A Amravati startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If the Amravati startup you worked for leaked customer data on an open server, the company may be liable under several provisions of Indian law, particularly the Information Technology Act, 2000, and the Personal Data Protection Bill, which is expected to become law soon. Your personal liability as an employee would depend on your role and whether there was any negligence or misconduct on your part.

Key points regarding liability and steps the company should take include:

• Legal Framework:
  • The Information Technology Act, 2000 governs cyber crimes and electronic commerce in India, particularly sections relating to data protection.
  • The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 outline the obligations of companies to protect sensitive personal data.
  • Under the upcoming Personal Data Protection Bill, organizations will have a duty to ensure data protection and may face penalties for data breaches.
• Company's Liability:
  • If the company failed to implement reasonable security measures, it may be held liable for data breaches under Section 43 of the IT Act.
  • Section 72A of the IT Act may impose liability on the company for wrongful disclosure of personal information.
  • The company may also face penalties under the Personal Data Protection Bill for non-compliance with data protection norms.
• Your Liability:
  • Your liability as an employee largely depends on whether you acted negligently or violated company policies regarding data handling.
  • If you were following protocols set by the company, your personal liability may be limited.
• Steps for the Company:
  • Immediately secure the server to prevent further unauthorized access.
  • Notify affected customers about the data breach and the nature of the leaked information.
  • Report the incident to the relevant authorities, such as the Data Protection Authority once the Personal Data Protection Bill is enacted.
  • Implement a data protection policy and conduct training for employees on data handling and security measures.
  • Consult legal counsel to assess potential liabilities and compliance with applicable laws.

In conclusion, while the company bears primary responsibility for data protection, your individual liability will depend on the circumstances of the breach and your actions as an employee.