Data theft, cyber crime and data protection laws in India
2 lawyers have verified
Data theft is the act of stealing virtual information with an intent to compromise someone’s privacy or to obtain confidential information. Data theft could be with respect to stealing or hacking passwords, banking information, credit card information, personal information of users, information of importance to a corporate business, hacking into government databases, stealing photographs and misusing them and many more in line with these.
Data theft is a relatively new arena of crime in India. Owing to the sharp rise in use of internet and technology, a new era of virtual reality has come up. The virtual world has created a new breed of criminals, who take advantage of the vulnerability of computer programs and use it for their personal gain or just to cause mischief. Such criminal elements need to be punished so that the society can the citizens can live without fear.
With the growth of digital information and digital commerce, where our day to day lives are linked to the internet, transactions based over emails and networking sites, e-shopping sites being the trend, where businesses are based in a virtual space and everything is digitized, data theft remains a huge threat to people in general.
What is Data Theft?
The term ‘data theft’ is actually a misnomer. Under the Indian law, theft can only be committed in respect of movable property. Data is not a movable property, and hence the unauthorized act of taking away data electronically (by way of emailing it to oneself or by hacking into a computer system, for example) is not considered as theft. However, stealing of data is no doubt a crime, and is punishable under the law. As there is no single law yet that precisely deals with stealing of data, the act can be reported and punished under the umbrella of various other laws. The most relevant provisions in this respect are contained in the Indian Penal Code, 1860 (IPC), the Information Technology Act, 2000 (IT Act) and The Copyright Act, 1957.
What is data?
Under the Information Technology Act, 2000, ‘Data’ means a representation of information, knowledge, facts, concepts or instructions which are being prepared or have been prepared in a formalized manner, and is intended to be processed, is being processed or has been processed in a computer system or computer network, and may be in any form (including computer printouts, magnetic or optical storage media, punched cards, punched tapes) or stored internally in the memory of the computer.
Data is generally stolen:
by employees or contractors using it in the course of their official work.
through hacking of computer systems.
In the former case, it is advisable that the agreements with the employees and contractors contain suitable provisions which can establish a breach of trust for unauthorised use and access of data. These agreements should clearly record that there is an entrustment of data to these parties and should restrict the scope and manner in which they may deal with the data. For example: If the employee in question has signed a Non-Disclosure Agreement with regard to a particular project and then misuses that information by giving it to someone else or using it for his/her benefit, then he/she can be held criminally liable for breaching the terms under the NDA and thereafter be heavily penalized for the same.
What is the punishment for Data Theft?
The Indian law provides for punishments and penalties for data crimes in the Information Technology Act, 2000, thus creating a mode of redressal for crimes undertaken with the help of technology as well as internet. In cases of data theft, it is essential that proper charges are brought against the wrongdoers by seeking advice from an experienced lawyer. If not, then it may permit the culprits to escape the penalties and cause irreparable damage to the victim’s goodwill and operations.
The Act addresses the ever growing menace of cyber crimes. It is the primary law dealing with electronic commerce. The Act deals with punishments for:
Unauthorized access of a computer system,
Destruction of computer system software
Unauthorized download or copying of material
Tampering with computer source codes
Hacking into unauthorized computer system
Accessing data stored in protected system and misusing it. Protected system data is that data which is declared by the government as protected data.
Breach of confidentiality and privacy of data by a person who has been accorded powers under the IT Act.
The Indian Penal Code deals with 'theft' and punishment for theft of movable property which includes all corporeal property. This means that data, which is intangible, is beyond the scope of the Indian Penal Code. However, if the data is stored in a medium, for example: floppy disks, CD, pen drives, hard drives, etc., and then if that is stolen, then the relevant section pertaining to theft in the Indian Penal Code can be applied and the accused will be prosecuted in a criminal court and, if found guilty, will be criminally liable for the same.
If an issue arises with respect to data crime or any cyber crime related to misappropriation of data, then the aggrieved individual can make a complaint by way of a criminal complaint as well as a civil complaint depending on the nature of the crime, in the police station or a cyber cell in their city.
What are the charges that can be imposed against data criminal?
Given the emergence of data theft, the law enforcement machinery may sometimes be unsure about the legal nature of the damage caused to the victim. The charges against the thief are framed based on the statement of the victim. It is therefore necessary that the victim is aware of the basic laws relating to information abuse. Some of the charges that can be filed against the perpetrator of data theft are listed below.
Charge: Criminal Breach of Trust
Source: Section 405 and Section 408 of the IPC
Penalty: Imprisonment of up to 3 years, or fine, or both. If committed by an employee (servant), it attracts imprisonment of up to 7 years, or fine, or both.
What is Criminal Breach of Trust: : “Whoever, being in any manner entrusted with property, or with any dominion over property, dishonestly misappropriates or converts to his own use that property, or dishonestly uses or disposes of that property in violation of any direction of law prescribing the mode in which such trust is to be discharged, or of any legal contract, express or implied, which he has made touching the discharge of such trust, or wilfully suffers any other person so to do, commits ‘criminal breach of trust’ ”
Charge: Penalty and compensation for damage to computer, computer system
Source: Section 43 of the IT Act
Penalty: Compensatory penalty of up to Rs. 1 Crore.
Legal Provision: “If any person without permission of the owner or any other person who is in-charge of a computer, computer system or computer network -
(a) accesses or secures access to such computer, computer system or computer network or computer resource;
(b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium;
(c) introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network;
(d) damages or causes to be damaged any computer, computer system or computer network, data, computer data base or any other programmes residing in such computer, computer system or computer network;
(e) disrupts or causes disruption of any computer, computer system or computer network;
(f) denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means;
(g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made there under,
(h) charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network,
(i) destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means; (i) Steals, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used for a computer resource with an intention to cause damage, he shall be liable to pay damages by way of compensation not exceeding one crore rupees to the person so affected.”
Charge: Computer Related Offences
Source: Section 66 of the IT Act
Penalty: Imprisonment of up to 3 years, or fine of up to Rs. 5 Lakh, or both.
Legal Provision: “If any person, dishonestly, or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both.”
Charge: Infringement of Copyright
Source: Section 2(o) and Section 63 of the Copyright Act
Penalty: Monetary fine commensurate with the magnitude of the offense. Further, infringement of copyright is a criminal offence.
Legal Provision: “literary work” includes computer programmes, tables and compilations including computer data bases”
In addition to the above, if the stolen data is shared with other parties (such as competitors), the victim can bring an action of criminal conspiracy, collusion, and furtherance of common intention, which makes such other parties an accomplice in the commission of the stealing of data.
The Indian legal system is awakening to the threat of data theft. However, there is no clear law which defines this crime and its punishment. It is advisable to engage a suitable lawyer who can understand the circumstances of the crime and frame suitable charges to enable the police in taking the desirable action against the criminal.