The country still does not have any privacy protection laws in-place. So such cases have to be considered in the civil law domain….”, says Prof Rahul Sud, Asian School of Cyber Laws, Pune. The rising cyber crimes and recent incidents of compromise of privacy involving social networking sites underscore the importance of information security and the role lawyers need to play to ensure it.

Asian School of Cyber Laws (ASCL), a premier institute in the country with expertise on cyber laws, has been associated with and is assisting the Department of Information Technology, Ministry of Communications and IT, Government of India in framing draft rules and regulations under the Information Technology Act, 2000 and the Information Age Crimes Act.

Although the Indian cyber law, namely, the Information Technology Act, 2000 (IT Act), came into force on 17th October 2000, the Government had not appointed the Adjudicating Officers or the Cyber Regulations Appellate Tribunal prior to the Pune-based ASCL's move.

In an interview, Deccan Herald's S Praveen Dhaneshkar asked Professor Rahul Sud from the Pune-based ASCL, who was recently in Bangalore, on the issue of cyber crimes in India. Excerpts:

DH: Cyber related crimes are on the rise and the privacy of individuals are being infringed on. Please comment

R S: The country still does not have any privacy protection laws in-place. So such cases have to be considered in the civil law domain. We do not have any specific laws binding any firms or companies to protect data. For example a person X logs-in to a social networking site and provides personal information voluntarily. He or she gives the phone number and expects it to be kept confidential. But the site does not comply with the norm. In such instances X is left with the only option of filing a civil case against the site.

DH: Could issues like violation of privacy be addressed through legislation?

R S: Parliament is planning to come out with the privacy protection bill in relation to cyber crimes. If it is made into law, then it would be a mandate to protect privacy of individual users. Most firms sell information to other companies. So, in a way your privacy is being compromised. Currently, there is a law in place saying privacy should be protected. India has become “The Best Outsourcing Destination” in recent times, but the laws are very weak. Though adequate protection is available on the criminal side, the same can’t be said about civil cases; you have to rely on private contracts. The law is not categorical about data protection. It has to change in future. It is here that the role of lawyers assumes great importance. We need lawyers who understand technology better.

DH: Why hasn’t the Information Technology Act 2000 addressed such issues?

R S: The Act has drawbacks. An amended version of the act is in the pipeline, put forward in the previous session of the Parliament. The objective is to make the Act address privacy and data protection issues; ensuring things like information sought or given in an e-mail are protected.

For example I log-in to a social networking site and provide information via e-mail, which comes under privacy protection. The web-site that may read my e-mail has to inform me. Its violation amounts to privacy protection. In data protection, when the company outsources its work to India, they provide confidential information. They expect the Indian company to adhere to minimum protection standards in compliance with Indian laws.

DH: Are current regulations enough to address data protection issues, particularly to the satisfaction of the international firms who out-source work to India?

R S: MNC’s and transnational firms who outsource work to India settle their contracts and arbitration clauses not as per Indian laws, but as per international commercial arbitration. However, Indian companies need to have data protection as per Indian standards. Only then will it be admissible in court.

DH: How does the ASCL help in addressing these issues?

R S: We conduct training programmes for police, income tax officers, bankers and others on the IT Act and dealing with cyber crimes.  In certain social networking websites, information shared is public. It is the individuals responsibility not to share personal information. Users should read the privacy policy. We create awareness programmes on these issues.