In November, the Indian Ministry of Electronics and Information Technology (MeitY) released its Digital Personal Data Protection Bill, 2022. The bill had been put up by the country’s Union Minister for Communications, Electronics and Information Technology, Ashwini Vaishnaw, for public consultation till December 17, however, the deadline has recently been extended to January 2, 2023.&nbsp;

The Digital Personal Data Protection Bill, of 2022, is legislation, on one hand, outlines the rights and duties of the citizen and on the other hand, the obligations to use collected data lawfully of the data fiduciary.&nbsp;

What happened to the previous drafts?

This bill was proposed after nearly four to five years of delays and changes and&nbsp;will reportedly be the Indian government’s fourth&nbsp;attempt to present a bill on data protection. In 2017, the country’s Supreme Court declared that privacy was a fundamental right under the Indian constitution, which led to the apex court asking the government to create a set of data protection rules, in line with this decision.&nbsp;

Subsequently, the government set up a committee of experts headed by retired Supreme Court judge, BN Srikrishna. A year later, the committee along with its report submitted a draft of the Data Protection Bill after which the Ministry of Electronics and IT said that they would use the ideas from the Srikrishna committee and create a fresh draft.&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/india-news/in-a-first-india-uses-she-and-her-to-refer-to-all-genders-in-a-draft-data-protection-bill-535612">In a first, India uses ‘she’ and ‘her’ to refer to all genders in a draft data protection bill</a>

In late 2019, a modified version of that Bill, the Personal Data Protection Bill (PDP Bill), 2019 was introduced by the government. This draft was then referred to the Joint Parliamentary Committee (JCP) which was headed by the ruling Bharatiya Janata Party (BJP) minister, Meenakshi Lekhi, at the time.

The JCP after its analysis sought an extension for presenting its report in 2021 which was later granted. Meanwhile, BJP MP, PP Chaudhary had taken over the chairpersonship of the JCP after Lekhi was appointed as the Minister of State for External Affairs and was granted another extension.&nbsp;

However, after the proposed and recommended changes, in August last year, Minister of State for Electronics and IT, Rajeev Chandrasekhar told the parliament, “The government has today withdrawn the Personal Data Protection Bill that was formulated in 2018 and re-written by the JCP in 2021.” He added, that new legislation by the government will be tabled in the parliament “very quickly”.&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/india-news/new-data-protection-bill-calls-for-consent-privacy-penalties-to-bring-more-accountability-in-digital-economy-155209">New data protection bill calls for consent, privacy, penalties, to bring more accountability in digital economy</a> 
 
Not to mention, the PDP Bill also reportedly faced massive pushback from a range of stakeholders including big tech companies like Facebook and Google for the bill’s provision of data localisation which would prohibit them from exporting undefined personal user data and had to keep a copy of certain sensitive information within the country.

Additionally, the JCP&nbsp;after 78 sittings, over 184 hours, and multiple extensions, the committee proposed 81 amendments (in a 99-section bill) and 12 recommendations. Meanwhile, reports suggest that&nbsp;privacy and civil society activists criticised the delays in the bill since one of the highest consumers and producers of data per capita among the countries across the world did not have a basic framework to protect the privacy of internet users.&nbsp;

They also raised concerns about the provision which allowed the government and its agencies to access data and exempt from most&nbsp;of the provisions of the bill reportedly saying that the measures favoured the government as opposed to safeguarding privacy.&nbsp;

What about the Digital Personal Data Protection Bill, 2022?

Released on November 18, earlier this year, the bill was first proposed in Lok Sabha (lower house) in December 2019. This time around, the proposed legislation has been reduced to only 30 clauses from the over 90 in the previous draft. It is also focused on personal data and also seemingly accounts for the big tech companies’ protests against the previous draft and eased the rules on cross-border data flow.&nbsp;

“The purpose of this Bill is to provide for the processing of digital personal data in a manner that recognises the right of individuals to protect their personal data, the need to process personal data for lawful purposes and for other incidental purposes,” said the draft bill’s explanatory note.&nbsp;

The proposed legislation&nbsp;is up for public consultation, where the government has sought comments from a range of stakeholders the deadline was which was recently extended to January 2, 2023. The move was made, “in response to the requests received from several stakeholders”, said the IT ministry in a statement.&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/opinions-blogs/why-tiktok-is-a-threat-to-national-security-if-left-unchecked-300976">Why TikTok is a threat to national security if left unchecked</a> 
 
