Data Protection Law In India-Needs And Position

The age of Internet has taken on India to new heights of excellence in education, medicine, communication, public services and almost all walks of governance. In the IT sector, Indian professionals have built for themselves an enviable global reputation through hard work, dedication and commitment. Development in one sphere also has an impact over other spheres of life. This follows that with the increasing use of internet, need for changes in law is inevitable. Internet has in store a huge amount of data for different kind of people with different requirements. It has proved to be a boon in as much as it being used for the purpose of growth and development. The growing use of internet can be witnessed in e-Commerce. The problem that arises in e-Commerce is that the Internet is in itself global. In order to protect the misuse of data and information, data protection laws become very important.

At the outset it is needful to discuss briefly about Data Protection. Data Protection relates to issues relating to the collection, storage, accuracy and use of data provided by net users in the use of the World Wide Web. Visitors to any website want their privacy rights to be respected when they engage in e-Commerce. It is part of the confidence-creating role that successful e-Commerce businesses have to convey to the consumer. If industry doesn't make sure it's guarding the privacy of the data it collects, it will be the responsibility of the government and it's their obligation to enact legislation.

Any transaction between two or more parties involves an exchange of essential information between the parties. Technological developments have enabled transactions by electronic means. Any such information/data collected by the parties should be used only for the specific purposes for which they were collected. The need arose, to create rights for those who have their data stored and create responsibilities for those who collect, store and process such data. The law relating to the creation of such rights and responsibilities may be referred to as 'data protection' law.

The world's first computer specific statute was enacted in the form of a Data Protection Act, in the German state of Hesse, in 1970.[1] The misuse of records under the Nazi regime had raised concerns among the public about the use of computers to store and process large amounts of personal data.[2] The Data Protection Act sought to heal such memories of misuse of information. A different rationale for the introduction of data protection legislation can be seen in the case of Sweden which introduced the first national statute in 1973.[3] Here, data protection was seen as fitting naturally into a two hundred year old system of freedom of information with the concept of subject access (such a right allows an individual to find out what information is held about him) being identified as one of the most important aspects of the legislation.[4]

In 1995, the European Union adopted its Directive (95/46/EC) of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter, the Directive), establishing a detailed privacy regulatory structure.[5] The Directive is specific on the requirements for the transfer of data. It sets down the principles regarding the transfer of data to third countries and states that personal data of EU nationals cannot be sent to countries that do not meet the EU adequacy standards with respect to privacy.[6] In order to meet the EU adequacy standards, US developed a 'Safe Harbour'[7] framework, according to which the US Department of Commerce would maintain a list of US companies that have self-certified to the safe harbor framework. An EU organization can ensure that it is sending information to a U.S. organization participating in the safe harbor by viewing the public list of safe harbor organizations posted on the official website.

Data protection has emerged as an important reaction to the development of information technology. In India data protection is covered under the Information Technology Act, 2000 (hereinafter, the Act). The Act defines 'data' as, 'data' means a representation of information, knowledge, facts, concepts or instructions which are being prepared or have been prepared in a formalized manner, and is intended to be processed, is being processed or has been processed in a computer system or computer network, and may be in any form (including computer printouts magnetic or optical storage media, punched cards, punched tapes) or stored internally in the memory of the computer.[8] Protection of such data and privacy are covered under specific provisions in the Act.[9] In the recent past, the need for data protection laws has been felt to cater to various needs. The following analyses the position of data protection law with respect to some of the needs.

Data Protection Law In Respect of Information Technology Enabled Services (ITES)

Significance of ITES:-
India started liberalizing its economy in the 1990's and since then a huge upsurge in the IT business process outsourcing may be witnessed. Financial, educational, legal, marketing, healthcare, telecommunication, banking etc are only some of the services being outsourced into India. This upsurge of outsourcing of ITES into India in the recent past may be attributed to the large English-speaking unemployed populace, cheap labour, enterprising and hardworking nature of the people etc. Statistics have shown that the outsourcing industry is one of the biggest sources of employment. In a span of four years, the number of people working in call centers in the country supporting international industries has risen from 42,000 to 3,50,000.[10] Exports were worth $5.2 billion in 2004-2005 and are expected to grow over 40% this fiscal year.[11] US is currently the biggest investor in Indian ITES, taking advantage of cheap labour costs. Statistics indicate that software engineers with two-years experience in India are being paid about 1/5th of an equivalent US employee.[12]

