white_paper_on_data_protection_in_india_171127_final_v2

B. COMPENSATION
Awarding of compensation constitutes an important remedy where an individual has incurred
a loss or damage as a result of a data controller‘s failure to comply with the data protection
principles as set out under law.
4.5 Issues
The IT Act, albeit in a limited manner, in Section 43A, recognizes the right of an individual
to claim compensation in case of a failure to protect sensitive personal data. Section 43A of
the IT Act specifically stipulates that where a body corporate possessing, dealing or handling
any sensitive personal data or information in a computer resource which it owns, controls or
operates is negligent in implementing and maintaining reasonable security practices and
procedures 863 and thereby causes wrongful loss or wrongful gain to any person, such body
corporate shall be liable to pay damages by way of compensation to the person so affected. 864
Moreover, while adjudging the quantum of compensation payable under the IT Act, the
adjudicating officer shall have due regard to the following factors, namely: 865
(i)
(ii)
the amount of gain of unfair advantage, wherever quantifiable, made as a result of the
default;
the amount of loss caused to any person as a result of the default; and
(iii) the repetitive nature of the default.
From a plain reading of the above, it follows that Section 43A of the IT Act is triggered in
cases of negligence in maintaining and implementing reasonable security practices and
procedures and that such negligence has caused a wrongful loss or wrongful gain 866 to any
person.
863 As per Section 43A, IT Act, ‗reasonable security practices and procedures‘ may be specified in an agreement
between the parties or may be specified under law or in the absence of such agreement or any law, such
reasonable security practices and procedures as may be prescribed by the central government in consultation
with such professional bodies or associations as it may deem fit.
864 It is relevant to note that under Section 43, IT Act, if any person without the permission of the owner or any
other person who is in charge of a computer, computer system or computer network accesses or secures access
to such computer, computer system or computer network, downloads, copies or extracts any data or information
from the same, or provides any assistance to any person to facilitate access to the same in contravention to the
provisions of the IT Act shall be liable to pay damages by way of compensation to the person so affected.
865 Section 47, IT Act.
866 While there is no specific definition of the terms ‗wrongful loss‘ or ‗wrongful gain‘ under the IT Act, reliance
may be placed on Section 23, IPC which states as follows:
―“Wrongful gain” is gain by unlawful means of property to which the person gaining is not legally entitled.
“Wrongful loss”.—“Wrongful loss” is the loss by unlawful means of property to which the person losing it is
legally entitled.‖
197