SC sets aside UP police order to trace journo’s digital footprint

The Supreme Court set aside a Ghaziabad police directive issued to X on August 22. The notice sought confidential digital information connected with journalist Abhishek Upadhyay. Police were investigating an alleged road-rage case registered on August 18.

The request covered Upadhyay’s social-media information from June 1, 2026, through August 22. Police told the court they wanted to discover his whereabouts after he remained untraced following the FIR. The bench questioned why such extensive past activity was relevant to a road-rage allegation.

The court ruled that information before August 22 could not be taken or used against him. Even information after the FIR could be sought only if it was proportionate and other investigative methods had proved inadequate. The court also kept his arrest stayed and ordered release of his vehicle within two days.

A person’s digital footprint is the record created by their use of digital services. It can include public posts, private messages, login records, location information, searches, uploaded files, and interactions with other accounts. The exact data depends on the platform and the request made to it.

In this case, the police sought information from X to help determine where Abhishek Upadhyay was. The request covered activity beginning June 1, 2026, even though the alleged road-rage incident occurred on August 18. The court questioned how that older social-media activity related to the investigation.

The case shows why digital footprints are sensitive. They can reveal patterns about a person’s movements, contacts, and interests. The Supreme Court said personal information must be sought proportionately. Investigators must also show that alternative methods were inadequate before seeking such data.

The police request covered the period from June 1, 2026, until August 22. That means X was asked for information spanning nearly three months. The alleged road-rage incident, however, took place on August 18, just four days before the notice was issued.

The Supreme Court highlighted this mismatch during the hearing. The bench asked why social-media activity from June was relevant to a road-rage case occurring in August. Police said they wanted to know Upadhyay’s whereabouts because he remained untraced after the FIR was registered.

The court viewed the time range as excessive in the circumstances. It quashed the notice and barred use of information collected for the period before August 22. It also said that even later information could not be sought automatically. Police would need to show proportionality and inadequate alternative investigative methods.

The Supreme Court considered the request excessive because it sought a wide span of personal data for a narrowly dated allegation. The road-rage incident was said to have occurred on August 18, but police requested information from June 1, 2026, onward. The court questioned the relevance of that earlier activity.

Police explained that they wanted to trace Upadhyay’s whereabouts after the FIR was registered. But the bench found no adequate explanation for examining months of social-media data. It also noted that the police had not raised a case showing that other investigative methods were insufficient.

The Court therefore described the notice as an “overkill” and quashed it. Its reasoning was not that police can never seek platform data. Instead, any request must match the investigation’s needs. It must be proportionate, and authorities must show why less intrusive methods would not work.

The Court imposed direct limits on the information already collected. It said confidential personal information from before August 22 could not be taken or used against Upadhyay. Any information obtained for that earlier period was also barred from use in the case.

For information after the FIR, the Court required more than a police request. Authorities had to show that seeking the data was proportionate and that alternative investigative measures had proved inadequate. The court found that the Uttar Pradesh Police had not made that showing.

The arrest protection already granted to Upadhyay continued until further orders. This allowed him to challenge the FIR before the appropriate court without the Supreme Court deciding whether the allegations were true. The police were also directed to release his vehicle, which was involved in the alleged road-rage case, within two days.

The IT Intermediary Rules 2021 are the rules the Uttar Pradesh government cited to justify requesting information from a digital platform. In this case, the government’s additional advocate general said police were empowered under those rules to seek “any” information from an intermediary such as X.

The mechanism described in the hearing was direct. Police issued a notice to X’s nodal officer, asking the platform to provide information connected with Upadhyay. The stated purpose was to discover his whereabouts after the road-rage FIR. The notice sought data covering June 1 through August 22.

The Supreme Court did not decide whether the rules gave police that power. It examined how the power was exercised. The Court said data requests still had to be proportionate. Police also had to show that alternative investigative methods were inadequate. The notice failed that standard and was quashed.

The Court said investigators cannot demand personal data merely because a rule appears to permit it. They must show that the information sought is proportionate to the investigation. They must also establish that alternative investigative methods have proved inadequate.

These requirements create a connection between the data and the alleged offence. In Upadhyay’s case, police sought X information from June 1 for a road-rage incident on August 18. The Court found that the police had not explained why months of earlier social-media activity were needed or why other methods could not locate him.

The safeguards are meant to prevent a “roving and fishing” inquiry. That phrase describes an open-ended search for potentially useful personal information without a focused investigative need. The Court said guidelines are needed to protect privacy and confidentiality, while avoiding rules that could obstruct legitimate investigations or affect investigative journalists.