Digital Personal Data Protection Act

Explanation

Pair 1 is correctly matched: the Cambridge Analytica scandal exposed how Facebook allowed a third-party app to harvest personal data of millions of users without their informed consent, and it became the defining episode that triggered global regulatory scrutiny of social media data practices. Pair 2 is correctly matched: India's Digital Personal Data Protection Act, 2023 (DPDPA) establishes 'data principals' (individuals) and 'data fiduciaries' (entities processing data), imposes consent-based obligations on fiduciaries, and creates a Data Protection Board of India as the adjudicating body empowered to levy penalties. Pair 3 is incorrectly matched: the Federal Trade Commission (FTC) is a federal (central government) body, not a state-level one. It enforces consumer protection law at the national level. The lawsuit described in the news was brought by the New Mexico state Attorney General under New Mexico's own Unfair Practices Act — a state-level consumer protection statute — which is a distinct, parallel enforcement mechanism from the FTC.

Explanation

Under the DPDP Act, 2023, a 'data fiduciary' is an entity that determines the purpose and means of processing personal data, and a core obligation is to give notice to and obtain consent from the data principal (the individual whose data is processed) — Pair 1 is correctly matched. Section 44(3) of the DPDP Act, 2023, did amend the RTI Act, 2005, specifically by removing the earlier public-interest qualification that had allowed disclosure of personal information held by public authorities when a larger public interest was at stake — Pair 2 is correctly matched. Pair 3 is incorrect: India has no standalone Press Act conferring statutory press freedom. Freedom of the press in India is not an explicitly enumerated or separately enacted statutory right; rather, it flows from Article 19(1)(a) of the Constitution, which guarantees freedom of speech and expression to all citizens. Courts have recognised press freedom as implicit in Article 19(1)(a), but it is a constitutional (not statutory) protection, and there is no dedicated legislation enshrining it.

Explanation

Pair 1 is correctly matched: under the IT Act, 2000 read with the Sensitive Personal Data or Information (SPDI) Rules, 2011, transfer of sensitive personal data outside India was permissible provided the recipient ensured a protection standard equivalent to Indian law, and the transfer was either necessary for a lawful contract or had been consented to by the data subject. An assertion or claim of adequacy was sufficient — there was no independent verification mechanism. Pair 2 is also correctly matched: the DPDP Act, 2023 replaced the earlier IT Act regime as the primary framework for personal data protection, with its Rules notified in November 2025 and a phased rollout under which certain consent and safety provisions take effect only in 2027. Pair 3 is incorrectly matched and is the key conceptual distractor: the SPDI Rules under the IT Act regime applied only to a defined list of 'sensitive personal data' (financial records, medical or health details, sexual orientation, biometric information, etc.). Categories such as names, addresses, phone numbers, caste, religion, political affiliations, browsing history, social media activity, and online or offline behavioural patterns were explicitly excluded from the Rules' protections — a major gap that the DPDP Act framework seeks to address.