Online Course on Personal Data Protection Act 2018

Cyber Law College, which is a pioneering institution in India dedicated to Cyber Law Education is starting an online course on Personal Data Protection Act 2018.

The Course will cover the draft Act as is being discussed in the Parliament and will include the accompanying draft proposed law for Health care namely the DISHA 2018.

Details are available at Cyber Law College website.

The Course fee would be Rs 6000/- and registration would commence from 19th October 2018.

Classes would be conducted by Naavi online as per schedule to be fixed.

I look forward to the support of the community in this regard.


Print Friendly, PDF & Email
Posted in Cyber Law | Leave a comment

Bengaluru as the Data Protection Capital of India

Naavi has been in the forefront of creating awareness of Cyber Laws in India. In 2005, Naavi had taken up a program called “Karnataka Cyber Laws Awareness Movement” under which several programs were undertaken in Karnataka.

Now time has come to start a similar activity for the Personal Data Protection Act 2018 which is presently in draft stage but is likely to become an important legislation in India.

While Cyber Law College will be focussing on some structured courses in this regard, we are glad to note that the Foundation of Data Protection Professionals in India (FDPPI) would be undertaking a “PDPA Awareness Movement” by conducting Awareness lectures in Bengaluru to begin with, in different organizations on the basis of invitations.

The program is being conducted by a team of professional members of FDPPI.

It is expected that the program would spread to other parts of India also in due course.


Print Friendly, PDF & Email
Posted in Cyber Law | Leave a comment

Let Data Protection Law of India define the Instrument creating a Data Fiduciary

The Draft of Personal Data Protection Act 2018 (PDPA 2018) which is being discussed in the Parliament has one extremely important hurdle to be crossed. The hurdle is how to establish a relationship between the Data Principal and the Data Fiduciary in such a manner that the Consent is provided “Explicitly” in certain cases incorporating the several requirements of Informational Privacy  such as how the personal data may be processed by the Data Fiduciary.

The GDPR called the person whose personal data is being discussed as the “Data Subject” and the entity which determines how the data would be processed as the “Data Controller”. Though the Data Controller was to take consent from the Data subject, it is clear that it is the “Data Controller” who takes over the control over Personal data and the Data Subject lives with the hope that the Data Controller will fulfill the obligations that he has contractually agreed in the letter of consent.

Some legislations prefer to consider “Data” as a “Property” and “Personal Data” as the property who is identifiable in the set of the subject data. By considering data as “property”, the property owner’s right can be recognized as owning a property which can be sold or assigned to the Data Controller (Data Buyer?).

But the Srikrishna Panel preferred to steer clear of both the approaches namely  “Data as a Right that can be transferred by a consent contract” and “Data” as “Property” . It preferred to call the Data Subject as “Data Principal” and the Data Controller as a “Data Fiduciary”. The reason that Justice Srikrishna provided for this departure was very innovative. He felt that by recognizing the role of the Data Controller as a “Data Fiduciary”, we are imputing a certain set of expectations on the Fiduciary which is beyond what can be expressed in a Consent contract. Hence, with or without  a “Contractual Binding” created by a “Consent Form”, the Fiduciary is bound to protect the “Privacy Right” of the individual.

“Privacy” being a “State of Mind”, it is difficult to be defined. Protecting the Privacy Right by writing down a few lines in a Consent form would therefor not suffice. The Data undergoes a metamorphosis after it is delivered to the Fiduciary and the Consent is signed when neither the Data Subject or the Data Controller is aware what is the potential of the data as it undergoes processing.

This dynamic nature of data and possible discovery of value after the hand over of data by the data subject, makes the Consent meaning less as a contract, since at the time of signing of the Consent, there would be  lack of acceptance of the “Facts” surrounding the object called “Personal Data” which is being handed over.

Hence the Consent fails the definition of “Contract” as defined in the Indian Contract Act. At the same time, the Supreme Court in its Aadhaar judgement has held that at least a private company cannot contractually obtain a consent to collect sensitive personal data using a consent contract.

Hence accepting  “Consent” as a “Contract”  appears untenable both under the Contract Act and because of the the Supreme Court verdict on Aadhaar.

