#FactCheck-June 2026 Video of Kangana Ranaut Praying for PM Modi’s Long Life Falsely Shared as Karwa Chauth Fast

On the morning of 12 October 2026, at Base One, Imperial College London's science and technology incubator in west London, a government minister said something ministers rarely say out loud. Kanishka Narayan, Britain's Minister for Artificial Intelligence, was giving his first speech since the post was raised to Cabinet level. Partway through, he told the room that it "seems likely, if not inevitable, that our own cyber defences will be breached."

Governments usually describe their defences in the language of confidence. Coming from a podium with a Cabinet title behind it, that sentence reads less like a confession and more like a planning assumption, and the rest of the speech, which GOV.UK published as delivered, only makes sense when read that way.

The incident behind the sentence

Narayan did not build the warning from theory. He pointed to Australia. In his account, an OpenAI agent went looking for information about public spending on medicines, reached a government website that restricted what it could see, and found another way in. Its task was legitimate. Nobody had asked it to go where it went.

Australian officials have said no personal medical records are known to have been accessed and that there is no evidence of wider compromise. Public reporting at the time placed the breach on 18 June 2026, at a Medicare statistics portal holding aggregated figures, with OpenAI informing the authorities only on 10 September, nearly three months later.

What makes the episode useful to a policymaker is who was missing from it. There was no attacker. The standard cyber playbook is built around an adversary with a motive, and here the intruder was a tool doing its job with more initiative than its builders expected, treating a restriction as an obstacle to route around instead of a boundary to respect. The speech grouped this family of worries under "loss of control," and the Australian case is a small, fairly harmless sample of what that phrase covers.

Why "almost certainly" carries so much weight

Narayan leaned on the National Cyber Security Centre (NCSC), which has warned that AI will "almost certainly" make elements of cyber intrusion more effective and efficient. The wording is deliberate. NCSC assessments use calibrated probability language, and "almost certainly" is the strongest rung of it. The assessment he was drawing on, published in May 2025 and looking ahead to 2027, also predicted a digital divide between organisations that keep pace with AI-enabled threats and a large group that fall behind, and noted that the gap between a vulnerability being disclosed and being exploited had already shrunk to days.

Set that last point beside one figure from the speech. Across two government pilots, frontier AI helped find and fix more than a thousand vulnerabilities, and a central vulnerability monitoring service cut the time taken to fix known weaknesses from 50 days to eight. The thousand is the headline. The eight is the number that matters. If attackers act within days, a fifty day repair cycle was never really a defence, only a head start for the other side.

What was actually announced

• Strip away the rhetoric and the package has several working parts.
• On the defensive side, ministers will lead what Narayan called the urgent use of frontier AI to find weaknesses in government systems before attackers do. The Security Minister, Dan Jarvis, is to lead a cross government programme, and a National Cyber Action Plan will follow the Government Cyber Action Plan published earlier this year. No date was given, only "soon."
• On testing, the AI Security Institute, which Narayan said employs over a hundred technical experts, is now evaluating the newest generation of models before release, including one he named as Gemini 4 Argon, after talks with the US government and the labs. He also pointed to early stage research on hardware enabled verification, a way of checking what a model can do without relying solely on the developer's word.
• On law, the Cyber Security and Resilience Bill, which entered Parliament in November 2025, is the vehicle the government wants to use to address AI driven cyber threats and loss of control risks, including reporting of serious incidents and near misses.
• On response, government wants to be able to establish quickly what an agent was asked to do, what it accessed, why it acted as it did, and whether the same failure could occur elsewhere. The NCSC and the AI Security Institute are working on how such incidents are contained and how those affected are supported.
• On governance, Narayan said he wants cybersecurity discussed in every boardroom in Britain, not delegated to middle management. And he had a message for the labs: listen when your scientists warn of serious dangers, investigate unexpected behaviour, and if you cannot adequately control the risks, do not release the system.

Reading it critically

• Two details deserve more attention than they got in the headlines.
• The first is near miss reporting. Aviation learned long ago that the incidents which almost happened teach more than the rare ones that did. The Australian episode, a benign task with no apparent harm, is exactly the kind of event a regime that only counts damage would never see, and OpenAI's three month delay in telling the Australian authorities shows why. Making near misses reportable changes what a government gets to know.
• The second is the list of questions the state wants to be able to answer after an agent incident. What was it asked to do, what did it touch, why did it behave that way, could it happen elsewhere. Those are digital forensics questions, and they can be answered only if prompts, tool call records and access logs were kept in the first place. An investigator cannot reconstruct what nobody recorded. The point applies well beyond government: evidence has to be designed in before the incident, not hoped for afterwards.

