India does not have a dedicated law on data protection and privacy. India has also not adopted any international instruments on privacy or data protection. Specific provisions on privacy are found in the Information Technology Act 2000 (IT Act). The IT Act is based on the United Nations Model Law on Electronic Commerce adopted by the United Nations Commissions on Internal Trade law on 30 January 1997 vide resolution A/RES/51/162. A plethora of laws in areas such as banking, telecoms and the medical field prescribe obligations of confidentiality. Banking regulations deal with when financial institutions can transfer data overseas and the types of data that cannot be transferred overseas. Telecom regulations, by and large, prevent the transfer of customer information overseas. The code of conduct of medical practitioners prevents disclosure of patient information. The insurance regulations restrict transfer of claims-related data overseas.
The IT Act contains three provisions on data protection and privacy. Section 43A provides for compensation in the event one is negligent in using reasonable security practices and procedures (RSPP) in protecting sensitive personal data and information (SPDI) and this results in a wrongful gain or wrongful loss. It should be noted that this law provides only compensation, and only when a wrongful gain or loss results from the failure to observe RSPP. It can be argued that this is nothing but a codification of the law of negligence. This means that there is no negative consequence arising merely from the failure to observe RSPP. Further, RSPP is defined to mean such procedures stated by a law in force or as agreed to by the parties, and in the absence of both, the rules framed by the government. There is no statute that prescribes RSPP. This means that if parties, for example, an employer and an employee, agree on the RSPP to be adopted, the rules of the government would not apply.
In the guise of prescribing what constitutes RSPP, the government has issued somewhat basic and not very well-written privacy rules. As stated above, these rules apply only if the concerned parties have not agreed on the RSPP that would apply. These rules contain basic principles of privacy such as when SPDI can be collected, requirements of notice and consent, when SPDI can be transferred, etc.
Section 72A provides for criminal punishment if, in the course of performing a contract, a service provider discloses personal information without the consent of the person concerned or in breach of a lawful contract and he or she does so with the intention to cause, or knowing he or she is likely to cause, wrongful loss or wrongful gain.
Section 72 prescribes criminal punishment if a government official discloses records and information accessed by him or her in the course of his or her duties without the consent of the concerned person or unless permitted by other laws.
There is no specific data protection authority in India. The IT Act provides for an adjudicating officer to be appointed to adjudicate whether a person has contravened the IT Act or its rules where the claim of injury or damages does not exceed 50 million rupees. If the claim exceeds 50 million rupees, the adjudicating authority would be the civil court. The Secretary to the Ministry of Information Technology in each state government has been appointed as the adjudicating officer. The adjudicating officer has all powers of a civil court. These include summoning the attendance of persons and examining them on oath, requiring the discovery or production of documents and other electronic records, receiving evidence on affidavits and issuing commissions for the examination of witnesses or documents.
The police have the power to investigate offences under the IT Act such as under section 72 and section 72A.
Under specialised statutes relating to banking, telecom and in the medical field, the relevant sectoral regulator has powers.
There is no data protection authority in India.
Under section 43A, if a breach results in a wrongful gain or wrongful loss, the adjudicating officer can order compensation to be paid. The law does not prescribe what the maximum compensation is. Under section 72, the punishment is imprisonment of up to two years or a fine of up to 100,000 rupees, or both. Under section 72A, the punishment is imprisonment of up to three years or a fine of up to 500,000 rupees, or both. Other laws provide for penalties under those statutes for breach of confidentiality provisions.
The provisions under the IT Act apply to all sectors, though laws specific to particular sectors would apply concurrently. Section 43A relates to a body corporate and the rules issued thereunder exclude government from the meaning of body corporate. Section 72A covers all types of organisations. Section 72 relates only to a government officer.
It should be noted, as described in the answer to question 1, that under section 43A, the parties concerned can agree among themselves on the RSPP to be adopted. If they do so, then the privacy rules passed by the Indian government would be excluded.
Since section 72 dealing with breach of confidentiality by a government officer is subject to other laws, if another law permits the disclosure of the information by a government officer, such disclosure would not be a violation of section 72.
Other sector-specific laws provide for exceptions relating to those sectors. For example, a doctor could disclose information in circumstances where there is a serious and identified risk to a specific person or community. Banking laws refer to the duty of confidentiality in the context of other laws, practices and usages customary among bankers.
