As stated in our answer to question 1.4 above, there is currently no specialised data protection authority. SPDI providers may refer their complaints about the handling of IDPS to the “complaints officers” of the collection agencies designated under the SPDI Rules. Complaints regarding the payment of compensation instead of SPDI`s non-protection may also be brought by aggrieved persons before the arbitrator appointed under the Information Technology Act. Other criminal proceedings for unlawful disclosure of SPDI may be initiated with law enforcement authorities. Cybersecurity incidents related to unauthorized access to computer systems/data and compromise of information may also be reported by relevant individuals or organizations to Computer Emergency Response Team – India (“CERT-IN”). According to SPDI rules, sensitive personal data or information must only be collected for lawful purposes related to a function or activity of the entity (or a person acting on its behalf), and the collection of the data must be necessary for this purpose. Biometric data: According to the draft law, “biometric data” is defined as facial images, fingerprints, iris scans or similar personal data resulting from measurements or technical processing operations carried out on physical, physiological or behavioural characteristics of a payer that enable or confirm the unique characteristics of the client. “Biometrics” is defined in the IDPS as technologies that measure and analyze human body characteristics such as fingerprints, retina and iris of the eyes, voice patterns, facial patterns, hand measurements, and DNA for authentication purposes. These developments are the result of the rapid adoption of technologies driven by vast data exchange networks created by private and public entities. These networks rely on the personal data of individuals.

In the absence of adequate privacy safeguards, there is a risk that personal data will be exposed to unauthorised access. The Data Protection Act defines personal data as any information relating directly or indirectly to an identified or identifiable natural person, in particular by reference to an identification number or to one or more elements that are the expression of his physical, physiological, mental, economic, cultural or social identity. Sensitive data: According to SPDI rules, “sensitive personal data or data” means passwords, financial information, physical, physiological, or mental health conditions, sexual orientation, medical records and background, and biometric information. However, this does not include personal data that is freely available or publicly available and provided in accordance with the Right to Information Act 2005 or any other applicable law. In such cases, penalties of up to a higher amount of INR 15 crore (approximately USD 2 million) or 4% of a data custodian`s total global revenue have been proposed under the PDP Act. The scope of the assessment would include transparency of data processing activities, the establishment of a privacy policy or policy, the consent mechanism, and rights management to help users modify or delete their data. The task force would also investigate the violation of purpose limitation requirements, as customer data is often used to harass them. The U.S. government is seeking a court order before accepting a mutual legal assistance request from India.

A U.S. court will consider whether the Indian claim meets the relevant legal requirements under U.S. law before issuing the relevant order. Once the order is placed, the U.S. service provider produces the required data and shares it with the U.S. Department of Justice for legal compliance verification before finally handing it over to India. This is a lengthy process that usually takes several months – and the lack of quick access to data can thwart any investigation. India, the world`s fastest-growing market for new internet users, has seen an explosion of personal data as millions of new users have logged in and used hundreds of free and paid apps that store data.

The Electronic Communications Act defines a personal data breach as any breach of security resulting in the destruction, loss, alteration or unauthorised, accidental or unlawful disclosure, or access to personal data transmitted, stored or processed in the course of providing a publicly available electronic communications service. After at least five years of privacy debates, intense pressure in Silicon Valley, and internal power struggles within India`s political apparatus, the world`s second most populous country is now back on a blank sheet of comprehensive data protection legislation. The rejection of the bill is a mixed outcome for everyone – Indian citizens, for example, will not have protection from corporate surveillance in the bill, although they also avoid the fallout from state surveillance – and only signals more turbulence in India`s privacy technology policy in the coming years. And because India is an influential tech player trying to put its flag on a “fourth way” of data governance, it also means more confusion around the world. The PDP bill proposes that the processing of employees` personal data be justified in situations where, given the relationship between the employee and the employer, it would be inappropriate to obtain the employee`s consent. Finally, personal data is protected by indirect guarantees developed by the courts in accordance with ordinary law, the principles of fairness and the law of breach of trust. In a landmark August 2017 decision (Justice K.S. Puttaswami & another vs.

Union of India), the Supreme Court of India recognized the right to privacy as a fundamental right under Article 21 of the Constitution as part of the right to “life” and “personal liberty”. “Protection of personal information” has been recognized as a facet of the right to privacy, and the Court has held that information about an individual and the right of access to that information must also ensure the protection of privacy (“Privacy Judgment”). The Court stated that every individual should have the right to control the commercial use of his or her identity and that the “right of individuals to use their identity and personal information exclusively for commercial purposes, to control the information available about them on the Internet, and to disseminate certain personal information only for limited purposes” flows from this right. This is the first time that the Supreme Court has explicitly recognized the individual`s right to personal data. 3.1 Do data protection laws apply to companies established in other jurisdictions? If so, under what circumstances would a company established in another country be subject to these laws? Currently, this area is governed by the Information Technology Act and the Information Technology (Reasonable Security Practices and Procedures) and Data or Sensitive Personal Information Rules, 2011. Section 43A of the Information Technology Act allows a data controller to claim compensation for the unauthorized disclosure of sensitive personal data. Section 72A is the criminal provision under which a person, including an intermediary, who discloses sensitive personal data without consent may be punished by imprisonment or a fine. The controller is obliged to document the measures it has taken to ensure the protection of personal data in accordance with the law and other legal provisions. Section 43A of the Information Technology Act provides that entities that possess, process or handle sensitive personal data or information in a computing resource that they own, control or operate are required to compensate data subjects if they are negligent in implementing and maintaining appropriate security practices and procedures to protect sensitive personal data or information. The Commissioner defined cookies in an online dictionary as data stored on the computer that contains certain information. This rudimentary definition is supplemented by a brief explanation indicating that cookies allow each server to know which pages have been visited recently by simply reading them.

In general, India`s data protection requirements can be found in several different sources, including: 1. Section 43A – Indemnification for Non-Data Protection. According to the draft law, the DPA`s main task is to issue regulations to put the provisions of the law into practice, protect the interests of data controllers, prevent misuse of personal data, ensure compliance with the law, and promote privacy awareness. In addition, some of its other duties and responsibilities include: According to the bill, “sensitive personal data” is defined as personal data that may disclose, relate to, or represent financial data, health data, official identifiers, sex life, sexual orientation, biometric data, genetic data, transgender or intersex status. caste or tribe, or religious or political beliefs or affiliations. The government has the right to define additional categories of sensitive personal data. Modern Indian case law on data protection and privacy is based on the decision of the Supreme Court of India (`the Supreme Court`) in Justice K S Puttaswamy and Anr v Union of India and Ors [Writ Petition (Civil) No 494 of 2012] (“Puttaswamy”). In the Puttaswamy case, the Supreme Court held unanimously that the right to privacy is an essential element of the promise of the right to life and personal liberty protected by section 21 of the Constitution and that it essentially includes a negative obligation not to violate the right to privacy and a positive right to take all necessary measures to protect the right to life. private.

Puttaswamy changed the contours of India`s data protection law, the interpretation of existing data protection rules, and raised the specter of a robust breach of privacy at common law, regardless of legal rules. The Data Protection Act defines sensitive data as any information concerning a natural person relating to his or her racial or ethnic origin, political opinions, trade union membership, religious or philosophical beliefs, law enforcement, as well as data concerning his or her health and sex life.