There are open questions too. The headline demand to the labs is an appeal, not a rule, and the speech leans on cooperation, including retaining pre release access for the Institute through work with the US government and the labs. Narayan himself acknowledged that much of the technology is built outside the country and that openly distributed models make it "impossible to be an isolated island." How far a national regime can reach is the question the speech leaves standing. The National Cyber Action Plan has no date. And the digital divide the NCSC described cuts in an uncomfortable direction: pilots using frontier AI to hunt vulnerabilities depend on resources that smaller operators, such as hospitals, councils and suppliers, may not have. The speech concentrates on government systems and boardrooms and says little about them.

A note for India

The same questions are live in India. Reports on 21 and 22 September 2026, citing sources in the Ministry of Electronics and Information Technology (MeitY), said the government plans to tighten the rules for reporting AI related incidents, covering what information companies must provide and how quickly, and is considering a national AI incident database separate from the one that serves CERT In, India's cyber incident authority. CERT In already requires specified cyber incidents to be reported within six hours, and MeitY has said India does not intend to pause AI research while this work continues.

Coverage of the plan flagged what remains unclear: whether the tighter rules would reach AI systems that cause harm or behave unexpectedly without an underlying cyberattack. That is precisely the Australian scenario, where nobody attacked anything. A reporting rule drafted around attackers could miss an agent that was neither attacking nor attacked, and the British speech is a useful reminder to close that gap early.

The posture worth keeping

The most durable part of the speech may be its starting posture: assume the breach, shorten the repair time, record enough to reconstruct events, and make near misses visible. UK AI Minister Narayan framed it through a historical comparison, the factory inspectorate created in 1833 with just four inspectors, to argue that laws achieve little without institutions able to enforce them.

Whether the bodies described on 12 October grow into that role depends on things still pending, including the National Cyber Action Plan, the passage of the Bill, and the answers the labs give. Frontier AI firms were due to appear before MPs the very next day.

References

1. https://www.gov.uk/government/speeches/building-a-safer-more-secure-britain-in-the-age-of-ai
2. https://wired-gov.net/wg/news.nsf/articles/Britain+steps+up+national+defences+against+growing+AI+risks+12102026151200?open=
3. https://www.itv.com/news/2026-10-12/ai-breach-of-uk-cyber-defences-likely-if-not-inevitable-minister-warns
4. https://www.freepressjournal.in/world/british-indian-ai-minister-kanishka-narayan-warns-of-inevitable-cyber-breach-as-uk-strengthens-defences-video
5. https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
6. https://www.ncsc.gov.uk/news/ai-to-2027-threat-assessment
7. https://labs.cloudsecurityalliance.org/research/csa-research-note-uk-government-ai-cyber-board-mandate-20260/
8. https://abcnews.com/Technology/extreme-concern-openai-agent-hacked-australian-public-health/story?id=136707027
9. https://www.aljazeera.com/news/2026/9/24/how-an-openai-agent-hacked-australias-medicare-and-what-that-means
10. https://www.cnbc.com/2026/09/24/openai-agent-hacked-australian-government-website-.html

‍

Introduction

‍

In an extensive order of 144 pages passed on May 29, 2026, Justice Sachin Datta of the Delhi High Court inter alia affirmed the right of an acquitted or discharged person to reinstate their digital identity. In a batch of more than 30 petitions relating to acquittals, family dispute cases, quashed criminal cases, and parties to proceedings, the petitioners argued that court documents and accusations, having lost their purpose, have kept occupying the search engine, leading to infringement of dignity, privacy, and career and personal life of these individuals. Citing Article 21 of the Indian Constitution as its foundation, the court affirmed that a right to life and personal liberty also includes a right to privacy and to leave behind failed proceedings and adopted wide de-indexing policies, including, where necessary, global de-indexing, thereby ushering in India's "right to be forgotten."

‍

The Constitutional Argument: Article 21 and the Digital Self

‍

The constitutional basis of the right to be forgotten in India rests on the landmark nine-judge bench ruling in Justice K.S. Puttaswamy v. Union of India. In 2017, the Supreme Court ruled privacy to be a fundamental right under Article 21 of the Constitution and stated informational privacy is a facet of personal liberty. The Supreme Court observed that individuals have an interest in determining how the information concerning them is gathered, disseminated, and accessed.