Yes, the Indian Telegraph Act 1885 and the Information Technology Act 2000 permit the government to engage in surveillance based on certain criteria that is in the interests of the sovereignty and integrity of India, security of the state, friendly relations with foreign states, public order or for prevention of incitement of the commission of an offence. These grounds are based on reasonable restrictions to free speech contained in the Constitution of India.
All surveillance has to be approved in writing by the Home Secretary of the central government or the relevant state government as the case may be. The Home Secretary is the most senior of bureaucrats tasked with maintaining law and order. Indian law does not require the permission of a court to engage in surveillance.
Many laws provide a duty on service providers to maintain confidentiality of customer information. For example, medical laws deal with maintaining confidentiality of patient information. Such laws, for example, relate to medical termination of pregnancy and mental health. The code of ethics for medical professionals also prescribes that doctors must maintain confidentiality of patient information.
Banking laws also deal with protection of confidentiality of customer information. This is provided both in statutes relating to banks and payment systems as well as regulations passed by India's central bank, the Reserve Bank of India (RBI), on customer servicing, credit card operations of banks, etc.
A statute dealing with credit information companies requires credit information companies and credit institutions (banks, etc) to adopt principles relating to collection of information, processing of such information, protection of data and the manner of access and sharing of data. The principles are not prescribed by the law or by the regulator but have to be framed by the concerned credit information companies and institutions.
The RBI has prescribed detailed guidelines on information security, electronic banking, technology risk management and cyber frauds. In particular, the guidelines mention that banks must report breaches to the RBI and require use of encryption technology of at least 128-bit SSL and implementation of ISO/IEC 27001 and ISO/IEC 27002. Further, the banking regulations require banks to appoint a chief information security officer who will be responsible for articulating and enforcing the policies that banks use to protect their information assets apart from coordinating security-related issues.
the jurisdiction of the courts in the offshore location would not extend to the operations of the bank in India.
The outsourcing regulations also require customer data to be isolated and clearly identified, and there can be no comingling of data. Telecom laws, by and large, prohibit the transfer of customer accounting and user information outside of India except with regard to roaming information and remote access to such data from outside India. A recent notification issued by the RBI imposes restrictions on overseas transfers of payment system data by payment system operators.
The law does not distinguish personal information on the basis of the format of the information, such as electronic as opposed to physical records. However, the laws on SPDI are applicable only to SPDI in electronic form.
The law does not specify whether it applies only to PII owners or processors of PII established or operating in the jurisdiction. After the privacy rules were notified, there was some concern that they would apply to SPDI of foreign nationals that was being processed in India by the many business process outsourcing businesses in India. The government then issued a press note to clarify that it relates only to a body corporate or person located within India. Further, data processing as a result of a contract between two entities is not covered by the privacy rules. While the clarification is not entirely clear, the accepted view is that this does not apply to foreign personal information being processed in India.
The law does allow transfer of SPDI out of India only if the recipient ensures the same level of data protection.
The law is not entirely clear on this point, though there is a clarification that appears to suggest that the privacy rules relate to a party that collects the data directly from the providers of the information and does not relate directly to a situation where the processor of the information receives the information from another body corporate. At the same time, the law allows transfer of SPDI only if the recipient ensures the same level of data protection. The two provisions are somewhat contradictory as one exempts onward transfers and the other appears to apply the rules to onward transfers.
Yes, SPDI cannot be collected unless the information is collected for a lawful purpose connected with a function or activity of the party collecting or using the information and the collection of the SPDI is considered necessary for that purpose. Apart from this, there are also notice and consent requirements.
Section 43A and the privacy rules relate to SPDI, which have a narrower meaning than personal information. Personal information is referred to in section 72A. See question 1 for definitions of both SPDI and personal information.
the name and address of the agency collecting or retaining the information.
Consent must be obtained from the provider of the SPDI regarding purpose of usage before collection of the information. Further, of the three grounds on the basis of which disclosure of SPDI is permitted to a third party, one relates to the provider of the information agreeing to the same and another relates to it being permitted under a contract with the provider.
There is no exemption to providing notice. It may be noted, however, that the privacy rules may not apply where the parties have agreed on their own terms of RSPP. The privacy rules also do not appear to apply to transfer of SPDI from one entity to another as opposed to from an individual provider of his or her own information to a data processor. It should also be noted that the privacy rules do not apply to the government.
No, the privacy rules do not offer individuals any degree of choice or control over the use of their information, although consent is required as to the purpose of the use so the individual may simply refuse to permit the use of his or her SPDI or withdraw his or her consent later. The collecting party then has the option not to provide the goods or services for which the information was sought.