In its explanatory note, the bill says that there are 760 million active internet users in India the number for which is expected to be 1.2 billion in upcoming years. “That is why laws and rulemaking for the internet have to be around the basic foundational principles and expectations of our citizens of openness, safety, and trust and accountability,” said the government.&nbsp;

According to the note, the bill has been based on seven principles around the data economy. The first and second principles call for organisations to be more transparent with users’ personal data in a way that is lawful and fair to individuals as well as “purpose limitation” which is using the data for which it is collected.&nbsp;

Furthermore, it also calls for “data minimisation” which is collecting those items of personal data only for what is needed. The fourth principle is about the accuracy of personal data and that a “reasonable effort” is made that the individual’s personal data is “accurate and kept up to date”.&nbsp;

ALSO WATCH |&nbsp;<a href="https://www.wionews.com/videos/gravitas-plus-indias-achievements-75-506581">Gravitas Plus: India’s achievements @75</a>

Subsequently, the fifth one calls for a “storage limitation” so that personal data is not being “stored perpetually by default”. It added, “The storage should be limited to such duration as is necessary for the stated purpose for which personal data was collected.”&nbsp;

The last two principles call for “reasonable safeguards” to prevent data breaches and ensure there is no unauthorised collection or processing of personal data and the person who is in charge of such processing should be&nbsp;held accountable for it.&nbsp;

“These principles have been used as the basis for personal data protection laws in various jurisdictions,” said the explanatory note. It added, “The actual implementation of such laws has allowed the emergence of a more nuanced understanding of personal data protection wherein individual rights, public interest and ease of doing business especially for startups are balanced.”&nbsp;

Furthermore, companies which handle large amounts of data should appoint an independent data auditor to ensure compliance with the provisions, said the Indian government.&nbsp;The proposed bill also says that the government will establish a Data Protection Board which will address user complaints and ensure compliance.&nbsp;

New Delhi will also choose a list of countries to which the companies can transfer personal data and will only allow platforms to send user data to servers in countries on that list. The aforementioned board can also levy fines and penalties in case of failure to adhere to the laws.&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/india-news/india-court-raises-serious-concerns-on-youth-accessing-banned-video-games-getting-addicted-525191">India: Court raises serious concerns on youth accessing banned video games, getting addicted</a>

Additionally, companies could be fined up to $30.6 million for not ensuring reasonable safeguards to prevent a data breach. Companies would also have to stop retaining data if it no longer serves the purpose for which it was collected.&nbsp;

They will also not be allowed to process personal data which might harm children or use target advertising for children. Additionally, before processing the personal data of any child the platform would have to take parental consent. The users will also have the right to correct or erase their personal data.&nbsp;

Concerns raised

Across the range of reports, one of the key concerns raised by experts is that the Indian government and state agencies have several exemptions from the proposed law in the interest of national security. The decision was justified by saying, “national and public interest is at times greater than the interest of an individual, a clear grounds-based description of exemptions has been incorporated in the Bill,” in the explanatory note.&nbsp;

Referring to Section 18 outlines the exemptions of the draft bill and talks about how the government can process personal data without the users’ consent, “in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these”, states the Section 18(2)(a).&nbsp;

Meanwhile, government agencies can also under certain circumstances indefinitely store personal data, said reports. Therefore, the Delhi-based, Internet Freedom Foundation said, “If the law is not applied to government instrumentalities, data collection and processing in the absence of any data protection standards could result in mass surveillance.”&nbsp;

(With inputs from agencies)&nbsp;

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

In November, the Indian Ministry of Electronics and Information Technology (MeitY) released its Digital Personal Data Protection Bill, 2022. The bill had been put up by the country’s Union Minister for Communications, Electronics and Information Technology, Ashwini Vaishnaw, for public consultation till December 17, however, the deadline has recently been extended to January 2, 2023.

