By Alistair Maughan and Miriam Wugmeister of Morrison & Foerster and Mr. Diljeet Titus of Titus & Co. This article was written
with the kind assistance of Madhavi Batliboi, Morrison & Foerster
India has successfully claimed a significant share of the offshore business process outsourcing (BPO) market, but recently,
there have been allegations that call center employees there have stolen data entrusted to their employers. As a result, concerns
have risen about the security of data held by Indian service providers, and companies that outsource to India are seeking
out the remedies that are available to them to deal with and prevent the misuse of data in India.
Preventative Measures
The National Association of Software and Service Companies (Nasscom), one of the most recognized and vocal trade organizations
in the IT software and services industry in India, has established several measures to address data security concerns regarding
service-provider employees. Earlier this year, Nasscom launched a National Skills Registry for IT professionals to help employers
conduct background checks by tracking certain information about employees, such as employment history. More recently, Nasscom
announced plans to set up an independent, self-regulatory organization to set and monitor data security and privacy best practices
by outsourcing service providers in India.
Service providers in India are also increasingly adopting compliance programs and comprehensive security audits, including
personnel and equipment audits to prevent misuse of sensitive information and data. Compliance programs include training of
employees to enhance awareness of confidentiality and of managers with regard to securing computer systems, common threats
to information security, access-control techniques, risk assessment and management, intrusion detection, authentication and
other issues. Enforcement agencies in India also work with business process outsourcers to conduct workshops aimed at improving
employees’ knowledge and skills in the area of the misuse of data.
However, despite the preventative measures, non-Indian companies should still be aware of their remedies in the event of a
data security breach in India.
Laws Relating to Data Security in India
The Indian legal system is substantially based on the British common law system. While there is no omnibus Indian data security
law, there are several laws that apply to data theft or misuse in India. Typically, when an incident involving data occurs,
a complaint is filed for theft, cheating, criminal breach of trust, dishonest misappropriation of data and/or criminal conspiracy
under the provisions of the Indian Penal Code (IPC) of 1846 and for hacking under the Information Technology Act (ITA) of
2000. Many of these offenses under the IPC and the ITA allow for an arrest without a warrant, are nonbailable and carry penalties
that range from one year to life imprisonment, as well as fines.
Moreover, certain offenses carry higher penalties when the offender is an employee, a public servant, a merchant, an attorney
or an agent. For example, misappropriation of data by criminal breach of trust could lead to imprisonment for up to three
years. However, when the criminal breach of trust is carried out by an employee -- i.e., if the data is dishonestly misappropriated
and converted by an employee for his own use -- the penalty increases to imprisonment for up to seven years. Further, when
the offender is a public servant, merchant, attorney or agent, the penalty can be as high as life imprisonment.
In addition to these criminal affairs, civil proceedings for copyright infringement under the provisions of the Copyright
Act (CA) of 1957 and the Specific Relief Act (SRA) of 1963 are also typically initiated to prevent the misuse and dissemination
of data. The penalties under the CA and the SRA can range from hefty fines and damages to temporary and permanent injunctions.
Over and above the laws currently in place, the Indian government is in the process of amending the ITA to deal with data
privacy and security issues. The proposed amendments are currently being reviewed by the Ministry of Law, Justice and Company
Affairs before being presented to the Indian Parliament. They include provisions that would empower the central government
to make rules concerning control processes and procedures to ensure adequate integrity, security and confidentiality of electronic
records and rules prescribing modes of encryption for data security.
Enforcement Procedures
There are several options open to a company that is dealing with a data misuse or theft incident in India. Generally, a criminal
complaint under the provisions of the ITA, the IPC and the CA for theft, misappropriation or misuse of data and infringement
of copyright is filed with the police station that has jurisdiction over the area where the security breach occurred. The
local police officers, however, may not be in a position to properly investigate a data security incident, since not all officers
are adequately trained to deal with cybercrime cases.
Thus, in the alternative, the criminal complaint can be made to Anti Cyber-Crime Cells set up by the state police departments.
These Anti Cyber-Crime Cells have been established to investigate and prosecute cases of data theft and copyright infringement,
as well as other cybercrime cases. Anti Cyber-Crime Cells of several state police departments organize training programs for
investigators concerning data protection and use of advanced equipment to investigate data security incidents. In fact, the
U.S. Department of State recently trained Indian cybercrime investigators on investigating techniques. The officers at Anti
Cyber-Crime Cells have the power to seize infringing or stolen data by conducting searches and raids on the premises of the
alleged offenders and can also prosecute the offenders in the criminal court that has jurisdiction over the police station
where the complaint was registered. The law enforcement agencies also have the power to arrest offenders and keep them in
custody during the course of the investigation and prosecution unless bail is granted to the offenders by the court.
If a company believes that the local police station and/or the Anti Cyber-Crime Cell do not have the requisite expertise to
investigate a data security incident, the company may make a formal complaint with the Central Bureau of Investigations (the
CBI) of the government of India under the provisions of the ITA, the IPC and the CA. The CBI is an autonomous agency and has
professionally trained the Anti Cyber-Crime Units in various states to investigate data security incidents. If the officer
investigating the complaint determines that a prima facie offense has been committed, he can register the complaint and file
a charge sheet with the criminal court.
In addition, complaints alleging offenses under provisions of the ITA can also be made to the controller of certifying authorities.
Upon receipt of a complaint, the controller of certifying authorities investigates allegations and can order punishment of
an offender under the provisions of the ITA. Since the controller of certifying authorities is a quasi judicial authority,
an appeal against its orders can be made only in the State High Court.
Finally, in addition to or in lieu of a criminal complaint, a civil suit seeking damages and an injunction to restrain the
misuse and misapplication of data can be filed under the provisions of the CA and the SRA. A civil court can issue an interim
temporary injunction pending final adjudication of the civil suit.
Issues in the Indian Legal System
While several measures have been put in place to deal with data security issues, some concerns still remain regarding the
Indian legal system. Indian courts are overburdened – in 2005, the lower courts had over 20 million pending cases, while the
high courts had over 3 million. Delays in the system are common, and an average case can take several years to be resolved.
However, things are changing. Several measures are under way, and the prime minister and chief justice of the Indian Supreme
Court have committed to dealing with the issues facing the Indian courts. Further, the system itself, while slow, works. More
importantly, as previously discussed, several preventative measures are being put into place by the service providers themselves
to deal with data security and privacy issues.
Conclusion
Unfortunately, data breaches have occurred and will probably continue to occur in many parts of the world. Fortunately for
companies that have sent data to India -- whether via an offshore outsourcing or otherwise -- the government of India has
responded to the concerns raised about data security issues, and proven methodologies have been used and refined to minimize
the damage, punish the offender and deter the tempted. Obviously, there are many steps that a non-Indian company can and should
undertake to minimize its risk. For example, it can conduct due diligence and risk assessments when choosing service providers,
implement appropriate contractual measures designed to meet its objectives, monitor the service provider’s compliance and
make adjustments to reflect modified risks. A combination of all these measures should go a long way toward minimizing both
the incidence and consequences of data theft and misuse incidents in India.