The privacy rules deal with this only indirectly. As regards currency, the SPDI cannot be retained for longer than is required for the purpose for which the information can lawfully be used or is otherwise required under any other law for the time it is in force. As regards accuracy, the provider of the information has the right to review the information it provided and correct any inaccuracy. However, this appears to relate only to information provided by the individual and not information collected separately.
Yes, the privacy rules specify that the SPDI cannot be retained for longer than is required for the purpose for which the information can lawfully be used or is otherwise required under any other law currently in force.
the information collected is used for the purpose for which it has been collected.
There is no requirement however that the purpose of use must be specific in its description.
Section 43A refers to RSPP, which is determined by a law in force (of which there is none) or as agreed to by the parties and in the absence of both, the rules framed by the government, that is, the privacy rules. Accordingly, the parties can agree on the security standards to be adopted. The privacy rules do not stipulate a particular security standard (though that was what the rules were meant to do). The privacy rules merely suggest that IS/ISO/IEC 27001 or a code prescribed by an industry association and approved by the government could be used. So far, no code has been approved by the government.
The banking regulations require banks to follow ISO/IEC 27001 and ISO/IEC 27002. Similarly, the securities exchange regulations require stock exchanges, depositories and clearing corporations to follow standards such as ISO 27001, ISO 27002, COBIT 5, etc.
There are two situations in which data breach notifications apply. First, banks are required to notify the central bank, that is, the Reserve Bank of India, in case of any cybersecurity incident within two to six hours.
Second, the intermediaries, as part of their due diligence requirement in order to make use of safe harbour from content liability, are required to report cybersecurity incidents to the Computer Emergency Response Team (CERT) as soon as possible. This is not a mandatory requirement and is required only if the intermediaries intend to use the safe harbour protection from content liability.
The definition of 'intermediary' is wide and includes telecommunications companies, ISPs, network service providers, web hosts, search engines, online payment/auction sites, online marketplaces, etc.
The data breach notifications are somewhat unclear as to whether breach notifications are mandatory or not, since the actual language states that parties 'may' notify the CERT. More recently, the CERT has been taking the view that breach notifications are mandatory for all parties and not just for intermediaries.
attacks on applications such as e-governance, e-commerce, etc.
The Ministry of Communication and Information Technology has set up CERT under the IT Act. CERT is the nodal agency for resolving cybersecurity incidents in India. It is responsible for scanning cyberspace for cybersecurity vulnerabilities, breaches and malicious activity and can block web pages and websites.
The privacy rules provide for the need to appoint a grievance officer to address discrepancies and grievances of providers of information. There is no requirement for the appointment of a data protection officer.
No requirements have been prescribed for maintaining internal records or establishing internal processes or documentation except the suggestion in the privacy rules that IS/ISO/IEC 27001 is one such security standard that could be adopted.
There are no obligations in relation to new processing operations under the present law. A new privacy statue is under way and it may include obligations relating to new processing operations.
No, owners and processors of PII are not required to register with the supervisory authority.
There are no such duties imposed under the present law.
The law regulates the disclosure or transfer of the SPDI to a third party. This is possible if it has been agreed in a contract with the provider, it is necessary for compliance of a legal obligation or prior permission is given by the provider.
Further, the privacy rules prescribe that SPDI can be transferred only to a third party that observes the same level of data protection as provided by the privacy rules. Further, the privacy rules prescribe that transfer is permitted only if necessary for the performance of the contract with the provider or where the provider has consented to the transfer. At the same time, a clarification appears to suggest that some of the privacy rules apply only between the individual provider of the information and the owner of PII and not between two entities. The two provisions do not entirely read harmoniously together.
There are no restrictions other than those stated above.
SPDI or any information can be transferred to a person outside India if he or she ensures the same level of data protection as provided by the rules. Further, such transfer is permitted only if necessary for the performance of the contract with the provider or where the provider has consented to the transfer.
Further, Indian company law requires companies that maintain their books of accounts and books and papers in electronic form outside India to keep a backup of such books of accounts and books and papers in servers physically located in India.
No, transfer of PII does not require notification to or authorisation from a supervisory authority.
The law is not entirely clear on this matter. Transfer of SPDI to a third party can be done only if it agrees to ensure the same level of protection under the privacy rules. We believe that it follows, therefore, that if transfer of PII from the owner to a service provider is subject to restrictions, the restrictions should apply to a further transfer from the service provider to another service provider. It may also be noted that notice has to be given to the provider of the information of the name and address of every agency that will have access to such information. This would, therefore, cover onward transfers.
