UPSC Prelims Practice Questions — India needs to train its clinical staff before erecting data shields

Q1. With reference to the scope of the Digital Personal Data Protection Act, 2023, consider the following statements: Which of the statements given above is/are correct?

  1. Patient details first written in a paper register at a clinic come within the Act once they are entered into the hospital's software system.
  2. The Act can apply to processing carried out outside India if that processing is connected with offering goods or services in India.
  3. The Act creates a separate category of sensitive personal data, such as health records, that carries stricter processing conditions than other personal data.
  • A. 1, 2 and 3
  • B. 1 and 3 only
  • C. 1 and 2 only
  • D. 2 and 3 only

Q2. With reference to Consent Managers under India's digital personal data protection framework, consider the following statements: Which of the statements given above is/are correct?

  1. A Consent Manager is accountable to the Data Fiduciary, which uses it as a tool to collect consents from its patients or customers.
  2. A Consent Manager offers an interoperable platform, so that a Data Principal can give, review and withdraw consents for several Data Fiduciaries in one place.
  3. Every Data Principal must route consent through a registered Consent Manager before any hospital can process their personal data.
  • A. 2 only
  • B. 1 and 2 only
  • C. 1 and 3 only
  • D. 2 and 3 only

Q3. Consider the following statements: Which of the following is correct in respect of the above statements?

  1. Under the DPDP framework, an entity must be registered with the Data Protection Board of India before it can function as a Consent Manager.
  2. The DPDP Act, 2023 treats every Consent Manager as a Significant Data Fiduciary, designated as such by the Central Government.
  • A. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
  • B. Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I
  • C. Statement-I is correct, but Statement-II is incorrect
  • D. Statement-I is incorrect, but Statement-II is correct

Q4. An unconscious road-accident victim is brought to a hospital emergency ward. To treat the patient, doctors retrieve and process the patient's earlier digital health records without anyone's consent. In the light of the Digital Personal Data Protection Act, 2023, consider the following statements: Which of the statements given above is/are correct?

  1. The hospital may process the personal data needed to treat the patient without waiting for consent, because a medical emergency is a recognised legitimate use.
  2. Because the data was lawfully processed during the emergency, the hospital may later use the same data for a promotional health-camp campaign without seeking consent.
  3. Because the patient could not sign a treatment consent form, the hospital is barred from processing the patient's data until a relative consents on the patient's behalf.
  • A. 1 and 2 only
  • B. 1 only
  • C. 2 and 3 only
  • D. 3 only

Q5. Consider the following statements: Which of the following is correct in respect of the above statements?

  1. The Digital Personal Data Protection Act, 2023 does not allow the State to process an individual's personal data to provide a subsidy, benefit or service unless it first obtains that individual's consent.
  2. The Supreme Court has recognised privacy as a fundamental right, and any infringement of it must be proportionate to the need for the interference.
  • A. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
  • B. Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I
  • C. Statement-I is correct, but Statement-II is incorrect
  • D. Statement-I is incorrect, but Statement-II is correct