Had PDPA 2018 adopted the GDPR definition of Data transfer from the Data Subject to the Data Controller as a contractual agreement called “Consent”, then we would have  reached a legal dead end in passing the PDPA 2018.

It was a blessing in disguise that the Srikrishna Committee decided to adopt a “Fiduciary” concept for the Data Subject-Data Controller relationship.

While this has resolved the problem of “Consent Contract” being considered void, it has however created another problem.

The “Fiduciary” relationship pre-supposes the existence of a “Trustee-beneficiary Relationship” between the Data Fiduciary and the Data Principal.

If we consider that “Consent” is a written representation of what the “Fiduciary Relationship” implies, then the “Consent” has to pass the test of being a “Trust deed”.

In the electronic world, a trust deed suffers from two deficiencies namely lack of “Stamp duty payment” and lack of recognition under Information Technology Act by virtue of Section 1(4).

Thus the “Consent” in electronic writing which is what a “Privacy Policy” accepted by a “Click Wrap” contract means, is not legally acceptable under Indian law.

We therefore end up with a situation where the Consent Contract is neither recognized under the Contract Act nor the Trust Act.

Solution is to create a new Instrument

There is no need to get disheartened by the failure of the Contract Act and the trust Act to solve our problem of getting a legally recognized instrument that can validate an electronic consent. There are at least two ways by which this problem can be resolved.

First is to amend the Section 1(4) by providing an exemption for the Data Fiduciary Creation instrument under PDPA 2018 and also provide exemption for the instrument from the Stamp Duty.

Second is to define the “Data Fiduciary Creation Instrument” as a new type of electronic document that is neither a Contract under the Contract Act or a Trust deed under the Trust Act. If this definition is included in PDPA 2018, there will be no need to amend the ITA 2000 nor the Stamp Duty Act.

Consent in a Privacy context requires to be an “Informed Consent” where the data principal is informed of his rights and also the details of processing etc., as per law. But in practice, it is difficult to make the Consent really fulfill all the details that may be required under law to be included and even if included, the “Consent fatigue” will ensure that the data principal does not take the trouble of understanding the details.

Hence the “Fiduciary creation instrument” will  superimposes the duties imposed by the PDPA 2018 on the data fiduciary in addition to the written provisions of the Consent.

Let’s hope that this innovative approach is taken to ensure that “Consent” in electronic form would be considered as an instrument of creation of the fiduciary relationship.


Print Friendly, PDF & Email
Posted in Cyber Law | Tagged , , | Leave a comment

FDPPI submits its Comments on PDPA 2018

FDPPI, an organization of Data protection Professionals in India has presented its comments on the draft PDPA 2018 (Personal Data Protection Act 2018) as presented by the Ministry of Electronics Information Technology (MeitY) under the recommendation of the Justice Srikrishna Committee.

The extended last date for submission was October 10, 2018. Considering the recent Judgement of the Supreme Court, the Government is under an obligation to pass the legislation at the earliest so that a Data Protection Law will be in place in the country as envisaged by the Supreme Court.

A Copy of the recommendations submitted by FDPPI is available here

The comments/recommendations of FDPPI contain several new thoughts which have not been under discussion since the draft was available. They will be elaborated in greater detail in a series of articles here.


Disclaimer: The views expressed here and elsewhere on this site are the personal views of Naavi and not the views of any organization or group that he may be associated with.

Print Friendly, PDF & Email
Posted in Cyber Law | Leave a comment

Last Day for Comments on PDPA 2018 is 10th October

The draft of the Personal Data Protection Act 2018 has been submitted by the Justice Srikrishna Committee along with its report. Copies of both are available at

The Government of India has requested for public comments to be submitted on the draft Bill which is in the Parliament before October 10, 2018.

The comments can be submitted at has discussed this subject extensively ever since the Srikrishna Committee has come into existence. Some  suggestions were submitted by during the time the Committee held its discussions. Some were submitted after the Committee submitted its reports. After the recent Aadhaar Judgement, another list of comments on the impact of this judgement on Privacy has also been separately recorded so that there is a large number of thoughts before the public to debate about.

I wish public go through all these comments and suggestions and whether they agree or disagree, use them to stir up their own thoughts on the subject so that they can formulate their own comments and present it to the Government.

