What rights do I have if my data is misused internationally?

Question

Hi! I'm scared and frustrated. I recently found out that my personal data was leaked by a company based in the USA, and now it’s being sold without my consent. It feels like a violation of my privacy! I’m in Bangalore and I don’t know what my rights are under Indian law regarding international data misuse. Can I take legal action? What steps should I follow?

Adv. Rohit Verma · Accepted Answer

Hi there, I completely understand why you're feeling scared and frustrated. It's unsettling to know your personal data is being misused, especially when it involves an international entity. Let's break down what you can do from here.

Yes, you do have legal rights under Indian law to address the misuse of your data internationally. The key is understanding how these rights apply and what steps you can take.

Under the Information Technology Act, 2000, specifically Section 43A, companies handling sensitive data are required to implement reasonable security practices. If they fail to do so, and your data is compromised, you can seek compensation. Additionally, the Digital Personal Data Protection Act, 2023 reinforces the protection of personal data and provides a framework for redressal mechanisms.

Here's what you can do next:

Document Everything: Keep records of any communications, notices, or evidence of the data misuse. This will be crucial for any legal proceedings.
File a Complaint: You can file a complaint with the Cyber Crime Cell in your area. Visit cybercrime.gov.in to register your complaint online.
Notify the Company: Contact the company responsible for the data leak and demand an explanation and corrective action. It's important to have this communication in writing.
Consult a Lawyer: Since this involves cross-border data misuse, consulting a lawyer who specializes in international cyber law can provide guidance specific to your situation.

In my experience, international data misuse cases can be complex due to jurisdictional issues. However, it's important to assert your rights. Companies are becoming increasingly aware of the implications of data breaches and often prefer to settle matters to avoid reputational damage. Courts in India have been proactive in protecting data privacy, as seen in the landmark case Justice K.S. Puttaswamy (Retd.) vs Union of India (2017 SC), which recognized privacy as a fundamental right.

It's crucial to act swiftly as there might be time limitations on filing complaints or legal actions. Make sure you initiate these steps at the earliest to preserve your rights.

If you have more details or specific documents, feel free to share them here. The exact wording of any agreements or notices can significantly influence the course of action.

📚 References

Adv. Ramesh Srinivasan · Answer

You have a valid concern, but your options under Indian law are limited when it comes to international data misuse. Here's what you need to know. First, under Indian law, the Information Technology Act, 2000 provides some protection for data privacy. Specifically, Section 43A of the Act deals with compensation for failure to protect data. However, this primarily applies to body corporates within India. The Act does not have direct extraterritorial application to entities outside India, like a company based in the USA. Now, regarding international data misuse, your primary recourse would be through the jurisdiction where the company is based—in this case, the USA. You would need to look into U.S. laws such as the California Consumer Privacy Act (CCPA) or the General Data Protection Regulation (GDPR) if the company does business in the EU. Domestically, you can take the following steps: Contact the company directly: Demand that they cease the misuse of your data and request details on how your data was leaked. File a complaint with the relevant Data Protection Authority in the USA, if available. Consult with a lawyer who specializes in international privacy law to explore any further legal actions you can take in foreign jurisdictions. In terms of Indian legal recourse, you might consider filing a complaint with the Cyber Crime Cell of the Indian police. While they might not directly resolve the issue, they can provide guidance on how to proceed. For any legal action, be mindfu

Adv. Preeti Saxena · Answer

Hi there, I understand how distressing it can be to find out that your personal data has been misused, especially on an international scale. Let’s carefully consider the legal framework available under Indian law and the steps you might take. Firstly, under Indian law, your primary protection comes from the Information Technology Act, 2000, particularly the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These rules mandate that any entity handling sensitive personal data must implement reasonable security practices to protect it. However, when it comes to international data misuse, things can get complicated due to jurisdictional issues. You might face challenges in enforcing Indian laws against a company based in the USA. However, here are some steps you can consider: Contact the Company: Immediately contact the company and file a complaint. They may have specific procedures to address data breaches and may offer remedies. Data Protection Authority: Although India is yet to have a comprehensive data protection law akin to the GDPR in Europe, the proposed Personal Data Protection Bill, 2019 (not yet enacted) aims to address such concerns. Meanwhile, you can approach the Cyber Appellate Tribunal under the IT Act. Legal Action: You can file a complaint with the Cyber Crime Cell in Bangalore. Under Section 43A of the IT Act, companies are liable to pay compensation for failure to protect sensitive dat

Adv. Rajesh Agarwal · Answer

I'm sorry to hear about your situation. Data privacy is a significant concern, and while the misuse of data internationally can be complex, there are steps you can take under Indian law to address this issue. Firstly, under Indian law, the Information Technology Act, 2000 and its subsequent amendments govern data protection. Specifically, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 are relevant. These rules mandate that companies handling sensitive personal data must implement reasonable security practices. Under Section 43A of the IT Act, if a body corporate handling your data is negligent in implementing such practices, causing wrongful loss or gain, they are liable to compensate the affected party. Additionally, Section 72A of the same Act addresses punishment for disclosure of information in breach of lawful contract. Given that the data misuse occurred internationally, you may face jurisdictional challenges. However, you can still take the following steps: Contact the Company: Reach out to the company in the USA and formally request them to cease the misuse of your data and provide details of how the breach occurred. File a Complaint: Consider filing a complaint with the Ministry of Electronics and Information Technology (MeitY) which governs data protection in India. Legal Notice: Send a legal notice to the company demanding cessation of data misuse and compensation for damages. Consult

What rights do I have if my data is misused internationally?

Report Content