Chandigarh: For more than two years now, a 19-year-old engineering student has been unable to access three of his Google accounts. He has now moved the Punjab and Haryana High Court, saying the clock is about to run out on his data.
Justice Tribhuvan Dahiya on 15 October issued a notice on the student’s writ petition, filed against the Union of India and others. The notice was also issued to Google India Pvt Ltd, the third respondent. The bench ordered the notice to be served by dasti process (hand-delivered) as well. It issued notice of motion and notice on the plea for interim directions.
Senior advocate Dheeraj Jain, appearing with advocate Amrita Singh for the Centre, accepted notice and sought time to file a reply.
The matter will be heard next on 20 November.
According to the petition, the student’s phone was stolen on 18 August, 2024. It was the only trusted device linked to his three Google accounts. The moment it was gone, he lost access to all of them. He claims Google’s recovery system left him with no way out. It checks the mobile number registered with the account, but then sends a verification code to the very account he is locked out of. There is no option to speak to a person or prove his identity in another way, the petition argues.
The student did not stop there. The petition says he complained to Google, filed RTI applications about those complaints and lodged a cyber complaint. He had also approached the High Court earlier, but that petition was disposed of on 13 August. The court asked the appellate authority to decide his appeal under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 within 30 days.
Eight days later, on 21 August, the Grievance Appellate Committee—established by the Centre under the IT Rules—passed its order. It directed Google to give the student proper guidance and support to recover data from his Gmail accounts.
However, the petitioner told the High Court that nothing happened after that. His emails to the company, including one sent on 9 September, remain unanswered.
The student also points to a deadline. Google’s inactive account policy allows deletion after two years of no access. Counted from his last login, that period ended on 18 August 2026. He fears his data can be wiped at any time.
His lawyer, Satyam Tandon, has built the case largely on the Digital Personal Data Protection Act, 2023. The petition describes Google as a “Data Fiduciary” and the student as a “Data Principal” under the law.
It argues that losing access to data amounts to a “personal data breach” under Section 2(u) of the Act. It relies on Section 8(5), read with Rule 6(1)(d) of the DPDP Rules, 2025, which require steps such as backups so that data stays available even if access is lost. It also cites Section 27, under which the Data Protection Board can order remedial measures.
The petition says Google holds the data and can restore it, but has chosen not to. This, it argues, goes against Rules 3(1)(m) and 3(1)(n) of the IT Rules, 2021, and violates Article 21 of the Constitution.
The petitioner has also challenged the two-year deletion policy itself. In his view, Sections 8(7) and 8(8) of the DPDP Act, read with Rule 8 and the Third Schedule of the DPDP Rules, require such data to be kept for three years from the Data Principal’s last request. The order records this challenge as one of the grounds raised.
(Edited by Amrtansh Arora)
Also Read: NCPCR summons Google over AI ‘kiss & hug’ apps, to issue social media child safety norms by December