Concerns about adequacy of law

BPO Frauds

With globalization and increasing BPO industry in India, protection of data warrants legislation. There are reasons for this. Every individual consumer of the BPO Industry would expect different levels of privacy from the employees who handle personal data. But there have been situations in the recent past where employees or systems have given away the personal information of customers to third parties without prior consent. So other countries providing BPO business to India expect the Indian government and BPO organizations to take measures for data protection. Countries with data protection law have guidelines that call for data protection law in the country with whom they are transacting.

For instance, in, the European Union countries according to the latest guidelines, they will cease to part with data, which are considered the subject matter of protection to any third country unless such other country has a similar law on data protection. One of the essential features of any data protection law would be to prevent the flow of data to non-complying countries and such a provision when implemented may result in a loss of "Data Processing" business to some of the Indian companies.

In the recent past, concerns have been raised both within the country as well as by customers abroad regarding the adequacy of data protection and privacy laws in the country.[13] A few incidents have questioned the Indian data protection and privacy standards and have left the outsourcing industry embarrassed. In June 2005, 'The Sun' newspaper claimed that one of its journalists bought personal details including passwords, addresses and passport data from a Delhi IT worker for £4.25 each.[14] Earlier BPO frauds in India include New York-based Citibank accounts being looted from a BPO in Pune and a call-center employee in Bangalore peddling credit card information to fraudsters who stole US$398,000 from British bank accounts.[15] UK's Channel 4 TV station ran broadcast footage of a sting operation exposing middlemen hawking the financial data of 200,000 UK citizens. The documentary has prompted Britain's Information Commissioner's Office to examine the security of personal financial data at Indian call centers.[16]

In the absence of data protection laws, the kind of work that would be outsourced to India in the future would be limited. The effect of this can be very well seen in the health-care BPO business, which is estimated to be worth close to $45 billion. Lack of data protection laws have left Indian BPO outfits still stagnating in the lower end of the value chain, doing work like billing, insurance claims processing and of course transcription. Besides healthcare, players in the retail financial sector are also affected. Financial offshoring from banks is limited because of statutory compliance requirements and data privacy laws protecting sensitive financial information in accounts. In the Human Resource (HR) domain, there are many restrictions on sharing of personal information. In the medical domain, patient history needs to be protected. In credit card transactions, identity theft could be an issue and needs to be protected. Companies in the banking, financial services and insurance (BFSI) sector and healthcare have excluded applications/processes which use sensitive information from their portfolio for offshoring till they are comfortable about the data protection laws prevalent in the supplier country.

Since there is lack of data protection laws in India, Indian BPO outfits are trying to deal with the issue by attempting to adhere to major US and European regulations. MNCs have to comply with foreign Regulations so that they don't lose on their international partners. There are problems involved in this. Efforts by individual companies may not count for much if companies rule out India as a BPO destination in the first place in the absence of data protection law.
Today, the largest portion of BPO work coming to India is low-end call centre and data processing work. If India has to exploit the full potential of the outsourcing opportunity, then we have to move up the value chain. Outsourced work in Intellectual Property Rights (IPR)-intensive areas such as clinical research, engineering design and legal research is the way ahead for Indian BPO companies. The move up the value chain cannot happen without stringent laws. Further, weak laws would act as deterrents for FDI, global business and the establishment of research and development parks in the pharmaceutical industry.

Looking to the above scenario, we can say that for India to achieve heights in BPO industry stringent laws for data protection and intellectual property rights have to be made. . Thus, a law on data protection on India must address the following Constitutional issues on a "priority basis" before any statutory enactment procedure is set into motion:
(1) Privacy rights of interested persons in real space and cyber space.
(2) Mandates of freedom of information U/A 19 (1) (a).
(3) Mandates of right to know of people at large U/A 21.

