A Shillong startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If customer data has been leaked on an open server by a startup in Shillong, both the company and potentially individual employees may be liable depending on their roles and actions regarding data security. Under Indian law, particularly the Information Technology Act, 2000, and the rules framed therein, companies must adhere to specific data protection obligations.

As an employee, your liability can depend on whether you acted negligently or failed to comply with the company's data protection policies. However, the primary responsibility typically lies with the employer, especially if they failed to implement adequate security measures.

Here's a breakdown of the implications and actions that need to be taken by the company:

• Assess the Breach: The company should conduct a thorough assessment of how the breach occurred, the type of data leaked, and the number of affected customers.
• Notify Authorities: Under the IT Act, particularly Section 70B, if sensitive personal data or information (SPDI) is compromised, the company is obliged to inform the Indian Computer Emergency Response Team (CERT-IN) and possibly the affected customers.
• Implement Corrective Measures: The company must take immediate steps to secure the server and prevent further data leaks, including fixing vulnerabilities and enhancing security protocols.
• Document the Incident: Maintain detailed records of the incident, including the investigation process, communications with affected parties, and any remedial actions taken.
• Legal Compliance: Familiarize with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which mandates the implementation of reasonable security practices to protect customer data.
• Potential Liabilities: The company may face penalties under Section 43 and Section 66 of the IT Act for failure to secure data. Employees may also face disciplinary action if negligence is proven.
• Communication Strategy: Develop a communication plan that addresses how the breach will be communicated to affected customers and the public to maintain trust and transparency.
• Review Policies: The company should review and update its data protection policies and employee training programs to prevent future incidents.

In conclusion, while you may have some level of responsibility, the primary obligation to protect customer data lies with the company. It is crucial for the startup to act swiftly and in compliance with the law to mitigate potential damages and liabilities.