Yes, they have a right to access their personal information and also correct the same, but this appears to relate only to personal information provided by them and not personal information obtained separately.
By and large the rights of individuals are covered in the answers to the questions in this chapter.
Yes, the law provides for compensation to be paid if the owner is negligent in using RSPP to protect the SPDI and it results in a wrongful loss or wrongful gain. The terms 'wrongful gain' and 'wrongful loss' are not defined in the IT Act but are defined under the Indian Penal Code. 'Wrongful gain' is defined to mean gain by an unlawful means of property to which the person gaining is not legally entitled. 'Wrongful loss' means loss by unlawful means of property to which the person losing it is legally entitled. While the definitions in the penal code cannot entirely be accepted under section 43A, since the purpose of the provisions are different, we believe they do have some persuasive value. In our view, given the manner in which section 43A is constructed and the meaning of 'wrongful gain' and 'wrongful loss' under Indian laws, it is more likely that actual damage would be required.
Compensation can be awarded by the adjudicating officer if the claim for damages does not exceed 50 million rupees. If the claim exceeds 50 million rupees, the rights would be exercisable through the judicial system.
As stated in question 20, the privacy rules come out of the power of the government to prescribe what RSPP is. RSPP is as per a law in force or as agreed between the parties and only in the absence of both would the rules of the government (that is, the privacy rules) apply. Accordingly, if the parties (eg, employer and employee or service provider and customer) agree on the RSPP, then the privacy rules would not apply. Further, through the definition of body corporate, the privacy rules do not apply to the government.
Yes, decisions of the adjudicating officer can be appealed to the Cyber Appellate Tribunal. Decisions of the Cyber Appellate Tribunal can be appealed to the High Court.
Indian law does not deal with marketing through email or fax. In 2015, a badly worded provision that appeared to deal with spam was struck down by the Supreme Court of India as being unconstitutional.
Further, SMS messages can be sent if the message is transactional in nature. Transactional messages cover only prescribed areas that include information pertaining to goods or services sent by a business to its employees, agents or customers, information pertaining to a banking, securities or insurance account, information pertaining to air and rail travel schedules and reservations, information from an educational institution to parents and students, and information by e-commerce companies in relation to transactions. Regulations also allow messaging by identified social media organisations such as Facebook, Yahoo, etc. There are also limits on how many SMSs a non-telemarketer can send in a day.
Telemarketers who make marketing calls or send marketing messages are required to be registered with TRAI. They have to obtain separate telecom resources specifically for engaging in telemarketing. They also have to obtain separate telecom resources for sending transactional messages. They are required to scrub their databases with that of the Do Not Call registry regularly. The law requires the telecom service providers (Telcos) to have backend integration with the Do Not Call registry. As a consequence, if a message is sought to be sent to a person on the Do Not Call registry and the message is not transactional in nature or the message does not relate to an exception category selected by the person, the IT systems of the Telcos will automatically block the message.
Various penalties have been prescribed where telemarketers violate the regulations. Penalties for each violation start at 25,000 rupees for the first violation and go up to 250,000 rupees for the sixth violation. On the sixth violation, the telemarketer will be blacklisted and will not be permitted to use any kind of telecom resources in India.
India does not have any rules or regulations governing the use of cloud computing services. The TRAI has recently released a consultation paper on cloud computing. The consultation paper points out several issues relating to cloud services, such as interoperability, data security, data localisation, data ownership, cross-border movement of data and taxation of cloud services. The consultation paper is presently open for public comments, and based on the public comments and discussion with the stakeholders TRAI may soon come out with regulations governing the use of cloud computing services.
Data protection has been trending for the past several months in India. The Supreme Court of India in August 2017 delivered a landmark judgment recognising the right to privacy as a fundamental right. In addition, the government of India, a few months after the decision, in its efforts to frame a separate data protection law, issued a white paper on a data protection framework for India for public comments. The last date for public comments has lapsed and the government should be able to place the draft data protection bill soon.
The Ministry of Health and Family Welfare has published the draft Digital Information Security in Healthcare Act (DISHA), inviting public comments. The DISHA lays down provisions that regulate the generation, collection, access, storage, transmission and use of digital health data and associated personally identifiable information. It seeks to enable the digital sharing of personal health records with hospitals and clinics, and between hospitals and clinics. The DISHA appears to lay the groundwork for many health exchanges. However, there shall be no access to or disclosure of personally identifiable information to any third party.
The banking regulator has imposed data localisation restrictions; payment systems processors are required to store payment data within India.