A Lucknow startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

You may be liable for the data leak depending on your role and actions, and the company must take immediate steps to mitigate the breach and comply with legal requirements.

Under the Information Technology Act, 2000, and the rules framed thereunder, particularly the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, both the company and individuals involved may face legal repercussions for data breaches.

Here are the key considerations regarding your potential liability and the actions the company should take:

• Understanding Your Liability:
  • If you had a direct role in the data management or security protocols, you might be held liable under Section 43 of the IT Act for negligence leading to the unauthorized access of data.
  • Section 66E of the IT Act provides for punishment for violation of privacy, which could involve individuals if personal data was mishandled.
  • Liability also depends on whether you acted in good faith or if there was a breach of your duty of care towards the customer data.
• Immediate Steps for the Company:
  • Notify affected customers about the data breach as per the provisions of the IT Act and the Personal Data Protection Bill (if enacted).
  • Conduct an internal investigation to ascertain the cause of the breach and the extent of the data compromised.
  • Implement measures to secure the server and prevent further unauthorized access.
  • Report the breach to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of becoming aware of the incident, as per the guidelines issued by the Ministry of Electronics and Information Technology.
  • Review and update data protection policies and practices to ensure compliance with applicable laws.
• Potential Legal Consequences:
  • Companies could face penalties under Section 43A of the IT Act for failure to protect sensitive personal data.
  • Depending on the nature of the breach, criminal liabilities could also arise under various sections of the IT Act.

It is advisable for both you and the company to seek legal counsel to navigate the complexities of cybersecurity laws and to mitigate any potential liabilities effectively.