A Gaya startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

In the scenario where a Gaya startup leaked customer data on an open server, liability may fall on both the individual who handled the data and the company itself, depending on the circumstances surrounding the data breach.

As an employee, your liability can be assessed based on your role and the nature of your actions. Under the Information Technology Act, 2000, particularly Sections 43 and 66, unauthorized access and data breaches can lead to penalties. If you were directly responsible for the leak, you might face consequences, but the company also has significant responsibilities under the law.

Here are key points regarding liability and steps the company should take:

• Company's Liability:
  • The company must adhere to the provisions of the Information Technology Act, 2000, which mandates due diligence in handling sensitive personal data.
  • Under Section 43A of the IT Act, companies that fail to protect personal data may be liable to pay compensation to affected individuals.
  • The company may also face penalties under the General Data Protection Regulation (GDPR) if it operates in jurisdictions where such regulations apply.
• Employee's Liability:
  • If you were negligent or acted outside your authority, you could be held liable under Section 66 of the IT Act for hacking or data theft.
  • However, if you were following company protocols, liability may primarily lie with the employer.
• Immediate Steps for the Company:
  • Secure the leaked data to prevent further unauthorized access.
  • Notify affected customers about the data breach as required under the IT Act.
  • Conduct a thorough investigation to determine the cause of the breach and identify responsible parties.
  • Implement stronger data protection policies and conduct employee training on data security.
  • Consider legal counsel to manage potential liabilities and regulatory compliance.
• Reporting Obligations:
  • Report the data breach to the Cyber Crime Cell or relevant authorities, as it may fall under the purview of criminal negligence.
  • Document all actions taken post-breach for legal and regulatory purposes.

In conclusion, both the startup and you may face various liabilities depending on the circumstances. It is crucial for the company to take immediate corrective actions and for you to seek legal advice based on your involvement.