Data Privacy Violation Liability - Complete Framework

Liability for data privacy violation in India has moved from Compensation Model to Punitive Model after DPDP Act 2023. Before you could only claim compensation for loss. Now regulator can fine you even if no one lost money.

1. Three Types of Liability That Co-Exist

A. Regulatory Liability - State Fines You:
Under DPDP Act 2023:

• Upto Rs 250 Crore per violation - highest in world after GDPR
• Upto Rs 200 Crore for failing to take reasonable security safeguards
• Upto Rs 200 Crore for failing to notify breach to Board and affected persons
• Upto Rs 200 Crore for handling children's data illegally

Key point: Penalties are civil, not criminal, but each violation is separate. If you leak data of 1 lakh users due to 1 bug, but failed to take safeguards + failed to notify = 2 violations = Rs 400 Crore max. Board says liability is uncapped in theory.

B. Civil Liability - Victim Sues You:

• IT Act Sec 43A (now repealed but cases still pending): Company negligent in protecting Sensitive Personal Data liable to pay compensation.
• Consumer Court: Deficiency of service
• DPDP Act doesn't give compensation to victim - penalty goes to Govt. So victim still needs to go to Consumer Court or Civil Court. This is the biggest gap in new law.

C. Criminal + Personal Liability - Directors Go To Jail / Board Liable:

• IT Act Sec 72, 72A: Breach of confidentiality by person with lawful access - upto 2-3 years jail
• IPC / BNS 316 - Breach of trust, 408 - breach by servant
• DPDP Rules 2025: Board members can be held liable if they failed to ensure compliance - valuation discount if privacy lapses found in due diligence.

This trifecta - regulatory + civil + criminal - is what makes liability complex now.

2. When Does Liability Arise? - The 4 Triggers

1. No Consent / Purpose Creep: You took data for loan KYC, used for cross-selling insurance. Illegal under Sec 6 DPDP.

2. No Security Safeguards: SBI 2019 case - unprotected server in Mumbai with no password exposed account balances. Even without hacker, mere lack of safeguards = violation under Sec 8(5) DPDP.

3. No Breach Notification: Under Rule 7, you must notify Board immediately and affected persons within 72 hours with detailed report. Failing to notify is separate Rs 200 Cr fine.

4. Excessive Collection: Delhi HC PIL Himakshi Bhargav v Union - digital lending apps accessing contacts, call logs. Even if user clicked "allow", it's excessive vs purpose.

3. Landmark Case Laws - India & Global

INDIA - CONSTITUTIONAL FOUNDATION

1. K.S. Puttaswamy (Retd) v. Union of India (2017) 10 SCC 1 - 9 Judge Bench
Declared privacy as fundamental right under Art 21. Created 4-part test: legality, legitimate aim, proportionality, procedural safeguards. Every privacy liability case starts here.

2. Puttaswamy Aadhaar Case (2018) 1 SCC 809
Struck down mandatory linking of Aadhaar with bank accounts. Held forcing customers to link Aadhaar or face account deactivation violated privacy and property rights. Established that financial data has higher privacy expectation.

3. Karmanya Singh Sareen v. Union of India (2016) Delhi High Court - WhatsApp- Facebook Case
First data sharing liability case. WhatsApp changed policy to share data with Facebook. HC ordered it must delete data of users who opt out and cannot share data pre-2016. Laid foundation for purpose limitation.

4. RBI v. Jayantilal N. Mistry (2015) + HDFC Bank Challenge 2024-26
SC said RBI cannot hide behind confidentiality to refuse inspection reports. But in 2024, SC noted Mistry did not balance right to information vs right to privacy recognized in Puttaswamy. Banks now argue disclosing customer-level data under RTI violates privacy liability under DPDP.

INDIA - BANKING & FINANCIAL DATA

5. Punjab National Bank v. Rupa Mahajan Pahwa (2015) NCDRC
Bank uploaded wrong CIBIL data - customer declared defaulter. Commission held bank liable for breach of Credit Information Companies Act, awarded compensation. First case holding bank as Data Fiduciary for credit data.

6. SBI Data Leak 2019 + Kerala HC SBI Refund Order 2026
Unprotected SBI server exposed millions of account balances. In 2026, Kerala HC ordered SBI to refund Rs 3.73 lakh to phishing victim, applying RBI zero-liability circular. Established that if breach is from bank side, customer has zero liability if reported within 3 days.

7. Himakshi Bhargav v. Union of India - Delhi HC PIL on Digital Lending Apps 2026
Alleged NBFCs collect contact lists and shame borrowers. HC asked RBI to explain enforcement of 2025 guidelines which bar access to contacts. This PIL will decide liability under DPDP Act for over-collection.

GLOBAL - GDPR - Shows How Fines Work

8. British Airways - £20 Million (2020) / €22 Million - GDPR
Hackers stole 400,000 customers' data due to inadequate security. ICO held basic security measures not in place, serious concern. Fine reduced from £183M to £20M due to Covid, but principle: No strict liability - need to prove culpable breach, but lack of safeguards = culpable.

9. Marriott - €20.45 Million GDPR
300 million guest records breached. Same reason - inadequate safeguards, acquired Starwood with known vulnerability but didn't fix.

10. Meta - €251 Million (Ireland 2024) + LinkedIn - €310 Million
Meta fined for breach affecting 3 million users in EEA. LinkedIn fined €310M for breach of principles in processing for targeted ads. Shows that even processing without leak - if against purpose - attracts liability.

11. CJEU Rejects Strict Liability - 2023 Landmark
Court of Justice of EU held there is no strict liability - mere infringement not enough to trigger fine. Authority must prove culpable breach by legal person. If cyberattack happens despite appropriate measures, fine risk reduces. This argument will be used in India too under DPDP Sec 8(5).

4. How Courts Calculate Liability

Indian courts use 5 factors now (borrowed from GDPR Art 83):

1. Nature & Gravity: Sensitive financial data vs name
2. Number Affected: 10 users vs 10 lakh
3. Intentional / Negligent: SBI no password = negligent
4. Mitigation: Did you notify quickly and help users?
5. History: Previous breaches?

Under DPDP, Board will publish penalty reasoning. Expect first big fine in 2026-27 when rules fully effective by May 2027.

5. How To Protect - From Litigation POV

For Companies:

• Map data flows - show you only collect what needed for loan, not contacts
• Get Sec 65B certificate ready for logs - courts throw out cases without it
• Breach playbook - 72 hr notification template
• Vendor contracts - make collection agency liable and require IIBF cert

For Borrowers / Customers:

• Evidence = Screenshot permission list, call to relatives, WhatsApp shaming
• File 3 parallel: Bank grievance -> RBI Ombudsman -> DPDP Board (once operational) + Consumer Court for compensation
• Claim: Financial loss + Mental harassment (Rs 50k-5L granted) + Punitive damages

Liability now is not about whether data leaked, but whether you can prove you had safeguards, consent, and notification. If you can't prove, you are liable even if hacker is from Russia.