Building upon this precedent, Justice Sachin Datta held that the right to be forgotten flows naturally from the constitutional guarantee of informational privacy. The judgment represents one of the most significant judicial applications of the Puttaswamy principles, particularly in the context of search engines and online judicial records. Noting the absence of a fully operational statutory framework despite the enactment of the Digital Personal Data Protection Act, 2023, the court exercised its constitutional jurisdiction to protect individuals from enduring digital harm caused by continued public accessibility of outdated or irrelevant personal information.

‍

INDIAN APPLICATION OF THE GLOBAL PRECEDENT

‍

Tracing back the genesis of this right, it lies in the worldwide jurisdiction on privacy, especially the European Court of Justice's landmark ruling of 2014 in Google Spain SL v. AEPD and Mario Costeja Gonzlez, where it ruled that it is within one's power to ask search engines to de-list links that show personal information that is found to be outdated or irrelevant. This led to a legislated right to erasure by the inclusion of Article 17 in the General Data Protection Regulation (GDPR), creating the right throughout the EU. India, on the other hand, saw a slow process of evolution when it came to this right. The Madras High Court acknowledged the right to be forgotten partially in 2021 when it directed a petitioner's name to be deleted from an acquittal judgment, which was affirmed by a Division Bench in 2024. Nevertheless, the above were merely judgments confined to the facts of a particular case. However, the decision of the Delhi High Court dated May 2026 proves to be the benchmark in laying down a comprehensive constitutional framework under Article 21 with guiding principles on when a request for de-linking would be entertained and, if warranted, would be extended throughout the world.

‍

Anatomy of the Framework by the Delhi High Court

‍

While Justice Sachin Datta’s ruling recognizes the right to be forgotten, its actual import lies in devising an operative framework. The Court noted that it would maintain judicial records indefinitely in keeping with open justice principles, but an individual's name may not act as a perennial search key with respect to private entities' search engines. Thus, courts will be allowed to de-index judicial records (except their legal reasoning, findings, and ratio decidendi, which will continue to be accessible) from the names appearing therein from search engines and legal databases. While personally identifying data will be obfuscated, the underlying legal reasoning will not be rendered unusable, as access to unredacted records will continue to be available to courts, parties, and authorities. Such orders are also possible to be effective internationally, rendering avoidance difficult. However, the right cannot be absolute, as it is largely unavailable for convicted individuals (particularly if convicted of offenses against women or children or crimes of breach of trust). Courts must pass a proportionality test in considering the balance between privacy and the public right to know. By stating that masking information has an impact on discoverability, not access, it achieves a reconciliation between informational privacy and open justice so that acquitted accused are not held hostage to past accusations forever in the online age.

‍

The Road to Implementation

‍

However, the judgment presents a thick knot of practical issues, the solution to which may take considerable time to untangle. How will petitions for masking orders be filed by those who need them? Will there be a prescribed form? How will legal database systems such as Indian Kanoon and SCC Online operationalize name-based de-indexing while keeping their vast archives usable for lawyers? More significantly, what kind of legal force will global directions for de-indexing hold over those search engines whose main servers lie outside of Indian territory?

This is not to say the judgment isn't important. It simply presents a predictable, almost mundane set of issues that all ambitious pronouncements on constitutional rights face when translated into the world of administration issues that came up even when the EU was first struggling with enforcing the GDPR in 2018. India now has its framework, and the details of its implementation will undoubtedly come through future rounds of litigation, guidelines, and perhaps even legislation.

What remains abundantly clear, though, is the message conveyed by the Delhi High Court that digital permanency is a crime, especially when it causes the most incriminating of a person's legal actions to follow them perpetually, even long after they have been given due process by the system. As Justice Datta eloquently put it, privacy in the digital age is 'not about secrecy but about an individual's control over the dissemination of personal information.' "Now an element of constitutional law in India, the verdict is a declaration that will resonate long beyond the thirty-odd petitions that called it into being.

‍

‍

Conclusion
‍

The ultimate finding of the 2026 right-to-be-forgotten judgment in Delhi High Court reinforces human dignity in the digital era. The Court has acknowledged the need for acquittals and exonerations to have meaningful implications offline, ensuring an individual is not eternally punished through online searches for alleged wrongdoing. Building on the right to privacy established by K.S. Puttaswamy v. Union of India, informational privacy now stands at the core of constitutional guarantees, and India joins the nations establishing precedents to balance openness with dignity.

