white_paper_on_data_protection_in_india_171127_final_v2

C. OFFENCES
There are certain types of breaches of data protection obligations, which, by their very nature
and the impact they create, are extremely serious and may cause significant harm to
individuals. In these instances, it may be imperative to prescribe criminal sanctions in the
form of punishment and severe fines on the data controller.
4.9 Issues
The IT Act deals extensively with several types of offences or cybercrimes and prescribes
penalty in the form of fines or imprisonment or both. 878 Specifically in the context of data
protection, Sections 72 879 and 72A 880 of the IT Act offer some redress. Section 72 of the IT
Act is limited in scope as it prescribes a penalty only against those persons who have been
given the power under the IT Act or the rules and regulations made thereunder to access any
electronic resource. As such, it may be limited to functionaries who have been granted
specific powers under the provisions of the IT Act. 881 Section 72A of the IT Act is broader in
scope as it imposes a penalty on any person, whether a private or public entity, for the
disclosure of personal information without the consent of the person concerned. However,
Section 72A of the IT Act is triggered only in those instances where the person (who has
disclosed the personal information) has secured access to such personal information while
providing services under the terms of a lawful contract.
Rapid growth of technological advancements which may be utilised towards processing of
personal information increases the risk of data protection violations. Consequently, provisions
in a data protection legal framework may be required to carefully set out criminal liability in
cases of data protection violation. Moreover, criminal sanction in the form of imprisonment
and fines may be prescribed to ensure that it adversely affects the data controller financially
and reputationally thereby serving some deterrent value.
878 This includes Section 65 (tampering with computer source documents), Section 66 (computer related
offences), Section 66B (punishment for dishonestly receiving stolen computer resource or communication
device), Section 66C (punishment for identity theft), Section 66D (punishment for cheating by personation by
using computer resource), Section 66E (punishment for violation of privacy), Section 66F (punishment for cyber
terrorism) and Section 67 (punishment for publishing or transmitting obscene material in electronic form).
879 Section 72, IT Act provides as follows:
―Save as otherwise provided in this Act or any other law for the time being in force, if any person who, in
pursuance of any of the powers conferred under this Act, rules or regulations made thereunder, has secured
access to any electronic record, book, register, correspondence, information, document or other material
without the consent of the person concerned discloses such electronic record, book, register, correspondence,
information, document or other material to any other person shall be punished with imprisonment for a term
which may extend to two years, or with fine which may extend to one lakh rupees, or with both.‖
880 Section 72A, IT Act provides as follows:
―Save as otherwise provided in this Act or any other law for the time being in force, any person including an
intermediary who, while providing services under the terms of lawful contract, has secured access to any
material containing personal information about another person, with the intent to cause or knowing that he is
likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in
breach of a lawful contract, such material to any other person, shall be punished with imprisonment for a term
which may extend to three years, or with fine which may extend to five lakh rupees, or with both.‖
881 Apar Gupta, Commentary on Information Technology Act, 269 (Lexis Nexis, 2013).
201