INDIA Law and Practice Contributed by: Suvarna Mandal and Rishikaa, Saikrishna & Associates
1.2 Regulators Current Data Protection Law
• Reserve Bank of India (RBI) for the banking sector; • AOs appointed under the Telecommunica - tion Act, 2023 (the “Telecom Act”) for the telecoms sector; • the Securities and Exchange Board of India (SEBI) for the securities market; and • the Insurance Regulatory and Development Authority for the insurance sector. 1.3 Enforcement Proceedings and Fines Current Data Protection Law Under the current regime (ie, the IT Act and the SPDI Rules), an AO holds the power of a civil court, and proceedings before AOs are deemed judicial proceedings. While deciding the quan - tum of compensation, AOs are required to con - sider: • the amount of unfair advantage resulting from the default; • the amount of loss caused to any person resulting from the default; and • the repetitive nature of the default. The IT Act does not stipulate the maximum fine for contravention of the SPDI Rules, simply stat - ing that the body corporate would be liable to pay damages by way of compensation to the affected person. Section 72A of the IT Act imposes a fine of up to INR25 lakhs (approximately USD29,000) for disclosing personal information obtained under a lawful contract to another person without con - sent and with the intent to cause wrongful gain or loss, or in violation of the contract. Upcoming Data Protection Law Under the DPDP Act, the DPB will have the power to:
While the SPDI Rules do not specify a regulator per se, an adjudicating officer (AO) is appointed under the IT Act to judge whether any person has committed a contravention of any of the provisions of the IT Act or any of the rules made thereunder, which renders such person liable to The DPB will be established under the DPDP Act, and will operate at the national level. The DPB will be a body corporate that will function as an independent body as per the procedure provided in the rules to the DPDP Act. Cybersecurity Law The Indian Computer Emergency Response Team (CERT-IN) serves as the national agency for incident response and performs functions such as: • the collection, analysis and dissemination of information on cyber incidents; pay a penalty or compensation. Upcoming Data Protection Law • forecast and alerts of cybersecurity incidents; • advising on emergency measures for handling cybersecurity incidents; and • co-ordinating cyber incident response activi - ties. It also issues guidelines, advisories and vul - nerability notes relating to information security practices, procedures, prevention, response and reporting of cyber incidents. Sectoral Laws In addition to the above, there are sectoral regu - lators that enforce data protection regulations in their respective sectors, such as:
190 CHAMBERS.COM
Powered by FlippingBook