white_paper_on_data_protection_in_india_171127_final_v2

4.11 Provisional Views
1. The law may treat certain actions of a data controller as an offence and impose criminal
liability. This may include instances where any person recklessly obtains or discloses,
sells, offers to sell or transfers personal data to a third party without adhering to relevant
principles of the data protection law, particularly without the consent of the data
subject.
2. The quantum of penalty and term of imprisonment prescribed may be enhanced as
compared to the provisions of the IT Act.
3. A more stringent penalty may be prescribed where the data involved is sensitive
personal data.
4. The power to investigate such an offence may lie with a police officer not below the
rank of Inspector. 890
4.12 Questions
1. What are the types of acts relating to the processing of personal data which may be
considered as offences for which criminal liability may be triggered?
2. What are the penalties for unauthorised sharing of personal data to be imposed on the
data controller as well as on the recipient of the data?
3. What is the quantum of fines and imprisonment that may be imposed in all cases?
4. Should a higher quantum of fine and imprisonment be prescribed where the data
involved is sensitive personal data?
5. Who will investigate such offences?
6. Should a data protection law itself set out all relevant offences in relation to which
criminal liability may be imposed on a data controller or should the extant IT Act be
amended to reflect this?
7. Are there any alternative views other than the ones mentioned above?
888 For instance, per Section 54, POPI Act, any person acting on behalf of or under the direction of the
Information Regulator must treat as confidential the personal information which comes to his or her knowledge
in the course of performing her official duties.
889 Section 107, POPI Act.
890 As reflected in Section 78, IT Act.
203