UPSC Mains 2018 GS Paper 3 Q19: model answer
Data security has assumed significant importance in the digitized world due to rising cyber crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space?
What the question wants
Give your view on the strengths and weaknesses of the Justice B.N. Srikrishna Committee report on protecting personal data in cyberspace.
How to structure it
Context, strengths, weaknesses, what followed.
- Background
- Key recommendations
- Strengths
- Weaknesses
- What happened next
How to think it through
Committee formed July 2017 after Puttaswamy (Aug 2017 nine-judge bench privacy fundamental right). Report July 2018 'A Free and Fair Digital Economy' + draft PDP Bill 2018. Recommendations: data fiduciary/principal, consent, purpose limitation, data minimisation, sensitive personal data, DPA, rights (access, correction, portability, right to be forgotten limited), penalties up to 4% global turnover, data localisation (one copy in India; critical data only in India), exemptions for state security with law. Strengths: rights-based, fiduciary idea, independent regulator, privacy by design, breach notification. Weaknesses: wide state exemptions, no surveillance reform, localisation cost, DPA appointment by executive, RTI dilution, weak right to be forgotten, Aadhaar not covered fully. After: PDP Bill 2019, JPC 2021, withdrawn 2022, DPDP Act 2023, Rules Nov 2025.
Model answer
In August 2017, a nine-judge bench in Justice K.S. Puttaswamy v. Union of India held that privacy is a fundamental right. A month earlier, the government had asked a committee under Justice B.N. Srikrishna to draft a data protection law. Its report, 'A Free and Fair Digital Economy', came in July 2018 with a draft bill.
Key recommendations
- Data principal (the person) and data fiduciary (the company or state) with a duty of trust.
- Consent, purpose limitation and data minimisation.
- Special care for sensitive personal data like health, finance and biometrics.
- Rights to access, correction and portability, and a limited right to be forgotten.
- An independent Data Protection Authority.
- Penalties up to 4% of global turnover.
- Data localisation: one copy of personal data in India; 'critical' data only in India.
Strengths
- A rights-based approach grounded in Puttaswamy.
- The fiduciary idea puts the burden on those who collect data.
- Breach notification and privacy by design.
- Applies to both private firms and the state.
Weaknesses
- Wide exemptions for the state on security grounds without strong judicial oversight.
- No reform of surveillance laws, like the Telegraph Act and IT Act interception powers.
- Localisation raises costs for start-ups and may not improve security.
- The DPA would be chosen by the executive, raising questions about independence.
- A proposed change to the RTI Act could restrict access to information on officials.
What followed
- The PDP Bill, 2019 went to a Joint Parliamentary Committee and was withdrawn in 2022.
- The Digital Personal Data Protection Act, 2023 replaced it; its Rules were notified on 14 November 2025, with most duties applying from May 2027.
The Srikrishna report set the vocabulary of India's data debate; the real test is whether the law guards citizens from both companies and the state.
Draw: A two-column table: strengths and weaknesses, with a timeline strip from 2017 to 2027 below.
Keywords, cases and data to drop in
Puttaswamy 2017, Srikrishna Committee July 2018, 'A Free and Fair Digital Economy', data fiduciary, data principal, consent, sensitive personal data, DPA, 4% global turnover, data localisation, state exemptions, surveillance reform, PDP Bill 2019, DPDP Act 2023, DPDP Rules 14 Nov 2025.
Where most answers lose marks
- Summarising the report without giving your own view, which the question explicitly asks for.
Related Mains PYQs
- Explain how fake news and disinformation pose threat to Internal Security and Public Order in Indian context? In this regard, discuss salient… UPSC 2026 · GS-III
- Describe the context and salient features of the Digital Personal Data Protection Act, 2023. UPSC 2024 · GS-III
- Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the… UPSC 2024 · GS-III
- What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India… UPSC 2022 · GS-III
Fresh examples from current affairs
Vehicle data sold for ₹5: Centre orders CERT-In audit of VAHAN, SARATHI and e-Challan portals
The Ministry of Road Transport and Highways has asked CERT-In, India’s cyber-security agency, for a forensic audit of its VAHAN, SARATHI, e-Challan and pollution-certificate portals. A security firm found that owners’ names, addresses and phone numbers were being sold through apps and a Telegram channel for as little as ₹5. On the same day, The Hindu reported a separate leak of film certification records. For you, this connects cyber security, the right to privacy and the Digital Personal Data Protection Act, 2023.
UPSC angle: Prelims: CERT-In, Section 70B IT Act, VAHAN/SARATHI, Puttaswamy, DPDP Act 2023, GDPR. · Mains GS-III: cyber security and data protection.
25 Oct 2026
eMudhra weak-key flaw: browsers block 8 certificates; what it means for India’s web trust
Google, Mozilla, Apple and Microsoft have blocked eight intermediate certificates of Bengaluru-based eMudhra, India’s largest certifying authority, after a researcher found their private keys were tiny numbers between 1 and 256 instead of proper 384-bit keys. eMudhra revoked them, CERT-In issued an advisory on 21 October 2026 and MeitY set up a special team. India’s regulated digital signatures and eSign are unaffected.
UPSC angle: Prelims: CCA, CERT-In, TLS, eSign. · Mains GS-III: cyber security, digital trust, data protection.
22 Oct 2026
Open-weight AI models: why Big Tech gives them away and what it means for India
In October 2026 alone, Reflection AI, Meta, NVIDIA and Mistral released or announced open-weight AI models. The Hindu explained on 20 October why firms spend heavily and then let anyone download the weights: to win developers, set standards and earn from cloud, chips and services. For India, open weights offer a base to build Indian-language AI, but they also bring safety risks.
UPSC angle: Prelims: weights, open-weight vs open-source, IndiaAI, AI4Bharat. · Mains GS-III: AI sovereignty, safety and regulation.
21 Oct 2026
Supreme Court: children have a right to the internet, and platforms must block child abuse material
In a judgment of 15 October 2026, the Supreme Court said that the right to access and use the internet is a fundamental right of every person, children included, under Article 21 read with Article 19(1)(a). So the answer to online danger is not to lock children out but to go after the abusive content and the platforms that fail to remove it. The Court ordered a National Hash and URL List Database, two-hour reporting of unknown abuse material, and loss of revenue for platforms that profit from it through paywalls.
UPSC angle: Prelims: Arts. 21 and 19(1)(a); POCSO s.15; IT Act ss.67B and 79; CSEAM. · Mains GS-II: rights of children, regulation of platforms.
18 Oct 2026Learn the concept
Question text as printed in the official UPSC Civil Services (Main) question paper. The model answer is original Battle IAS work; use it to learn structure, not to memorise.
Want every PYQ in one place? See the Battle IAS PYQ Book.