A Kanpur startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

As an employee of the startup in Kanpur that leaked customer data, your liability depends on your role and actions taken regarding data handling, while the company is primarily responsible under Indian law for the data breach.

Under the Information Technology Act, 2000 and the Indian Penal Code, 1860, the liability for data breaches can be categorized as follows:

• Company’s Liability:
  • The company may be held liable under Section 43 of the IT Act for failure to secure data, leading to loss or damage.
  • Under Section 66E, if the breach involved violation of privacy, the company could face criminal charges.
  • The company is also obligated to follow the data protection principles under Section 8 of the IT Act and ensure compliance with any applicable data protection regulations.
• Employee’s Liability:
  • If you acted negligently or intentionally caused the breach, you could potentially be held liable under Section 66 of the IT Act for hacking and unauthorized access.
  • If your actions were within the scope of your employment and followed company protocols, your liability may be limited.

To address the situation, the company should take the following steps:

• Immediate Action:
  • Secure the server and stop any further unauthorized access.
  • Conduct an internal audit to assess the extent of the data leak.
• Notify Affected Customers:
  • Inform customers about the data breach, detailing what information was compromised and the potential risks.
  • Provide guidance on steps customers can take to protect themselves.
• Compliance with Regulations:
  • Report the breach to the Cyber Crime Cell and other relevant authorities, as per Section 70B of the IT Act.
  • Review and enhance data security measures to prevent future breaches.
• Legal Consultation:
  • Engage a legal expert specializing in cyber law to navigate potential liabilities and compliance issues.

Taking these steps can help mitigate the damage and ensure compliance with the law, while also clarifying your position as an employee in this incident.