Once the data protection rules are enforced in India, companies outsourcing to India are unlikely to dismantle the systems they have in place straightaway, and move data more freely to India. Hence ,the need for data protection laws would win over the confidence of international business partners; protect abuse of information; protection of privacy and personal rights of individuals would be ensured; there would be more FDI inflows, global business and the establishment of research and development parks in the pharmaceutical industry & impetus to the sector of e-Commerce at national and international levels would be provided.

Data protection law in India (Present status):-
Data Protection law in India is included in the Act[17] under specific provisions. Both civil and criminal liabilities are imposed for violation of data protection.
(1) Section 43 deals with penalties for damage to computer, computer system etc.

(2) Section 65 deals with tampering with computer source documents.

(3) Section 66 deals with hacking with computer system.

(4) Section 72 deals with penalty for breach of confidentiality and privacy. Call centers can be included in the definition of 'intermediary'[18] and a 'network service provider' and can be penalized under this section.

These developments have put the Indian government under pressure to enact more stringent data protection laws in the country in order to protect the lucrative Indian outsourcing industry. In order to use IT as a tool for socio-economic development, employment generation and to consolidate India's position as a major player in the IT sector,[19] amendments to the IT Act, 2000 have been approved by the cabinet[20] and are due to be tabled in the winter session of the Parliament.[21]

Proposed amendments:-
The amendments relate to the following[22]:
(i) Proposal at Sec. 43 (2) related to handling of sensitive personal data or information with reasonable security practices and procedures.
(ii) Gradation of severity of computer related offences under Section 66, committed dishonestly or fraudulently and punishment thereof.
(iii) Proposed additional Section 72 (2) for breach of confidentiality with intent to cause injury to a subscriber.
It is hoped that these amendments will strengthen the law to suffice the need.

Data Protection Laws In Order To Invite 'Data Controllers'.[23]
There has been a strong opinion that if India strengthens its data protection law, it can attract multi-national corporations to India. India can be home to such corporations than a mere supplier of services.

In fact, there is an argument that the EU's data protection law is sufficient to protect the privacy of its people and thus lack of strong protection under Indian law is not a hindrance to the outsourcing industry. To enumerate, consider a company established in EU (called the 'data controller') and the supplier of call center services ('data processor') in India. If the data processor makes any mistake in the processing of personal data or there are instances of data theft, then the data controller in the EU can be made liable for the consequences. The Indian data processor is not in control of personal data and can only process data under the instructions of the data controller. Thus if a person in EU wants to exercise rights of access and retrieve personal data, the data controller has to retrieve it from the data processor, irrespective of where the data processor is located. Thus a strong data protection law is needed not only to reinforce the image of the Indian outsourcing industry but also to invite multi-national corporations to establish their corporate offices here.

Data Protection And Telemarketing

India is faced with a new phenomenon-telemarketing. This is facilitated, to a large extent, by the widespread use of mobile telephones. Telemarketing executives, now said to be available for as low as US $70 per month,[24] process information about individuals for direct marketing. This interrupts the peace of an individual and conduct of work. There is a violation of privacy caused by such calls who, on behalf of banks, mobile phone companies, financial institutions etc. offer various schemes. The right to privacy has been read into Article 21, Constitution of India, but this has not afforded enough protection. A PIL against several banks and mobile phone service providers is pending before the Supreme Court alleging inter alia that the right to privacy[25] has been infringed.

The EC Directive confers certain rights on the people and this includes the right to prevent processing for direct marketing.[26] Thus, a data controller is required not to process information about individuals for direct marketing if an individual asks them not to. So individuals have the right to stop unwanted marketing offers. It would be highly beneficial that data protection law in India also includes such a right to prevent unsolicited marketing offers and protect the privacy of the people.

Data Protection With Regard To Governance And People

The Preamble to the Act specifies that, the IT Act 2000, inter alia, will facilitate electronic filing of documents with the Government agencies. It seeks to promote efficient delivery of Government services by means of reliable electronic records. Stringent data protection laws will thus help the Government to protect the interests of its people.

