A Margao startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If a Margao startup you worked for leaked customer data on an open server, both you and the company may face legal implications under Indian law, particularly under the Information Technology Act, 2000 and the Indian Penal Code, 1860.

As an employee, your liability primarily depends on your role and actions regarding the data breach:

• Intent and Negligence: If the data leak occurred due to your negligence or intentional misconduct, you may bear some liability. The IT Act, 2000 under Section 43(a) specifies that if a person causes damage to a computer, computer system, or computer network, they are liable to pay damages.
• Role in Data Management: If you were directly managing or handling the customer data and failed to adhere to security protocols, your liability may be heightened. Section 66E of the IT Act penalizes violations of privacy, which could be applicable based on the circumstances of the leak.
• Vicarious Liability: Companies can be held vicariously liable for the actions of their employees if those actions were within the scope of employment. However, if you acted outside the scope of your duties, your liability may be reduced.

For the company, immediate action is critical to mitigate further damage and legal repercussions:

• Notification: The company must notify affected customers about the data breach as per the guidelines under the IT Act and the Personal Data Protection Bill (still pending in Parliament). Transparency is crucial.
• Investigation: Conduct a thorough investigation to determine how the breach occurred, identifying vulnerabilities in the data management system.
• Implement Security Measures: Based on the investigation, the company should enhance its data security protocols, including encryption, access controls, and regular audits to prevent future breaches.
• Legal Counsel: Consult with a legal expert specializing in cyber law to understand the implications of the breach and develop a response strategy, including potential liability and defense options.
• Compliance with Laws: Ensure compliance with applicable laws, including the IT Act, 2000, and any sector-specific regulations governing data protection in India.

In summary, both you and the company may have legal responsibilities stemming from the data leak, and prompt action can help in managing the situation effectively.