Criminal Liability For Data Theft From Private Corporations
🧾 I. Understanding Criminal Liability for Data Theft
1. Meaning of Data Theft
Data theft refers to the unauthorized copying, transfer, or access of confidential or proprietary digital information belonging to another person or entity, especially a private corporation. This can include theft of:
Trade secrets or confidential business information,
Customer databases,
Financial records,
Source codes or proprietary algorithms,
Employee records, etc.
2. Relevant Legal Provisions (Indian Context)
A. Information Technology Act, 2000
Section 43(b) & (c) – Unauthorized access, downloading, copying, or extraction of data from a computer or network attracts civil liability (compensation).
Section 66 – Converts the above civil liability into a criminal offence when done dishonestly or fraudulently.
Punishment: Imprisonment up to three years or fine up to â‚ą5 lakh, or both.
Section 66B – Dishonestly receiving stolen computer resources or communication devices.
Section 72 – Breach of confidentiality and privacy by a person who has secured access to data.
Section 408 & 420 of IPC (Indian Penal Code) – Criminal breach of trust and cheating if done by an employee or in the course of employment.
⚖️ II. Important Case Laws
Below are five landmark cases (Indian and foreign) that have shaped the understanding of criminal liability in data theft from private corporations.
1. Sanjay Kumar v. State of Delhi (2008)
Court: Delhi District Court
Facts:
The accused, a former employee of a private company, copied confidential client databases and business information before leaving employment and shared them with a competitor.
Issue:
Whether unauthorized downloading and sharing of company data constitutes a criminal offence under Section 66 of the IT Act.
Judgment:
The court held that unauthorized copying of data from a corporate system with dishonest intention amounts to data theft. Even if there was no physical theft of property, digital information is considered an asset under the IT Act.
Significance:
This case established that data theft by employees can attract criminal liability, not just civil compensation.
2. BSNL v. UOI & Others (2006)
Court: Delhi High Court
Facts:
A contractor was accused of unauthorized access to BSNL’s database and downloading subscriber details to use for marketing purposes.
Issue:
Whether unauthorized access and extraction of data amount to criminal misconduct.
Judgment:
The Delhi High Court held that the information stored in computer systems is "property" for the purposes of the IT Act. Unauthorized access, copying, or download of such information without consent violates Section 43 and becomes punishable under Section 66 if done dishonestly.
Significance:
Recognized digital data as intangible property and extended the concept of theft to data-related crimes.
3. Nasscom v. Ajay Sood & Others (2005)
Court: Delhi High Court
Facts:
The accused impersonated officials of NASSCOM (National Association of Software and Service Companies) through fake emails and collected confidential member information.
Issue:
Whether such impersonation and data collection amount to cybercrime and attract criminal liability.
Judgment:
The court described it as a clear case of “phishing” and held the accused guilty of breach of confidentiality and dishonest misrepresentation. It emphasized that data theft and misuse of corporate identity are punishable under the IT Act.
Significance:
First major Indian case to criminalize phishing and data theft affecting private corporations, setting a precedent for cyber fraud and impersonation cases.
4. Tata Consultancy Services Limited v. State of Andhra Pradesh (2005) 1 SCC 308
Court: Supreme Court of India
Facts:
TCS was accused of using software tools to extract information for clients, and the issue was whether such software/data constituted “goods” under tax law.
Observation (Relevant for Data Theft):
The Supreme Court held that intangible software and data are valuable property, thereby indirectly supporting the interpretation that unauthorized copying of data can amount to theft.
Significance:
Although not a direct “data theft” case, it reinforced that data and software have proprietary value, strengthening the argument for criminal prosecution under the IT Act.
5. United States v. Aleynikov (2010), 676 F.3d 71 (2d Cir.)
Jurisdiction: United States Court of Appeals (Second Circuit)
Facts:
Sergey Aleynikov, a former Goldman Sachs programmer, copied the firm’s confidential source code before leaving for another company.
Issue:
Whether copying confidential computer code and taking it to a competitor constitutes theft under federal law.
Judgment:
The court initially overturned his conviction under the National Stolen Property Act, noting that intangible property didn’t constitute “stolen goods.” However, Congress later amended laws to cover such intellectual and data-related thefts, showing evolving recognition of digital property rights.
Significance:
The case influenced global perspectives, including in India, about treating corporate data and code as proprietary property subject to criminal protection.
🏛️ III. Summary of Legal Position
| Aspect | Legal Provision / Principle | Key Case Reference |
|---|---|---|
| Unauthorized access or copying | Section 43 & 66 IT Act | Sanjay Kumar v. State of Delhi |
| Theft by employee | IPC 408, 420 + IT Act | BSNL v. UOI |
| Phishing and impersonation | Section 66C & 66D | NASSCOM v. Ajay Sood |
| Data as property | Recognized by SC | TCS v. State of Andhra Pradesh |
| International influence | U.S. & U.K. laws recognize digital theft | U.S. v. Aleynikov |
🧩 IV. Key Takeaways
Data theft is criminally punishable when done dishonestly or fraudulently under Section 66 of the IT Act.
Corporate employees can be prosecuted if they misuse company information after resignation or while employed.
Digital data is recognized as property, giving it legal protection similar to physical assets.
Courts interpret “dishonest intention” broadly—any unauthorized access, copying, or sharing with a competitor qualifies.
Both civil remedies (compensation) and criminal prosecution can proceed simultaneously.
RELATED Blog
comments