Thread by @internetfreedom

Mega-thread:

Dominos, UpStox, MobiKwik, Facebook, Air India - India's deluge of data breaches shows no sign of stopping.

Today, we want to explain to you why our legal system is not equipped to deal with this situation, and what needs to change.
1/n
internetfreedom.in/our-recommenda…

The rising data breaches in India threaten your safety. Not only do they make your personal information available for anyone on the internet for nefarious uses, their economic impact is tremendous. One IBM study shows that the average breach in India costs Rs 14 crore.
2/n

As per the Constitution, IT Act, and common law, data fiduciaries (i.e. companies like Dominos and MobiKwik) who face breaches have a legal obligation to ensure that the personal data in their custody - like your name and address - is safeguarded.

But what's the reality? ->
3/n

a. There is no actual legal obligation on such companies to notify you in case a data breach occurs.

While Air India did send across a notification to its customers, MobiKwik chose not to engage at all.

(India needs to consider a Communicate-Comply-Investigate process.)

4/n

b. The IT Act provides compensation for negligent handling of *sensitive* data.

But this only includes your passwords, finances, sexual orientation, medical records, and biometrics.

There is no such redressal if your name, email, address or passport details are breached!
5/n

c. When breaches take place, proper investigations are not conducted to enable you to claim compensation under the IT Act.

In recent times, @IndianCERT only issued an advisory to Facebook for its breach. W.r.t. other breaches, it is unclear if CERT-IN took any steps.
6/n

d. The redressal mechanism is inadequate.

MEITY appoints officers in each state to determine violations under the IT Act. But in cases where data in the custody of the Government is breached (e.g. Air India), there are questions over the independence of these officers.
7/n

So what does this mean? There is always a high and consistent possibility of violation of law by data fiduciaries in whose custody data was breached. And the existing legal regime has several lacunae that can be exploited. You, the user, are primarily affected by this.
8/n

There are several solutions that can be easily and tangibly implemented to protect your rights. We wrote to @IndianCERT in March and April about them and we've written to @GoI_MeitY @IndianCERT @airindiain with our recommendations and analysis again today.
9/n

We have affixed recommendations by @Banbreach in reference to the Air India breach, and are thankful to Mr Kar for providing his insights.

Security researchers, reach us on [e-mail] and [e-mail] for further assistance!
10/n

Our team is working hard to make sure that India's data protection regime centers YOU and your rights.

To do this, we need your help. Support IFF today!

internetfreedom.in/donate/