Social media rules: the IT Rules, 2021 set duties for intermediaries, including grievance officers
Right to information tension: the DPDP Act changed Section 8(1)(j) of the RTI Act, which raised concerns about transparency
CERT-In directions, 2022: six hour reporting of incidents
International models: the European Union General Data Protection Regulation of 2018 is a global benchmark
Cross-border data: the Act allows transfer of data abroad except to countries the Government restricts
Surveillance reform: calls for judicial oversight of interception under the Telegraph Act and IT Act
Pegasus controversy: allegations in 2021 of spyware use led the Supreme Court to set up a technical committee
Data breaches: leaks at hospitals, airlines and government portals show weak security
Cyber hygiene: strong passwords, two-factor authentication and not sharing OTPs
Link: agencies are in National Cyber Coordination Centre and encryption is in Encryption and Cybersecurity

Why Does It Matter for the Exam?

Judgment: Puttaswamy 2017, nine judges
Law: DPDP Act 2023 features
Crimes: phishing, ransomware, deepfakes
Current affairs link: DPDP Rules and digital arrest scams
Common errors: saying privacy is a fundamental right under Article 19 only or confusing the IT Act with the DPDP Act

As an analytical point, data can improve welfare and security, but without safeguards it can harm freedom. A good framework needs strong rights, accountable institutions, narrow exemptions and public cyber awareness.

Why Is This Topic Important?

Right Privacy under Article 21
Law DPDP Act
Crime Types and response

What Came Next?

The next topic covers spectrum policy and mobile spectrum management in India. Next topic: Spectrum Policy and Mobile Spectrum Management in India.

Key People and Terms

Big data Very large varied data sets
Data fiduciary Entity deciding data use
Data principal Person the data is about
Phishing Fake message to steal details
Deepfake AI generated fake media
I4C Cyber crime coordination centre

Exam Corner

Points to Remember

Puttaswamy: August 2017, nine judges.
DPDP Act: 2023.
Cybercrime helpline: 1930.
IT Act: 2000.
Privacy falls under Article 21.

Do Not Confuse With

IT Act and DPDP Act Cyber offences and intermediaries versus personal data protection
Data fiduciary and principal Controller versus person
Privacy and secrecy Control over personal information versus hiding

Memory Hook

Privacy is part of life and liberty; fiduciaries must ask consent; dial one-nine-three-zero for fraud.

Mains Angle

Questions ask for the judgment, the law and cybercrime types. These points help.

Benefits Welfare and security
Risks Privacy
Reform Rights and oversight

A Question You May Face

An original practice question, not a past paper question.

“Discuss the challenges to privacy in the era of big data and evaluate the Digital Personal Data Protection Act, 2023.”

How to Answer

Context Big data uses.
Right Puttaswamy.
Law DPDP Act merits and gaps.
Way forward Safeguards.

GS Relevance

Prelims: Puttaswamy judgment, DPDP Act, types of cybercrime, helpline. GS Paper 2: rights, governance; GS Paper 3: cyber security, internal security.

Frequently Asked Questions

What did the Puttaswamy judgment decide in 2017?

In August 2017 a nine judge bench of the Supreme Court in K S Puttaswamy versus Union of India unanimously held that the right to privacy is a fundamental right protected under Article 21 as part of the right to life and personal liberty. Any restriction must meet tests of legality, a legitimate aim and proportionality.

What is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023 is India's law on the processing of digital personal data. It requires consent for use of data, gives people rights to access, correct and erase their data, places duties on data fiduciaries, creates a Data Protection Board and provides penalties for breaches, with exemptions for the State in some cases.

What is big data?

Big data refers to extremely large and varied sets of data, produced quickly from sources such as phones, sensors, online transactions and social media, that need special tools for analysis. It is described by the three Vs of volume, velocity and variety and is used in health, welfare, business and policing.

How can one report cybercrime in India?

A victim can report cybercrime on the National Cyber Crime Reporting Portal at cybercrime.gov.in or by calling the helpline 1930, which is used mainly for financial fraud so that the money can be frozen quickly. The complaint is then handled by state cyber police under the coordination of the Indian Cyber Crime Coordination Centre.

What is a deepfake?

A deepfake is audio, image or video made or changed by artificial intelligence so that it looks real, for example showing a person saying something they never said. It is used for fraud, harassment and false news, and the Government has issued advisories asking platforms to remove such content.

PYQ Practice — Statement Analysis

1 The right to privacy is part of Article 21.

True

As held in Puttaswamy, 2017.

2 Puttaswamy (2017) was decided by a five judge bench.

False

It was a nine judge bench.

3 The DPDP Act was passed in 2023.