A Cuttack startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If a Cuttack startup you worked for leaked customer data on an open server, both you and the company may face legal consequences, depending on the circumstances surrounding the data breach.

Under Indian law, particularly the Information Technology Act, 2000, and the Personal Data Protection Bill (which is expected to become law), the handling of personal data is strictly regulated. Here are the key points to consider:

• Liability of Employees: If you were involved in the mishandling or misconfiguration of the server that led to the data leak, you could potentially be held liable under Section 43B of the Information Technology Act, which addresses damages for failure to protect data.
• Company's Responsibility: The startup, as a data controller, has a primary responsibility to ensure the security and confidentiality of customer data under Section 8 of the Personal Data Protection Bill.
• Data Breach Notification: The company is required to notify affected customers and the Data Protection Authority (once established) about the data breach as per the provisions of the Personal Data Protection Bill.
• Penalties: Under Section 66E of the Information Technology Act, unauthorized access to personal data can attract a punishment of up to three years of imprisonment or a fine, or both.
• Internal Investigation: The company should conduct a thorough internal investigation to assess how the breach occurred and identify the responsible parties.
• Remedial Measures: Implement immediate remedial measures, such as securing the server and reviewing data protection policies and practices.

In addition to the above actions, the company should also consider the following:

• Consult Legal Counsel: Engage a legal expert specializing in cyber law to navigate the implications of the breach and to understand potential liabilities.
• Review Employment Contracts: Evaluate your employment agreement to determine if there are any clauses related to data protection and your potential liability.
• Training and Awareness: Ensure that all employees receive training on data protection practices to prevent future incidents.

In conclusion, both you and the company have responsibilities regarding data protection. The startup must take immediate steps to mitigate the impact of the breach and comply with relevant legal obligations.