India Unit 3B Section 43A, IT Rules 2011 II Flashcards
What does IT Rules 2011 regulate?
The IT Rules broadly regulate the:
- Collection, receipt, possession, use, storage, dealing or handling of sensitive personal data or information (SPDI)
- Transfer or disclosure of SPDI
- Security procedures for protecting SPDI
- Transfer of SPDI outside India
- Disclosure of SPDI to the government
- Retention of SPDI
- Review and correction of SPDI
- Deletion of SPDI on withdrawal of consent
What are one of the complications with the IT Rules 2011?
The complication is that some rules do not apply directly to data subjects, only to “providers” of information
- This means that in the case of outsourced processing, the data controller, not the data processor, is liable, provided the data subject has someone against whom to take action
- This can also mean that where the data subject is not the “provider” of the information to the data controller (e.g. collection of personal data from third parties, by observation or from documentary sources), none of these data protection rules will apply
What are the rules 4 to 8 of Section 43A and IT Rules 2011?
Under Section 43A, “bodies corporate” can be liable if they are negligent in implementing and maintaining “reasonable security practices and procedures” to protect “sensitive personal data or information” and that negligence causes
wrongful loss or wrongful gain to any person.
Rule 4 Privacy policies required
Rule 5 Data protection principles
- Consent and purpose limitation
- Lawful purpose and minimal collection
- Notice and purpose limitation
- Retention
- Use
- Subject access and correction
- Option to refuse or withdraw consent
- Security
- Complaint handling
Rule 6 Disclosure limitations and exceptions
Rule 6* Data processing
Rule 7 Data export restriction
Rule 8 Reasonable security
Rule 4 - Provide Privacy Policy. What must body corporate do?
Every body corporate that deals with sensitive personal data or information (SPDI) must have a privacy policy with:
– Clear and easily accessible statements of its practices and policies
– Type of personal or sensitive personal data or information collected
– Purpose of collection and usage of such information
– Disclosure of information including sensitive personal data or information
– Reasonable security practices and procedures
Rule 5(1) - Consent and Purpose Limitation. What does body corporate do before collecting SPDI?
Rule 5(1) - Consent and Purpose Limitation
- A body corporate cannot collect SPDI unless it obtains the prior consent of the provider of the information
- The consent has to be provided by letter, fax or email
- Applies only to sensitive data and to “Provider of information” dealing directly with the data subject
Rule 5(2) Lawful purpose and minimal collection. For what purpose can body corporate collect SPDI?
- Collected for lawful purposes “connected with a function or activity of the agency” and only necessary for that purpose
- Applies to sensitive data only
- Prior to collecting the information, give the option to the provider of the information to not provide such information. (In such case, the body corporate can cease providing goods and services for which the information is sought).
Rule 5(3) Notice and Purpose Limitation. What must body corporate ensure?
- The body corporate should ensure that the provider of the information is aware that the information is being collected, the purpose of use of the information, the recipients of the information and the name and address of the agency collecting the information
- Prior consent is required for disclosure of the information to any party other than the government
- Applies to all personal information
- Note: Does not apply when personal data is collected from third parties
Rule 5(4) Retention and 5(5) Use. Under what circumstances can SPDI be retained? How can information be used?
- The body corporate cannot retain the SPDI for longer than is required for the purposes for which the information may lawfully be used or is otherwise required under any other law
- Does not include or cover when the purpose of collection expires
- Applies to controllers
- The body corporate can use personal information only for the purpose for which it was collected
Rule 5(6) Access and Correction. What must body corporate when they receive an access request?
- The body corporate should permit the provider of the information the right to review that information and should ensure that any information found to be inaccurate or deficient be corrected
- Provided that a body corporate shall not be responsible for the authenticity of the personal information or sensitive personal data or information supplied by the provider of information to such body corporate or any other person acting on behalf of such body corporate.
Rule 5(7) Option to reuse, withdraw consent. What must body corporate provide before collection of information?
- The body corporate must provide an option to the provider of the information not to provide the data or information sought to be collected
- The provider of the information also has the right to withdraw its consent to the collection and use of the information
Rule 5(8) Security. What is Rule 5(8)?
The body corporate must “keep the information secure”
Rule 5(9) Complaint handling. Who must body corporate designate and how long must complaints or grievances be redressed?
- The body corporate must address complaints by the provider of the information
- Note: may not have the obligation to address and respond to any complaints by data subjects
- For this purpose, the body corporate shall designate a Grievance Officer and publish his name and contact details on its website. The Grievance Officer shall redress the grievances or provider of information expeditiously but within one month ‘ from the date of receipt of grievance.
Rule 6 Disclosure limitation and exceptions. What must body corporate do before disclosing information. What are the exceptions?
- Prior permission is required if disclosing personal data or information to any third party
- Exception: performance of contract, compliance to legal obligation, request from government agencies
- Sensitive personal data or information cannot be published
Rule 7 transfer of info. When can body corporate transfer information overseas?
- Transnational transfer. A body corporate can only transfer the SPDI or information to a party overseas if the overseas party ensures the same level of protection provided for under the Indian rules
- Information can be transferred only if it is necessary for the performance of a lawful contract between the body corporate and the information provider or where the information provider has provided his consent to such transfer
Rule 8 - RSPP. What is Rule 8 about? What procedures and stds? What type of audit must be done?
- The IT Act requires reasonable security procedures to be maintained in order to escape liability.
- Reasonable security procedures needed — either (a) the IS/ISO/IEC27001 on “Information Technology – Security Techniques – Information Security Management System – Requirements; or (b) a code developed by an industry association and approved and notified by the government.
- The security procedure has to be audited on a regular basis by an independent auditor, who has been approved by the Government of India.
- Such audit should be carried out at least once year or as and when the body corporate has undertaken a significant upgradation of its computer resource.
