Data protection Bill: Adjudicating officer to decide compensation amount

The amount of compensation for misusing or unauthorisedly using data has not been specified in the draft personal data protection Bill, which, however, has provisions for stiff penalties.

The amount will be decided by the adjudicating officer probing a complaint by an individual. As the amount awarded will be subjective, some of the privacy advocates say not many people may lodge a complaint because the amount awarded may not be big enough.

The Justice B N Srikrishna-led panel, which had submitted its report and draft Bill to the government a couple of days ago, proposes that in the case of a breach or misuse of personal data, sensitive data or the personal information of children, a fine of up to Rs 150 million or 4 per cent of the offending company’s global turnover, whichever is higher, could be levied on the violating entity. 

However, in the case of compensation, no amount has been specified.

“The data principal may seek compensation pursuant to a complaint instituted in such form and manner as may be prescribed before an adjudicating officer,” the Bill said.

Asked about the amount that may be awarded to a data principal or any individual whose data may have been misused, one of the members of the panel said the amount would be equal to the loss the individual may have suffered. As this will be very difficult to quantify, like the magnitude of loss in the case of data misuse like showing targeted advertisement derived through use of personal data of an individual without informed consent, many people may not even demand compensation.

The complaint redress mechanism has not worked very well in telecom sector where customers usually don’t come forward to recover amounts, deducted by telecom operators for certain value-added services like hello tunes without informing them as the amount itself is in the range of Rs 30-40. To recover the miniscule amount, the telecom consumers may have to spend much more in taking legal recourse. 

A few people feel that it could have been much better if the amount for compensation for various violations also have been defined by the panel.

Another member of the panel said that as the amount may be very less for compensation for a single individual or data principal, it is likely that one complaint may be instituted on behalf of all such data principals who have suffered same set of violations. “This has been a normal practice in other countries and it may happen in India also,” the member said.

The bill recommends setting up of a Data Protection Authority of India, which will protect the interests of data principals, prevent any misuse of personal data, ensure compliance with provisions of the personal data protection Act and promote awareness of data protection. The Data Protection Authority will appoint adjudicating officers for the purpose of imposing penalties and awarding compensation.

The Bill said adjudicating officers would be persons of ability, integrity and standing, and must have specialised knowledge of, and not less than seven years’ professional experience in the fields of constitutional law, cyber and internet laws, information technology law and policy, data protection and related subjects.

SHIELDING YOUR DETAILS
 

• The Justice B N Srikrishna-led panel proposes that in the case of a breach or misuse of personal data, sensitive data or the personal information of children, a fine of up to Rs 150 million or 4 per cent of that company's global turnover, whichever is higher could be levied on the violating entities

• The amount could be equal to the loss one may have suffered 

• The bill recommends setting up of a Data Protection Authority of India, which will protect the interests of data principals, prevent any misuse of personal data, ensure compliance with provisions of the personal data protection Act and promote awareness of data protection