A company in Darjeeling leaked my personal data including Aadhaar and phone number in a breach. What is my remedy?

Detailed Legal Analysis

If a company in Darjeeling has leaked your personal data, including Aadhaar and phone number, you have several remedies available under Indian law, primarily under the Information Technology Act, 2000, and the Aadhaar Act, 2016.

Here are the steps you can take to seek redress:

• File a Complaint with the Company:
  • Contact the company’s grievance officer, as mandated by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
  • Provide a detailed account of the data breach, including all relevant details such as the nature of the data leaked and the impact it has had on you.
• Report to the Data Protection Authority:
  • If the company fails to address your complaint, you can escalate the matter to the Data Protection Authority of India (DPA), which is yet to be fully established under the Personal Data Protection Bill, 2019.
• File a Complaint with Cyber Crime Cell:
  • You can lodge a complaint with the local Cyber Crime Cell. Under Section 66E of the Information Technology Act, unauthorized access and violation of privacy can lead to penalties.
  • Provide all evidence related to the breach, including screenshots and communication with the company.
• Seek Legal Remedy:
  • If the issue remains unresolved, consider filing a civil suit for damages under Section 43 of the Information Technology Act, which provides for compensation for damages due to the failure of a service provider in maintaining security.
  • You may also explore provisions under the Consumer Protection Act, 2019, if you are a consumer of the company’s services.
• Contact the Unique Identification Authority of India (UIDAI):
  • Since your Aadhaar details are involved, you can also lodge a complaint with the UIDAI under Section 47 of the Aadhaar Act, 2016, which provides for penalties for unauthorized disclosure of Aadhaar information.

It is important to document all steps you take and maintain a record of communications for future reference. Taking prompt action is crucial in mitigating any potential harm caused by the data breach.