Data protection law is necessary to provide protection to the privacy rights of people and to hold cyber criminals responsible for their wrongful acts. Data protection law is not about keeping personal information secret. It is about creating a trusted framework for collection, exchange and use of personal data in commercial and governmental contexts. It is to permit and facilitate the commercial and governmental use of personal data.
Conclusion:
The stringency of data protection law, whether the prevailing law will suffice such needs, whether the proposed amendments are a welcome measure, whether India needs a separate legislation for data protection etc are questions which require an in-depth analysis of the prevailing circumstances and a comparative study with laws of other countries. There is no consensus among the experts regarding these issues. These issues are not in the purview of this write-up. But there can be no doubt about the importance of data protection law in the contemporary IT scenario and are not disputable.

endnotes
[1] See Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), available at http://www.iuscomp.org/gla/statutes/BDSG.htm
[2] Parag Diwan and Shammi Kapoor, Cyber and e-commerce laws, 2nd ed., [2000], p.4
[3] See Freedom of Speech, The EU Data Protection Directive and the Swedish Personal Data Act, available at www.dsv.su.se/jpalme/society/eu-data-directive-freedom.html
[4] Parag Diwan and Shammi Kapoor, Cyber and e-commerce laws, 2nd ed., [2000], p.4.
[5]See Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:NOT
[6] See Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Art. 25(2), available at http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:NOT
[7] See Safe Harbor Overview, available at http://www.export.gov/safeharbor/index.html
[8] See The Information Technology Act, 2000, Sec. 2(1)(o)
[9] See The Information Technology Act, 2000, Sec. 43, Sec. 65, Sec. 66, Sec. 72
[10] See How secure are India's call centers- Soutik Biswas, available at http://news.bbc.co.uk/2/hi/south_asia/4619859.stm
[11] <ùáৡ>Id.
[12] See Data protection and offshoring to India, available at http://www.out-law.com/page-3608
[13] See India tightens Data Protection law available at http://www.atimes.com/atimes/South_Asia/HJ20Df01.html
[14] See How secure are India's call centers- Soutik Biswas, available at http://news.bbc.co.uk/2/hi/south_asia/4619859.stm
[15] See India tightens Data Protection law available at http://www.atimes.com/atimes/South_Asia/HJ20Df01.html
[16] Id.
[17] See The Information Technology Act, 2000.
[18] See The Information Technology Act, 2000, Sec. 2(1)(w).
[19] See Press Information Bureau, Government of India, Expert Committee on Amendments to IT Act, 2000 submits its report, August 29th, 2005, available at http://www.mit.gov.in/itact2000/PressRelease.doc[20] See Tougher IT law for Data Protection Soon, available at <http://content.msn.co.in/Technology/technologyIANS_171006_155.htm,>
[21] See India to amend IT Act for data protection, available at http://timesofindia.indiatimes.com/articleshow/2177219.cms
[22] See Report of the Expert Committee, Proposed Amendments to Information Technology Act 2000, Summary, August 2005, available at http://www.mit.gov.in/itact2000/Summary-final.doc
[23] See Data protection and offshoring to India, available at http://www.out-law.com/page-5013
[24] See Does India need a separate data protection law?, available at http://www.knspartners.com/files/BNA%20Article-180106.pdf
[25] See Mr. X v. Hospital Z, (1998) 8 SCC 296. The right to privacy is enshrined in Article 21 of the Constitution of India.
[26] See Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Art. 14.

The author can be reached at: [email protected] / Print This Article

Follow the Procedure Below To Submit Your Articles

Submit your Article by using our online form Click here
Note* we only accept Original Articles, we will not accept Articles Already Published in other websites.
For Further Details Contact: [email protected]

Divorce by Mutual Consent in Delhi/NCR

Right Away Call us at Ph no: 9650499965

Articles of Yesteryears

Click on the link Below to check articles submitted in previous years:
Latest Articles - Law Articles 2017 - Law Articles 2016 - Law Articles 2015 - Law Articles 2014 - Law Articles 2013 - Law Articles 2012 - Law Articles 2011 - Law Articles 2010 - Law Articles 2009 - Law Articles 2008 - Articles 2007 - Law Articles 2006 - Law Articles 2000-05 - Archive