CHAPTER-XI: OFFENCES

Section 72: Breach of confidentiality and privacy

(1) Save as otherwise provided in this Act or any other law for the time being in force, any person who, in pursuance of any of the powers conferred under this Act, rules or regulations made thereunder, has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned intentionally discloses such (electronic record, book, register, correspondence, information, document or other-Deleted) material to any other person shall be punished with imprisonment for a term which may extend upto two years, or with fine which may extend to five lakh rupees, or with both.

(2) Save as otherwise provided under this Act, if any intermediary who by virtue of any subscriber availing his services has secured access to any material or other information relating to such subscriber, discloses such information or material to any other person, without the consent of such subscriber and with intent to cause injury to him, such intermediary shall be liable to pay damages by way of compensation not exceeding Rs. 25 lakhs to the subscriber so affected.;

(3) Whoever intentionally captures or broadcasts an image of a private area of an individual without his consent, and knowingly does so under circumstances violating the privacy of that individual, shall be liable to pay compensation not exceeding Rs. 25 lakhs to the person so affected, and shall also be liable for imprisonment for a term not exceeding one year or with fine not exceeding Rs 2 Lakhs, or with both on the complaint of the person so affected.

(4) No court shall take cognizance of any offense punishable under sub-section (3) except upon a complaint filed by the aggrieved person in writing before a Magistrate

Explanation: For the purpose of this section

(a) “capture” with respect to an image, means to videotape, photograph, film, record by any means;
(b) “broadcast” means to electronically transmit a visual image with the intent that it be viewed by a person or persons;
(c) “a private area of the individual” means the naked or undergarment clad genitals, pubic area, buttocks, or female breast of that individual;
(d) “female breast” means any portion of the female breast below the top of the areola; and
(e) “under circumstances violating the privacy of that individual” means –

(i) circumstances in which a reasonable person would believe that he or she could disrobe in privacy, without being concerned that an image of a private area of the individual was being captured; or

(ii) circumstances in which a reasonable person would believe that a private area of the individual would not be visible to the public, regardless of whether that person is in a public or private place.

(f) “Intermediary” as defined in Section 79;

(g) Injury as defined in IPC.

A perusal of the section reveals the following:

(a) Section 72(1): Section 72(1) is subject to the provisions of this Act or any other law for the time being in force. From the very reading of section 72(1) it is clear that its application comes into picture where:

(i) An “authority” having powers under the Act, Rules or Regulations to gain access,

(ii) has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned, and

(iii) intentionally discloses such material to any other person.

All these conditions must be fulfilled simultaneously to make section 72(1) applicable.

Now the expression “intentionally” has drastically reduced the “accountability and liability” of the authorities violating privacy rights under the Act. There is nothing wrong in asking for the “mens rea” element but taking “half of it” to suit specific requirements cannot be a reasonable proposal. For instance, what will happen when there is“negligence” on the part of any such authority that results in privacy violation? The IPC recognises both “act and omission” as the guiding criterion for fixing liability. If the authorities are either negligent or had knowledge about the privacy violation at the time of its commission, they must be held liable. The concept of “due diligence” is not a sword for few and luxury for others. The due diligence requirements and accountability is missing from this sub-section. It would be better if the expression “intentionally or knowingly” is used for section 72(1).

(b) Section 72(2): Section 72(2), subject to the ‘gigantic protection” to intermediaries guaranteed by the Act, will come into operation if:

(i) The disclosure in question is arising due to availing of services of the intermediary that has provided him/it access to the information,

(ii) Such intermediary “disclosed” that information to any person, and
(iii) Such disclosure has been made without the consent of such subscriber and with intent to cause injury to him/it.

This is again a “legal loophole” provided specifically to ensure that the intermediaries escape their liability without any fear for law and penal sanctions. It seems the Committee was wary of simply and directly providing a “blanket protection” to the intermediaries. It seems the theme of the “entire penal scheme” of the proposed Act is strongly suggesting the “law and its enforcement agencies” to “KEEP THE HANDS OFF” from intermediaries.

A close perusal of section 72(2) reveals that first of all there is no penal provision taking care of this situation and only a right to claim “compensation” has been provided at most. Further, even to claim that compensation, another Herculean task has to be performed. The disclosure to be “civilly actionable” must be made without the consent of such subscriber “and” with intent to cause injury to aggrieved party.

Now this is absurd on the following counts:

(a) Firstly, no penal sanction is there and a civil liability can be imposed at most,
(b) Secondly, such disclosure, to be punishable, must be done without the consent of subscriber “and” with “intent to cause injury”. Now suppose, an intermediary is “negligent” or he fails to exercise “due diligence”, then he cannot be held liable under section 72(2) because he will contend that he had no “intention” to cause injury and that was just an inadvertent mistake. This, in other words is a “blanket protection” to the intermediaries to play with the privacy of the subscribers.

Thus, the section must proceed like this:

Section 72(2): ------ if any intermediary---- intentionally or knowingly discloses---. That can only do justice to this section and situation. Further, penal sanctions must also be attached because the section is already subject to other provisions of the Act protecting intermediaries.

Section 73(3): A welcome provision, but the “legality” of “sting operations” is about to be debated.

Section 72(4): It has the elements of “controversy”, particularly while deciding who the “aggrieved person” is. For instance, if the privacy of a girl/ boy is violated, are their parents “aggrieved parties”? Further, the exclusion of jurisdiction f the courts also may be objected to.

Thus, the provisions under section 72(3) and (4), protecting privacy rights, are welcome provisions provided the ambiguity of “aggrieved person’ is removed.