In November, the Indian Ministry of Electronics and Information Technology (MeitY) released its Digital Personal Data Protection Bill, 2022. The bill had been put up by the country’s Union Minister for Communications, Electronics and Information Technology, Ashwini Vaishnaw, for public consultation till December 17, however, the deadline has recently been extended to January 2, 2023. The Digital Personal Data Protection Bill, of 2022, is legislation, on one hand, outlines the rights and duties of the citizen and on the other hand, the obligations to use collected data lawfully of the data fiduciary. What happened to the previous drafts? This bill was proposed after nearly four to five years of delays and changes and will reportedly be the Indian government’s fourth attempt to present a bill on data protection. In 2017, the country’s Supreme Court declared that privacy was a fundamental right under the Indian constitution, which led to the apex court asking the government to create a set of data protection rules, in line with this decision. Subsequently, the government set up a committee of experts headed by retired Supreme Court judge, BN Srikrishna. A year later, the committee along with its report submitted a draft of the Data Protection Bill after which the Ministry of Electronics and IT said that they would use the ideas from the Srikrishna committee and create a fresh draft. ALSO READ | In a first, India uses ‘she’ and ‘her’ to refer to all genders in a draft data protection bill In late 2019, a modified version of that Bill, the Personal Data Protection Bill (PDP Bill), 2019 was introduced by the government. This draft was then referred to the Joint Parliamentary Committee (JCP) which was headed by the ruling Bharatiya Janata Party (BJP) minister, Meenakshi Lekhi, at the time. The JCP after its analysis sought an extension for presenting its report in 2021 which was later granted. Meanwhile, BJP MP, PP Chaudhary had taken over the chairpersonship of the JCP after Lekhi was appointed as the Minister of State for External Affairs and was granted another extension. However, after the proposed and recommended changes, in August last year, Minister of State for Electronics and IT, Rajeev Chandrasekhar told the parliament, “The government has today withdrawn the Personal Data Protection Bill that was formulated in 2018 and re-written by the JCP in 2021.” He added, that new legislation by the government will be tabled in the parliament “very quickly”. ALSO READ | New data protection bill calls for consent, privacy, penalties, to bring more accountability in digital economy Not to mention, the PDP Bill also reportedly faced massive pushback from a range of stakeholders including big tech companies like Facebook and Google for the bill’s provision of data localisation which would prohibit them from exporting undefined personal user data and had to keep a copy of certain sensitive information within the country. Additionally, the JCP after 78 sittings, over 184 hours, and multiple extensions, the committee proposed 81 amendments (in a 99-section bill) and 12 recommendations. Meanwhile, reports suggest that privacy and civil society activists criticised the delays in the bill since one of the highest consumers and producers of data per capita among the countries across the world did not have a basic framework to protect the privacy of internet users. They also raised concerns about the provision which allowed the government and its agencies to access data and exempt from most of the provisions of the bill reportedly saying that the measures favoured the government as opposed to safeguarding privacy. What about the Digital Personal Data Protection Bill, 2022? Released on November 18, earlier this year, the bill was first proposed in Lok Sabha (lower house) in December 2019. This time around, the proposed legislation has been reduced to only 30 clauses from the over 90 in the previous draft. It is also focused on personal data and also seemingly accounts for the big tech companies’ protests against the previous draft and eased the rules on cross-border data flow. “The purpose of this Bill is to provide for the processing of digital personal data in a manner that recognises the right of individuals to protect their personal data, the need to process personal data for lawful purposes and for other incidental purposes,” said the draft bill’s explanatory note. The proposed legislation is up for public consultation, where the government has sought comments from a range of stakeholders the deadline was which was recently extended to January 2, 2023. The move was made, “in response to the requests received from several stakeholders”, said the IT ministry in a statement. ALSO READ | Why TikTok is a threat to national security if left unchecked In its explanatory note, the bill says that there are 760 million active internet users in India the number for which is expected to be 1.2 billion in upcoming years. “That is why laws and rulemaking for the internet have to be around the basic foundational principles and expectations of our citizens of openness, safety, and trust and accountability,” said the government. According to the note, the bill has been based on seven principles around the data economy. The first and second principles call for organisations to be more transparent with users’ personal data in a way that is lawful and fair to individuals as well as “purpose limitation” which is using the data for which it is collected. Furthermore, it also calls for “data minimisation” which is collecting those items of personal data only for what is needed. The fourth principle is about the accuracy of personal data and that a “reasonable effort” is made that the individual’s personal data is “accurate and kept up to date”. ALSO WATCH | Gravitas Plus: India’s achievements @75 Subsequently, the fifth one calls for a “storage limitation” so that personal data is not being “stored perpetually by default”. It added, “The storage should be limited to such duration as is necessary for the stated purpose for which personal data was collected.” The last two principles call for “reasonable safeguards” to prevent data breaches and ensure there is no unauthorised collection or processing of personal data and the person who is in charge of such processing should be held accountable for it. “These principles have been used as the basis for personal data protection laws in various jurisdictions,” said the explanatory note. It added, “The actual implementation of such laws has allowed the emergence of a more nuanced understanding of personal data protection wherein individual rights, public interest and ease of doing business especially for startups are balanced.” Furthermore, companies which handle large amounts of data should appoint an independent data auditor to ensure compliance with the provisions, said the Indian government. The proposed bill also says that the government will establish a Data Protection Board which will address user complaints and ensure compliance. New Delhi will also choose a list of countries to which the companies can transfer personal data and will only allow platforms to send user data to servers in countries on that list. The aforementioned board can also levy fines and penalties in case of failure to adhere to the laws. ALSO READ | India: Court raises serious concerns on youth accessing banned video games, getting addicted Additionally, companies could be fined up to $30.6 million for not ensuring reasonable safeguards to prevent a data breach. Companies would also have to stop retaining data if it no longer serves the purpose for which it was collected. They will also not be allowed to process personal data which might harm children or use target advertising for children. Additionally, before processing the personal data of any child the platform would have to take parental consent. The users will also have the right to correct or erase their personal data. Concerns raised Across the range of reports, one of the key concerns raised by experts is that the Indian government and state agencies have several exemptions from the proposed law in the interest of national security. The decision was justified by saying, “national and public interest is at times greater than the interest of an individual, a clear grounds-based description of exemptions has been incorporated in the Bill,” in the explanatory note. Referring to Section 18 outlines the exemptions of the draft bill and talks about how the government can process personal data without the users’ consent, “in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these”, states the Section 18(2)(a). Meanwhile, government agencies can also under certain circumstances indefinitely store personal data, said reports. Therefore, the Delhi-based, Internet Freedom Foundation said, “If the law is not applied to government instrumentalities, data collection and processing in the absence of any data protection standards could result in mass surveillance.” (With inputs from agencies) WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

