A Rourkela startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

You may be liable for the data leak if negligence can be established, while the company has specific obligations under Indian law to address the breach and protect customer data.

Under the Information Technology Act, 2000, particularly Section 43 and Section 72, there are provisions that govern the unauthorized access and disclosure of personal data. If the startup you worked for failed to implement necessary security measures, they could be held liable for the breach. Here's a breakdown of the responsibilities and potential liabilities involved:

• Liability of the Employee (You):
  • If you were responsible for the management or security of the data, you could be held liable under Section 72 of the IT Act for disclosing personal information without consent.
  • Your liability may depend on whether you acted with negligence or breach of duty in handling customer data.
• Liability of the Company:
  • The company could face penalties under Section 43 of the IT Act for failing to maintain adequate security measures, resulting in loss or damage to customers.
  • Under the Personal Data Protection Bill (currently under consideration), if enacted, the company could face stricter regulations and penalties for data breaches.

Steps the Company Should Take:

• Immediate Assessment: Conduct a thorough investigation to understand how the data was leaked and the extent of the breach.
• Notify Affected Customers: Inform customers whose data has been compromised, as per the guidelines established under data protection laws.
• Report to Authorities: Depending on the severity, report the breach to the Cyber Crime Cell and other relevant authorities as required under Section 70B of the IT Act.
• Implement Security Measures: Review and enhance data security protocols to prevent future breaches, including encryption and regular audits.
• Legal Consultation: Seek legal advice to navigate potential liabilities and compliance with existing laws and upcoming data protection regulations.

In conclusion, both you and the company may have legal obligations and potential liabilities arising from the data leak. It is crucial to act promptly to mitigate the situation and comply with legal requirements.