Data Breach

A data breach is an incident in which personal, confidential, sensitive, financial, employment-related, or other protected information is accessed, disclosed, altered, copied, lost, or obtained by an unauthorised person. A data breach may occur because of hacking, malware, phishing, insider misconduct, accidental disclosure, loss of devices, weak security controls, or improper handling of information.

Data breaches are particularly significant in employment and business law because organisations routinely collect large amounts of personal information, including names, addresses, identification details, salary information, bank details, health information, employment records, passwords, and biometric data.

1. Major Causes of Data Breaches

Common causes include:

• Cyberattacks: Hacking, ransomware, malware, and credential theft.
• Phishing: Employees are tricked into revealing passwords or other confidential information.
• Insider misconduct: Employees or contractors deliberately or negligently disclose information.
• Weak cybersecurity: Poor passwords, outdated software, inadequate encryption, or insufficient access controls.
• Lost or stolen devices: Laptops, phones, USB drives, or paper records may contain sensitive information.
• Accidental disclosure: Information may be sent to the wrong person or published unintentionally.
• Third-party failures: Vendors, cloud providers, payroll companies, or other contractors may expose information.

2. Legal Consequences of a Data Breach

A data breach can result in:

1. Compensation claims by affected individuals.
2. Regulatory penalties for failure to comply with data-protection requirements.
3. Breach of confidentiality claims.
4. Breach of contract claims, particularly where employment or commercial agreements contain confidentiality and data-security obligations.
5. Negligence claims where an organisation failed to take reasonable security precautions.
6. Reputational damage and loss of customer confidence.
7. Employment consequences where an employee improperly accesses or discloses confidential data.

Under Indian law, the Digital Personal Data Protection Act, 2023 establishes a statutory framework concerning processing of digital personal data and obligations relating to personal-data breaches. The Information Technology Act, 2000 and rules made under it have also played an important role in India's earlier data-protection framework.

3. Employer's Responsibility

Employers increasingly act as custodians of substantial employee data. They should therefore implement appropriate safeguards, including:

• limiting access to employees who need the information;
• maintaining appropriate cybersecurity systems;
• encrypting sensitive information where appropriate;
• conducting security audits;
• maintaining breach-response procedures;
• training employees about phishing and information security;
• monitoring unauthorised access;
• securely deleting information that is no longer required; and
• carefully controlling third-party access.

4. Employee Responsibility

Employees may also face legal or disciplinary consequences if they:

• deliberately access information without authorisation;
• download confidential employee/customer data;
• disclose passwords;
• send confidential files to personal accounts;
• share protected information with competitors; or
• negligently expose confidential information.

However, disciplinary action should ordinarily follow a fair procedure and should take account of the employee's actual conduct, intent, applicable policies, and the evidence available.

Important Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution. The judgment established privacy as an important constitutional principle and recognised informational privacy as an aspect of individual autonomy.

Relevance: Unauthorised collection, use, disclosure, or exposure of personal information can raise serious privacy concerns.

2. K.S. Puttaswamy (Retd.) v. Union of India, (2019) 1 SCC 1

The Supreme Court examined the constitutional framework surrounding Aadhaar and emphasised the importance of safeguards when personal information is collected and processed.

Relevance: The case demonstrates the need for lawful purposes, proportionality, and safeguards when dealing with large quantities of personal data.

3. District Registrar and Collector, Hyderabad v. Canara Bank, (2005) 1 SCC 496

The Supreme Court considered privacy and protection against unauthorised intrusion into private information and documents.

Relevance: The decision supports the broader principle that private information cannot be subjected to arbitrary or unjustified access.

4. Mr. X v. Hospital Z, (1998) 8 SCC 296

The Supreme Court considered confidentiality concerning sensitive medical information. The Court recognised the importance of maintaining confidentiality but also discussed circumstances in which disclosure could be legally justified.

Relevance: Unauthorised disclosure of sensitive personal information, including health information, can have serious legal consequences.

5. Sharda v. Dharmpal, (2003) 4 SCC 493

The Supreme Court discussed the relationship between privacy and the administration of justice, recognising that privacy is important but is not an absolute right in every circumstance.

Relevance: The case is useful in understanding that privacy protections must sometimes be balanced against legitimate legal interests.

6. R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632

The Supreme Court recognised the individual's right to privacy and examined the protection of private matters from unauthorised publication.

Relevance: Unauthorised publication or disclosure of personal information may violate privacy interests.

7. People's Union for Civil Liberties v. Union of India, (1997) 1 SCC 301

The Supreme Court dealt with telephone interception and established procedural safeguards to protect privacy against unlawful surveillance.

Relevance: The case demonstrates the importance of safeguards when private communications and personal information are accessed.

8. Selvi v. State of Karnataka, (2010) 7 SCC 263

The Supreme Court considered involuntary techniques for obtaining personal information and emphasised constitutional protections relating to privacy and personal autonomy.

Relevance: It reinforces the principle that personal information and individual autonomy receive constitutional protection.

Data Breach in Employment Law

A workplace data breach may involve the exposure of:

• employee salary and bank details;
• Aadhaar or other identification information;
• medical and insurance records;
• disciplinary records;
• attendance information;
• performance evaluations;
• passwords and login credentials;
• biometric information;
• customer information; and
• confidential business information.

For example, if an employee's salary records and bank details are accidentally emailed to another employee, the incident may constitute a data-security and confidentiality problem. The employer may need to investigate how the disclosure occurred, contain the breach, assess affected individuals, take corrective measures, and comply with applicable legal requirements.

Conclusion

A data breach is not merely a technological problem; it can create significant consequences under privacy, employment, contract, negligence, confidentiality, and data-protection law. Organisations should adopt reasonable technical and organisational safeguards and establish a clear incident-response mechanism. Employees likewise have responsibilities concerning confidential and personal information entrusted to them. Indian constitutional jurisprudence, particularly the Puttaswamy decisions, provides an important foundation for understanding privacy and protection of personal information.