Govt to impose higher penalties on companies not reporting data breaches: Report

Amid public concern over data privacy, the government intends to impose higher penalties on companies if they fail to report cases of a data breach of Indian users to concerned authorities, a government official told The Economic Times.

There have been several cases of personal data breaches by technology giants like Facebook and Google in the past one year, which the government came to know of after the companies released public statements.

Most companies do not comply with rules of the Information Technology Act, 2008, which require them to pay financial penalties if breaches are not reported to the Ministry of Electronics & Information Technology (MeitY). They do not even respond to multiple letters by authorities since penalties are so low.

The ministry is working on a draft of the final data protection law, which could be tabled in the Parliament by December-end.

"Increasing penalties to ensure higher reporting of incidents is one way of looking at it. Regulators around the world, be it in the General Data Protection Regulation (GDPR), or the data protection bill, are resorting to fairly high penalties so that it acts as deterrence. However, we also need a legal and regulatory framework to support them," Nehaa Chaudhari, Public Policy Head at Ikigai Law, told the paper.

In October, Facebook accounts of 50 million Indians were exposed to a personal data breach. The ministry wrote to the social media giant regarding the extent of the damage. Facebook told the government it would respond after an investigation.

Google too announced it would shut down its social media arm, Google+, after reports that 5 lakh users may have been exposed to external parties due to a bug that was in the system for two years.

A company spokesperson had said Google always goes beyond legal requirements and applies methods focused on our users. In a statement, it said millions of notifications are sent to users about privacy and security bugs.