I hope that the following list of articles provide the information that one may look for as background material for forming their individual opinion.

  1. Calling attention of Justice Srikrishna Committee on Data Protection; Don’t let GDPR be the new Vasco Da Gama
  2. Srikrishna Panel Report and Aadhaar
  3. PDPA 2018 and Aadhaar-2
  4. Public Consultation on Data Protection Law…. Some points of discussion-1: Part II : Part III
  5. Personal Data protection and Data Localization-1
  6. Personal Data Protection and Data Localization-2
  7. Uphold the “Right to Know” against “Right to Privacy” in the new Data Protection Law
  8. Are Privacy Laws Getting bigger than Cyber Crime Laws?.. Is Profiteering replacing deterrence principle in law making?
  9. Privacy law cannot be only a tool for hiding oneself
  10. Look beyond GDPR and Create Personal Data Trusts to manage Privacy of data subjects
  11. Data Protection Act.. We should aim at Compliance with Pleasure not Compliance with Pain.
  12. PDPA 2018: Is Data Localization related to Privacy?
  13. PDPA 2018: Privacy Activists and RTI Activists fight with each other
  14. Aadhaar Judgement : 10 articles : The 10th Article

There could be more articles if one searches through Using the information available here, public may send their comments.

Additionally, FDPPI (Foundation of Data Protection Professionals in India) will be collating the comments from its members and sending it to the Ministry. Those of you who want your comments to be included in the comments or in FDPPI comments, can send them to Naavi or to FDPPI by e-mail, by the end of today.


Print Friendly, PDF & Email
Posted in Cyber Law | Leave a comment

The Cosmos Bank fraud.. Could better security at NPCI have prevented it?

The recent fraud in which Rs 94 crores were siphoned off the Cosmos Bank system on August 11th and 13th through over 14800 ATM withdrawals has once again highlighted that for fraudsters it makes no difference if the money comes from a Cooperative bank or an SBI . They seek to attack the systems where the security is weak .

If a Bank like Cosmos Bank of Pune thinks it is big enough to offer  cards and ATM facility to its customers and implement a CBS system over multiple branches, it must understand the risk of expanding the vulnerability of the systems and it requires adequate security measures to be in place.

A few years Bank (2013) the Bank of Muscat Fraud  was carried out in which about Rs 250 crores were fraudulently drawn out from the Bank through about 40000 ATM transactions carried out in 27 different countries in two bursts each of which lasted only a few hours. The fraud was carried out by hacking into the back end systems of the card data processors in India. The second and the larger burst of this fraud occurred three months after the first indicating that the vulnerability was not recognized and corrected when the first burst of withdrawals took place.

Subsequently RBI has been warning the Banks to ensure that adequate security measures are taken by the Banks. But at the same time, RBI has been pushing co-operative Banks to the use of technology without providing them adequate support and time in terms of introducing security measures. In the meantime some of the Co-operative Banks have grown big and introduced innovative technology based services without adequately covering the risks.

The Cosmos Bank episode is indicative of this negligence as the method of withdrawal of the money by fraudsters is similar to the Bank of Muscat fraud…namely cloned cards used to withdraw money from ATMs in foreign centers. But the modus operandi appears more sophisticated.

In the Bank of Muscat incident, the systems of the card processing companies were hacked and the information of about two dozen pre paid cards were changed. In the Cosmos Bank case, it appears that the fraudsters created a proxy server to approve the ATM transactions and bypassed the real CBS system to fool the ATMs into believing that the transactions were approved by the Bank. They also cloned debit cards both VISA and Rupay cards and withdrew money in 28 different countries. One of the contributory factors was that the ATMs were using Windows XP system which some time back was also the cause of ransomware attack on some Indian Banks.

Though NPCI has indicated that there was a malware attack in the Bank that created a proxy authentication system, NPCI cannot wash its hands off because there could be several security measures which it may be able to implement at the Switch level to prevent frauds of this nature.

For example, it is not clear why the ATM switch operated by NPCI should allow any ATMs anywhere in the world to connect to it if such ATM is running on a  Windows XP system. It would have been prudent that NPCI stops servicing such outdated and proven to be fraud prone systems even if such systems are from abroad.

