Data misuse Bill leaves a choice
The amount of compensation for an offence will be decided by the adjudicating officer
The amount of compensation for misusing or unauthorisedly using data has not been specified in the draft personal data protection Bill, which, however, has provisions for stiff penalties.
The amount will be decided by the adjudicating officer probing a complaint by an individual.
As the amount awarded will be subjective, some of the privacy advocates say not many people may lodge a complaint because the sum may not be big enough to satisfy complainants.
The Justice B N Srikrishnaled panel, which had submitted its report and draft Bill to the government a couple of days ago, proposes that in the case of a breach or misuse of personal data, sensitive data or the personal information of children, a fine of up to ~150 million or four per cent of the offending company’s global turnover, whichever is higher, could be levied on the violating entity.
However, in the case of compensation, no amount has been specified.
“The data principal may seek compensation pursuant to a complaint instituted in such form and manner as may be prescribed before an adjudicating officer,” the Bill said.
Asked about the amount that might be awarded to a data principal or any individual whose data might have been misused, one of the members of the panel said the amount would be equal to the loss the individual might have suffered.
As this will be very difficult to quantify, like the magnitude of loss in the case of data misuse such as showing targeted advertisement derived through use of personal data of an individual without informed consent, many people may not even demand compensation.
The complaint redress mechanism has not worked very well in the telecom sector, where customers usually don’t
come forward to recover amounts deducted by telecom operators for certain valueadded services like hello tunes without informing them because the amount is ~30-40. To recover the minuscule amount, consumers may have to spend much more in taking legal recourse.
Some say the panel should have defined the compensation for various violations.
Another member of the panel said as the compensation amount might be very small for a single individual or data principal, it was likely that one complaint might be instituted on behalf of all such data principals who had suffered the same set of violations.
“This has been normal practice in other countries and it may happen in India also,” the member said.
The Bill recommends setting up a Data Protection Authority of India, which will protect the interests of data principals, prevent misuses of personal data, ensure compliance with provisions of the personal data protection Act, and promote awareness of data protection.
The Data Protection Authority will appoint adjudicating officers for imposing penalties and awarding compensation.
The Bill said adjudicating officers would be people of ability, integrity and standing, and must have specialised knowledge of, and not less than seven years’ professional experience, in constitutional law, cyber and internet laws, information technology law and policy, data protection and related subjects.