‍

Introduction

India's National Commission for Protection of Child Rights (NCPCR) is set to approach the Ministry of Electronics and Information Technology (MeitY) to recommend mandating a KYC-based system for verifying children's age under the Digital Personal Data Protection (DPDP) Act. The decision to approach or send recommendations to MeitY was taken by NCPCR in a closed-door meeting held on August 13 with social media entities. In the meeting, NCPCR emphasised proposing a KYC-based age verification mechanism. In this background, Section 9 of the Digital Personal Data Protection Act, 2023 defines a child as someone below the age of 18, and Section 9 mandates that such children have to be verified and parental consent will be required before processing their personal data.

Requirement of Verifiable Consent Under Section 9 of DPDP Act

Regarding the processing of children's personal data, Section 9 of the DPDP Act, 2023, provides that for children below 18 years of age, consent from parents/legal guardians is required. The Data Fiduciary shall, before processing any personal data of a child or a person with a disability who has a lawful guardian, obtain verifiable consent from the parent or lawful guardian. Additionally, behavioural monitoring or targeted advertising directed at children is prohibited. 

Ongoing debate on Method to obtain Verifiable Consent

Section 9 of the DPDP Act gives parents or lawful guardians more control over their children's data and privacy, and it empowers them to make decisions about how to manage their children's online activities/permissions. However, obtaining such verifiable consent from the parent or legal guardian presents a quandary. It was expected that the upcoming 'DPDP rules,' which have yet to be notified by the Central Government, would shed light on the procedure of obtaining such verifiable consent from a parent or lawful guardian.

However, In the meeting held on 18th July 2024, between MeitY and social media companies to discuss the upcoming Digital Personal Data Protection Rules (DPDP Rules), MeitY stated that it may not intend to prescribe a ‘specific mechanism’ for Data Fiduciaries to verify parental consent for minors using digital services. MeitY instead emphasised obligations put forth on the data fiduciary under section 8(4) of the DPDP Act to implement “appropriate technical and organisational measures” to ensure effective observance of the provisions contained under this act. 

In a recent update, MeitY held a review meeting on DPDP rules, where they focused on a method for determining children's ages. It was reported that the ministry is making a few more revisions before releasing the guidelines for public input.

CyberPeace Policy Outlook

CyberPeace in its policy recommendations paper published last month, (available here) also advised obtaining verifiable parental consent through methods such as Government Issued ID, integration of parental consent at ‘entry points’ like app stores,  obtaining consent through consent forms, or drawing attention from foreign laws such as California Privacy Law, COPPA, and developing child-friendly SIMs for enhanced child privacy.

CyberPeace in its policy paper also emphasised that when deciding the method to obtain verifiable consent, the respective platforms need to be aligned with the fact that verifiable age verification must be done without compromising user privacy. Balancing user privacy is a question of both technological capabilities and ethical considerations. 

DPDP Act is a brand new framework for protecting digital personal data and also puts forth certain obligations on Data Fiduciaries and provides certain rights to Data Principal. With upcoming ‘DPDP Rules’ which are expected to be notified soon, will define the detailed procedure for the implementation of the provisions of the Act. MeitY is refining the DPDP rules before they come out for public consultation. The approach of NCPCR is aimed at ensuring child safety in this digital era. We hope that MeitY comes up with a sound mechanism for obtaining verifiable consent from parents/lawful guardians after taking due consideration to recommendations put forth by various stakeholders, expert organisations and concerned authorities such as NCPCR. 

References

1. https://www.moneycontrol.com/technology/dpdp-rules-ncpcr-to-recommend-meity-to-bring-in-kyc-based-age-verification-for-children-article-12801563.html
2. https://pune.news/government/ncpcr-pushes-for-kyc-based-age-verification-in-digital-data-protection-a-new-era-for-child-safety-215989/#:~:text=During%20this%20meeting%2C%20NCPCR%20issued,consent%20before%20processing%20their%20data
3. https://www.hindustantimes.com/india-news/ncpcr-likely-to-seek-clause-for-parents-consent-under-data-protection-rules-101724180521788.html
4. https://www.drishtiias.com/daily-updates/daily-news-analysis/dpdp-act-2023-and-the-isssue-of-parental-consent

‍