Data Privacy
Data protection law is necessary to provide protection to the privacy rights of people and to hold cyber criminals responsible for their acts. Data protection law is not about keeping personal information secret. It is about creating a trusted environment for collection, exchange and use of personal data in social welfare, governmental or commercial contexts. It is to permit and facilitate the use of personal data without violating any person’s right to privacy.
The Constitution of India does not patently grant the fundamental right to privacy. However, the courts have read the right to privacy into the other existing fundamental rights, ie, freedom of speech and expression under Art 19(1)(a) and right to life and personal liberty under Art 21 of the Constitution of India. However, these Fundamental Rights under the Constitution of India are subject to reasonable restrictions given under Art 19(2) of the Constitution that may be imposed by the State. Recently, in the landmark case of Justice K S Puttaswamy (Retd.) & Anr. vs. Union of India and Ors., the constitution bench of the Hon'ble Supreme Court has held Right to Privacy as a fundamental right, subject to certain reasonable restrictions.
This law is based on principles. There are eight principles which are enumerated as below:
- There should be strict check on the limit of collection of personal data. Such data should be obtained by lawful and fair means with the consent of the individual.
- The personal information should be accurate and relevant and should be used for the stated purpose.
- The purposes should be specified at the time of collection of data without any ambiguity.
- The information must be secured and protected. Data collector must ensure the safety of the information and reasonable safeguard.
- There should be no secrecy while collecting data. The purpose of collecting data must be made clear, stating for what purpose their information is being collection, where it will be used, whether they will retain the information or not. Etc.
- Organization will be held liable in case of any abuse of their data and personal information.
- Each individual have right to be involved. An individual have right to access to his/her information and change it. Can also ask that information to be deleted from the database also its rectification or completion.
- Information must be collected in good faith. The intention behind collecting the information should be bona fide. One’s information should not be used against them or to harm other.
- Accesses or secures access to such computer, computer system or computer network;
- downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium;
- Introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network;
- damages or causes to be damaged any computer, computer system or computer network, data, computer data base or any other programmes residing in such computer, computer system or computer network;
- Disrupts or causes disruption of any computer, computer system or computer network;
- Denies or causes the denial of access to any person authorized to access any computer, computer system or computer network by any means;
- Provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder;
- Charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network, he/she shall be liable to pay damages by way of compensation not exceeding one crore rupees to the person so affected.
Government of India law on Data Protection:
In India there is no specified legislation for privacy and data protection. However, the Information Technology Act, 2000 contains specific provisions intended to protect electronic data (including non-electronic records or information that have been, are currently or are intended to be processed electronically).
India’s IT Ministry adopted the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules (Privacy Rules). The Privacy Rules, which took effect in 2011, require corporate entities collecting, processing and storing personal data, including sensitive personal information to comply with certain procedures. It distinguishes both ‘personal information’ and ‘sensitive personal information’.
In August 2011, Indian Ministry of Communications and Information Technology issued a ‘Press Note’ (Clarification on the Privacy Rules), which provides that any Indian outsourcing service provider/organisation providing services which involves collection, compilation, storage, dealing/handling or accessing of sensitive personal information or personal information under contractual obligation with any legal entity located within or outside India is not subject to collection and disclosure of information requirements, including the consent requirements discussed below, provided that they do not have direct contact with the data subjects (data subject refers to providers of information) when providing their services.
Information Technology Act
Penalty for damage to computer, computer system, etc. in Section 43 states that, if any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network, —
Section 72A talks about Penalty is in the form of a civil liability
Any corporate which, fail to observe data protection norms may be liable to pay compensation if they are negligent in implementing and maintaining reasonable security practices and thereby cause wrongful loss or wrongful gain to any person, body corporates may be exposed to criminal liability under Section 72A of the IT Act, if they disclose personal information with the intent of causing wrongful loss or obtaining a wrongful gain.
Section 72: Penalty for breach of confidentiality and privacy. States that “Save as otherwise provided in this Act or any other law for the time being in force, any person who, in pursuance of any of the powers conferred under this Act, rules or regulations made thereunder, has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned discloses such electronic record, book. Register, correspondence, information, document or other material to any other person shall be punished with imprisonment for a term which may extend to two years, or with fine which may extend to one lakh rupees, or with both.”
Data protection is one of the most important part of the right to privacy as a data protection law will protect your personal information, which is collected, processed and stored by "automated" means or intended to be part of a filing system.
