In an order dated 12 October 2026, Justice Suraj Govindaraj of the Karnataka High Court refused to quash proceedings under Sections 66C and 67 of the Information Technology Act, 2000 against five men. They are accused of circulating an obscene video, built from a woman's Instagram photo, in WhatsApp groups. LiveLaw reported the order on 4 November. MediaNama followed on 6 November. The court held that "the use of a publicly available photograph does not, by itself, authorise another person to misuse it."
The ruling is a good outcome for the complainant. It also exposes a mismatch with India's new data protection statute.
What the court actually decided
According to MediaNama, a college lecturer in Dakshina Kannada complained in March 2020 that her Instagram ID and photograph had been used to circulate an obscene video in WhatsApp groups. A charge sheet was filed on 17 July 2024, and the case is pending before a magistrate's court in Puttur.
The defence argued that the woman in the photo and the person in the video were different people. The State forensic laboratory found the faces "similar" by visual observation. It said it lacked tools to compare visual content, and that checking for editing was beyond its remit. The court treated identity as a disputed question of fact for trial. It also said its observations should not influence the trial court.
So the High Court has not found anyone guilty. It decided only that the proceedings can continue, and that the original public posting is no defence at this stage. As MediaNama reports it, the court reasoned that the effect of misuse "cannot be assessed merely by observing that the original photograph was available on Instagram."
The strongest case for the existing toolkit
Criminal law is a legitimate way to handle this conduct, and the regulatory case for it is strong. Section 66C of the IT Act punishes whoever "fraudulently or dishonestly" uses another person's "unique identification feature" with up to three years' imprisonment and a fine of up to one lakh rupees. Section 67 punishes publishing or transmitting lascivious material in electronic form. A first conviction carries up to three years and a fine of up to five lakh rupees, per the statute text. The harm here is concrete, and a specific person's face was weaponised. A framework that treats "she posted it herself" as a defence would punish victims for having an online presence.
The court's logic is also sound. Consent is purpose-bound. Someone who shares a photo so friends can see it has not agreed to its use in sexual content. That is the same purpose-limitation idea that sits at the centre of modern data protection.
Where the DPDP Act points the other way
The Digital Personal Data Protection Act, 2023 runs on a different assumption. Section 3(c)(ii) says the Act does not apply to personal data "made or caused to be made publicly available by" the Data Principal to whom it relates, or by someone legally obliged to publish it. The Bill text (as introduced) gives an illustration: an individual who, "while blogging her views, has publicly made available her personal data on social media," falls outside the Act. MediaNama reports that the enacted Act uses the same language and argues that a photo a woman posted herself falls outside it. The High Court's order did not address the DPDP Act. The tension is an analytical one.
The exclusion is binary and tied to who published the data. It does not ask what happens afterwards. Under a literal reading, anyone who downloads a public photo, manipulates it and redistributes it is not processing data regulated by the Act. The DPDP Act also does not address screenshots or resharing, according to MediaNama.
The case shows why that matters. The conduct the court let proceed, harvesting a public image for a purpose its owner never intended, is the kind of purpose drift a data protection regime exists to catch. Under DPDP's current text, the Data Protection Board would have no jurisdiction over it. The IT Act would be the only route.
A pro-innovation case for fixing this narrowly
The answer is not to abolish the exclusion. It exists for good reasons. Search engines, archives, journalists, researchers and ordinary users all depend on being able to handle information that people have chosen to publish. A rule that required consent for every use of anything public would chill speech, indexing and open-source research. That would be a poor trade, and a worse one for a country trying to build an AI and data sector.
The better fix is interpretive and targeted:
- Read the exclusion as covering the original publication, not every downstream use. The clause says data "made publicly available" is outside the Act. It does not clearly say that every later use stays outside it.
- Carve out clearly harmful uses. Sexual or deceptive manipulation of a person's likeness could be addressed through narrow rules or Board guidance, without regulating ordinary reuse of public information.
- Leave existing criminal law in place. Sections 66C and 67 already target the harm. Broadening DPDP to duplicate them would add compliance burden for lawful actors and little protection for victims.
The timing matters
The DPDP Rules were notified in November 2025 and are being phased in. PTI reported at the time that the rules would become "completely operational only after 18 months," which puts full operation around May 2027 (The Week). That leaves a window to clarify the public-data exclusion before enforcement begins. Once the Board starts hearing complaints, ambiguity will be resolved case by case, and the winners will be whoever litigates best.
The Karnataka order shows a court reaching the right result by relying on older criminal provisions and common-sense consent principles. A modern data protection law should not leave that result dependent on the 2000-era IT Act alone.