Introduction:
In today's digital business landscape, data is sometimes called the new gold. From confidential client information to proprietary trade secrets, the vast data generated daily serves as a fundamental asset. However, with the rise in the value of corporate data, so too has emerged the practice of corporate data theft.
Defining Corporate Data Theft:
Corporate data theft, also known as data breach or data intrusion involves the unauthorized acquisition, copying, or retrieval of sensitive information from a corporation without proper consent. This includes pilfering passwords, banking details, client information, trade secrets, software, source codes, or any other confidential or proprietary data.
Instances of Corporate Data Theft:
Frequently, incidents arise where former employees engage in corporate data theft. These individuals, having access to sensitive information during their employment, misuse that data for personal gain or to establish competing enterprises.
Legal Framework Against Corporate Data Theft:
Various legal provisions govern offenses related to corporate data theft in India, encompassing both the Information Technology (IT) Act, 2000, and the Indian Penal Code (IPC), 1860.
Under the IT Act, 2000:
1. Section 72A addresses the disclosure of information in breach of lawful contracts.
2. Section 72 deals with breaches of confidentiality and privacy, relevant to acts like pilfering client information.
3. Section 43 of the IT Act specifically covers various categories of data theft, penalizing individuals who, without proper authorization, download, copy, or extract data from computer systems, networks, or removable storage media.
Under the Bharatiya Nyaya Sanhita, 2023 (BNS):
1. Section 316 BNS deals with Criminal Breach of Trust, applying to individuals entrusted with property, including data, who dishonestly misappropriate or use it in violation of legal contracts.
Section 316 BNS also stipulates that criminal breach of trust is a non-bailable and cognizable offense, punishable by imprisonment for up to three years, a fine, or both.
2. Section 303 of BNS: Theft of Mobile Phones, Data, or Computer Hardware
This section specifically addresses theft related to mobile phones, data, or computer hardware/software. It offers a legal framework to prosecute individuals engaged in cyber theft activities. However, the applicability of special laws like the IT Act takes precedence in cases where they are attracted.
3. Section 317 of BNS: Receipt of Stolen Property
Section 317 is pertinent when an individual receives stolen mobile phones, computers, or data. It does not only target the thief but also extends its scope to anyone in possession of such stolen property, even if held by third parties.
4. Section 318 of BNS:
Address frauds, including password theft, creation of bogus websites, and cyber frauds. Imposes varying imprisonment and fines based on the gravity of the offense.
Liability of a Body Corporate:
The legal responsibility for corporate data theft extends beyond individual perpetrators. Under Section 43-A of the IT Act, the body corporate, representing the organization experiencing the data breach, can also be held accountable. This includes firms, sole proprietorships, or other associations involved in commercial or professional activities.
Digital Personal Data Protection Act, 2023:
The recently enacted DPDP Act comprehensively addresses data theft and imposes significant responsibilities on data fiduciaries, custodians of personal data. They are obligated to implement stringent protocols, encryption methods, and access controls to safeguard collected and processed data.
Conclusion:
Corporate data theft is a multifaceted challenge that requires a robust legal framework and proactive security measures. It underscores the importance of stringent security policies, regular audits, and continuous reinforcement to recognize data as both an asset and a potential liability in the ever evolving growing corporate world.
Corporate theft under BNS (Bharatiya Nyaya Sanhita) regime
Comments