white_paper_on_data_protection_in_india_171127_final_v2

Compensation as a remedy as stipulated under Section 43A of the IT Act appears to be rather
limited in its nature and scope. 867 In this regard, it is relevant to note that first, this provision
is applicable only where a body corporate 868 fails to maintain and implement reasonable
security practices and procedures. Consequently, Section 43A of the IT Act does not appear
to impose any liability to pay compensation on a government body/public authority in case of
breach of data protection obligations by such entities.
Second, Section 43A of the IT Act appears to be applicable only when a body corporate has
failed to maintain reasonable security practices and procedures as provided in an agreement
between the parties concerned or as may be specified under any law for the time being in
force, i.e., the SPDI Rules. It is unclear whether ―reasonable security practices and
procedures‖ referred to in Section 43A of the IT Act includes the various obligations under
the SPDI Rules or only the security practices and procedures specified in Rule 8 of the SPDI
Rules. 869 Concomitantly, even where one or more other obligations under the IT Act is
breached but there is no gain or loss in financial terms, Section 43A of the IT Act would not
be attracted. 870
4.6 International Practices
European Union
Under the EU GDPR 871 , an individual who has suffered ―material or non-material‖ damage as
a result of the infringement of the EU GDPR shall have the right to receive compensation
from the data controller or data processor for the damage suffered. It has been specified that a
data controller shall be liable for the damage caused by processing which infringes the EU
GDPR and that a data processor shall only be liable where it has acted in violation of any
obligation specifically applicable to data processors or has acted outside or contrary to any
lawful instruction provided by the data controller. Further, court proceedings for exercising
the right to receive compensation shall be brought before the competent courts in the Member
States.
867 The use of Section 43A, IT Act appears to be rather limited. A majority of the jurisprudence in this regard
appears to stem from orders passed by adjudicating officer in Maharashtra where cases pertain to fraudulent
transactions from bank accounts on account of failure to maintain reasonable security practices and
compensation may range from Rs. 5,000 to Rs. 40 lakhs. See Sreenidhi Srinivasan and Namrata Mukherjee,
‗Building An Effective Data Protection Regime‘, Vidhi Centre For Legal Policy 19 (January 2017) and also see
Chander Kalani & Anr. v. State Bank of India & Ors., Complaint No. 1 of 2014, Adjudicating Officer
(Maharashtra) Order dated 12 January 2015, available at:
https://it.maharashtra.gov.in/Site/Upload/ACT/DIT_Adjudication_Chander%20Kalani_Vs_SBI_Ors-
12012015.PDF, (last accessed 21 November 2017) and Amit Dilip Patwardhan v. Bank of Baroda, Complaint
No. 15 of 2013, Adjudicating Officer (Maharashtra) Order dated 30 December 2013, available at:
https://it.maharashtra.gov.in/Site/Upload/ACT/DIT_Adjudicaton_AmitPatwardhan_Vs_BankOfBaroda-
30122013.PDF, (last accessed 21 November 2017).
868 Explanation (i) to Section 43A, IT Act defines ―body corporate‖ as any company and includes a firm, sole
proprietorship or other association of individuals engaged in commercial or professional activities.
869 Sreenidhi Srinivasan and Namrata Mukherjee, ‗Building An Effective Data Protection Regime‘, Vidhi Centre
For Legal Policy 19 (January 2017).
870 Sreenidhi Srinivasan and Namrata Mukherjee, ‗Building An Effective Data Protection Regime‘, Vidhi Centre
For Legal Policy 19 (January 2017).
871 Article 82, EU GDPR.
198