A Bhubaneswar startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

You may be liable for the data leak depending on your role and the extent of negligence involved, while the company must take immediate steps to mitigate the situation and comply with legal obligations.

Under Indian law, particularly the Information Technology Act, 2000 (IT Act) and the rules framed therein, there are several considerations regarding data protection and liability:

• Responsibility of Employees: If you were involved in handling customer data and your actions led to the leak due to negligence, you could potentially be held liable under Section 43 of the IT Act, which deals with damage caused by a person who, without consent, accesses or secures access to a computer resource.
• Company's Liability: The company may also be held liable, particularly under Section 72 of the IT Act, which addresses penalties for breach of confidentiality and privacy. If the company failed to implement adequate security measures, it may face legal consequences.
• Data Protection Requirements: The company must comply with the provisions of the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. This includes implementing reasonable security practices to protect customer data.

In the event of a data breach, the company should take the following steps:

• Immediate Investigation: Conduct a thorough investigation to determine the cause of the data leak and assess its impact on customers.
• Notify Affected Parties: Inform the affected customers about the breach, detailing what information was leaked and the potential risks involved.
• Report to Authorities: Depending on the severity of the breach, report the incident to the CERT-In (Indian Computer Emergency Response Team) as mandated under Indian law.
• Enhance Security Measures: Review and enhance data protection measures and policies to prevent future incidents. This includes staff training on data handling practices.
• Legal Consultation: Seek legal advice to understand potential liabilities and compliance requirements, including possible penalties under the IT Act.

In summary, both the employee and the company may face legal consequences for a data leak, and immediate action is crucial to mitigate risks and comply with the applicable laws.