Data security has assumed significant importance in the digitized world due to rising cybercrimes. The Justice B.N Sreekrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to the protection of personal data in cyberspace? (250 words)

The Srikrishna Committee Report recognised that personal data is an individual resource and a governance asset requiring rights, accountability and innovation to be balanced in cyberspace.

• It proposed a comprehensive, technology-neutral framework covering collection, processing, storage, sharing and erasure of personal data.
• It endorsed purpose limitation, collection limitation, data minimisation, storage limitation, transparency, security safeguards and accountability.
• It recognised consent and individual rights such as access, correction, portability and the right to be forgotten, while proposing a data-protection authority.
• It distinguished personal, sensitive and critical personal data, proposed breach notification and addressed cross-border transfers.

The report acknowledged privacy as a fundamental right after the Puttaswamy judgment, but also allowed legitimate state functions, public interest and innovation subject to safeguards. Privacy-by-design and privacy impact assessments could improve organisational security.

• Broad state exemptions for security, public order and crime prevention risk surveillance without sufficiently strong necessity, proportionality and independent authorisation.
• Data localisation requirements may raise costs, fragment the internet and exceed what is necessary for security.
• Consent can be illusory in unequal digital markets, while enforcement capacity, regulator independence and remedies require clearer guarantees.
• Rules for anonymised data, non-personal data, algorithmic harms and small entities needed greater precision.

Use a rights-based statute with independent oversight, judicial or parliamentary review of exemptions, strong penalties, interoperability, affordable compliance and cross-border standards. Cybersecurity, encryption and digital literacy must complement privacy regulation.

Keywords: privacy, purpose limitation, data minimisation, consent, fiduciary, data-protection authority, localisation, surveillance, proportionality, breach notification.