Your SlideShare is downloading. ×
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Legal aspects of IT Security-at ISACA conference 2011
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Legal aspects of IT Security-at ISACA conference 2011

674

Published on

Legal aspects of IT Security,corporate responsibility towards IT Act,2000

Legal aspects of IT Security,corporate responsibility towards IT Act,2000

Published in: Economy & Finance, Business
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
674
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
15
Comments
0
Likes
1
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Legal Aspects in IT Security Is Your Organisation Up-to-Date?? (Ref : IT Act, 2008 & IT Rules 2011) Adv. Prashant Mali [BSc(Phy),MSc(Comp. Sci.),CNA,LLB,ISO 27001 LA] President – Cyber Law Consulting (Advocates & Attorneys) Founder – Cyber Law Foundation www.cyberlawconsulting.com
  • 2. COMPENSATION FOR FAILURE TO PROTECT DATA
    • S43-A: Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation (limit not defined) to the person so affected.
  • 3. What is a Body Corporate ? Under Section 43-A of IT Act,2008
    • Explanation: For the purposes of this section
    • (i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities ..
    • ..Contd
    • Exception: Government Organisations
  • 4.
    • “ Personal Information” means any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person.
    Personal Information Under Section(2)(1)(i) of IT Rules 2011
  • 5.
    • Sensitive personal data or information of a person means such personal information which consists of information
    • relating to;―
    • (i) password;
    • (ii) financial information such as Bank account or credit card or debit card or other payment instrument details ;
    • (iii) physical, physiological and mental health condition;
    • sexual orientation;
    • medical records and history;
    • Biometric information;
    • Exception: Info available under The Right to Information Act
    Sensitive Personal Data or Information Under Section(3) of IT Rules 2011 www.cyberlawconsulting.com
  • 6. Appointment of Grievance Officer Under Section(5)(9) of IT Rules 2011
    • Body corporate shall address any discrepancies and grievances of their provider of the information with respect to processing of information in a time bound manner. For this purpose, the body corporate shall designate a Grievance Officer and publish his name and contact details on its website. The Grievance Officer shall redress the grievances of provider of information expeditiously but within one month from the date of receipt of grievance.
  • 7. WEBSITES SHOULD HAVE LEGAL NOTICES Under Section(3) of The IT Rules 2011
    • The intermediary shall observe following due diligence while discharging his duties, namely :
    • The intermediary shall publish the rules and regulations, privacy policy and user agreement for access or usage of the intermediary’s computer resource by any person.
  • 8.
    • Your Organisations Server gets infected by a worm implanted by Chinese hacker hired by an angry investor /Customer any Competitors
    • S(43)(c) introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network;
    • shall be liable to pay damages of ? (limit not defined)
    • CEO/CIO/CTO
    • S(66) he shall be punishable with imprisonment for a term which may extend to two three years or with fine which may extend to five lakh rupees or with both.
    Vicarious liability of an Organisation (If Resonable Security Practices are not followed)
  • 9. INDIAN GOVERNMENT CAN PEEP IN YOUR DATA
    • S(69-B) Power to authorize to monitor and collect traffic data or information through any computer resource for Cyber Security
    • (2) The Intermediary or any person in-charge of the Computer resource shall when called upon by the agency which has been authorized  under sub-section (1), provide technical assistance and extend all facilities to such agency to enable online access or to secure and provide online access to the computer resource generating , transmitting, receiving or storing such traffic data or information.
  • 10. THANK YOU prashant . [email_address] Mobile : 09821763157 www.cyberlawconsulting.com

×