Also a question needs to be asked, if there is an ATM withdrawal request (and thousands of them in quick succession) from a Co-operative Bank customer/s from abroad, does it not automatically indicate a “Risk” since we donot expect customers of Cooperative Banks to be globe trotting executives?

It is our view that such transactions should have been stopped and flagged at the switch itself before being transferred to the Bank’s server.

I am sure that NPCI will frown if we say that they are responsible the breach of security in Cosmos Bank but we need to ponder if they could have by upgrading their own risk identification and management measures have prevented the Cosmos Bank fraud.

But unless we accept that the ATM, the Switch and the Bank’s server all parts of an integrated financial authentication system and secure the transaction in its totality, the customers of the Banks and the owners of the Banks will be exposed to risks that will ultimately fall on individuals who trusted the system.

From the legal perspective, it is the Bank which engages the services of the Switch and the ATM to provide services to its customers and has to ensure through contractual agreements that the intermediaries provide secure service. It is a presumption that if  Windows XP systems in ATMs are considered as obsolete, they should not be used by the ATM operators and the Switch should refuse services to such ATM machines.

The Switch operators cannot be dumb routers of transactions but should implement and manage their own security systems to detect suspicious transactions.

In particular, approving transactions from abroad which are outside the legal jurisdiction of India for further investigations should be subjected to a greater level of security prescriptions.

It does not matter if a stray individual is unable to draw money from an ATM while he is on a tour of Thailand or Turkey, and complains of bad service, but it is essential that in order to score a brownie point that the Bank can issue globally acceptable debit cards, the security of the Bank itself is not jeopardised.

RBI should therefore immediately instruct NPCI to impose restrictions that any ATM debit transaction request coming from outside the country is flagged as a special case and subjected to better security measures even while the Banks are also required to do so. It is however possible that it may be only at the switch that the transaction can be better identified as coming from abroad.

Additionally, the switch should maintain the digital signature of all ATMs installed in India and should be able to instantly identify whether the call is from an Indian ATM or from abroad and initiate necessary security procedures as required.

The Switch should identify any abnormal pattern of withdrawals and take immediate action to block the suspicious ATMs, or Cards to prevent continuance of the fraud over an extended time.

Probably frauds will continue to happen even in an increased security preparedness of the Switch but it would make the life of the fraudster difficult and reduce the incidence of frauds.

Look forward to comments from security specialists on the above.



One of the alert readers of the post has suggested some corrections to what is stated above and I am happy to add the clarifications:

  1. Within India,
    1. an ATM of a particular Bank connects to the switch operated by the respective Bank when the transaction relates to the Bank itself.
    2. In respect of Inter Bank transactions, the authentication call is routed through NPCI
  2. In the case of foreign transactions, it may be routed through the payment gateway of VISA or an agent of Rupay which could be an aquiring Bank in that country which being an interbank transaction may go through NPCI switch.
  3. In all cases some information such as IP address, ATM ID, Aquiring Bank transaction ID etc., is collected. The OS details may not be presently collected.
  4. NPCI Switch comes into play  in InterBank requests and not in inter-bank debit card transactions.

I thank the reader for the clarifications. NPCI may try to check if it can re-define the parameters that the ATM request should contain and how it can be expanded if required so that at least transactions from abroad are filtered effectively.

Transactions in India can be tracked further since RBI insists on the CCTV in ATM and some remedy against the mules is possible.

In case of withdrawals from abroad, the hands of the law enforcement are tied. Consultants like us insist insist that they register FIRs and they are uncomfortable since it is a dead end of investigation any way.

Further Add on:

RBI has indicated that by default cards should not be payable outside India. Banks should ensure that only at the specific request of the customer card should be payable abroad. If therefore a request comes from outside India, the Switch as well as the Bank’s Server should recognize that it is an exceptional transaction and has to be subjected to some kind of secondary verification. The ATM transactions in India, The online transactions and the International transactions  should be recognized as different levels of transactions and subjected to the differential levels of authentication. Responsibility for this has to be taken by all the stake holders since the objective is to make the system more secure.

Disclaimer: The views expressed here and elsewhere on this site are the personal views of Naavi and not the views of any organization or group that he may be associated with.

Print Friendly, PDF & Email
Posted in Cyber Law | Tagged , | 2 Comments