Supreme Court to Examine Plea for CBI Probe into ₹1.5 Lakh Medical Records Data Theft

The case involves a large-scale cyber attack against what appears to be a major healthcare provider or health data aggregator, resulting in unauthorized access to highly sensitive personal information including medical histories, diagnostic reports, contact details, and potentially financial information. Such breaches pose serious risks including identity theft, insurance fraud, unauthorized disclosure of health information (violating patient privacy), and potential blackmail. The plea requesting CBI involvement suggests the breach is of national importance and involves inter-state or international dimensions beyond state police capacity.

Key contextual facts: India's Digital Personal Data Protection Act, 2023 came into force only in 2024; healthcare data is classified as 'sensitive personal data' requiring explicit consent for processing; CBI typically investigates cases of national importance involving fraud, data theft, or organized cybercrime with pan-India implications; estimated 1.5 lakh affected individuals; previous healthcare data breaches in India have compromised data of Aadhaar holders and health insurance portals. The incident raises questions about compliance with Information Technology Act, 2000 and data security standards.

For examination purposes: This case exemplifies several critical themes—cybersecurity vulnerabilities in critical infrastructure, data protection law enforcement, criminal procedure in digital crimes, and constitutional right to privacy (established in Puttaswamy judgment). UPSC candidates should understand the distinction between data protection (civil framework) and cybercrime prosecution (criminal framework). This connects to India's digital governance challenges, the need for robust cyber regulations, and institutional accountability. Expect Mains questions about data protection frameworks, cybersecurity policy, or CBI's jurisdiction in technology crimes.