Explained: What is India’s Digital Data Protection Bill, 2022 all about?

Your complete digital life - including data from your social media accounts, banking and credit card details -- can be sold by cybercriminals for less than US $50, scientists say.

While many of us have heard of, or even fallen victim to, cybercrimes such as data and identity theft, it seems that relatively few know the value of the information stolen from us.&nbsp;

Scientists from the Kaspersky Lab, a cybersecurity company in Russia, found that while our identity may not be worth a lot in terms of dollars, it is a significant asset to criminals in other ways.

The research uncovered an appetite among cybercriminals for data stolen from popular services - including via social media accounts and remote access to gaming websites.

User confusion about what their data is worth could result in a haphazard approach to security, making it all too easy for thieves to steal data and commit crime.

Data stolen due to people's lax security may have limited resale value, but can be put to many uses.

This can cause huge problems for an individual victim, who may lose money and their reputation, find themselves being chased for debt that somebody else has incurred in their name, or even suspected of a crime that somebody else has committed using their identity as a cover.

Kaspersky Lab investigated 'Dark Web' markets to find out how much personal data is worth, and how it is used by criminals.&nbsp;

The dark web, also referred to as the darknet, is an encrypted portion of the internet that is not indexed by search engines. These networks use the internet but require specific software, configurations, or authorisation to access.

The researchers found that criminals can sell someone's complete digital life for less than US $50; including data from stolen social media accounts, banking details, remote access to servers or desktops, and even data from popular services like Uber, Netflix, and Spotify, as well as gaming websites, dating apps, and porn websites which might store credit card information.

Meanwhile, researchers found that the price paid for a single hacked account is lower, with most selling for about US $1 per account, and with criminals offering up discounts for bulk-buying.

The most common way criminals steal this sort of data in the first place is via spear phishing campaigns or by exploiting a web related security vulnerability in an application's software.

After a successful attack, the criminal gets password dumps which contain a combination of emails and passwords for the hacked services. With many people using the same password for several accounts, attackers might be able to use this information to access accounts on other platforms too.

Some criminals selling data even provide their buyers with a lifetime warranty, so if one account stops working, the buyer will receive a new account for free.

"It is clear that data hacking is a major threat to us all, and this applies at both an individual and societal level, because stolen data funds many social evils," said David Jacoby, Senior Security Researcher at Kaspersky Lab.

"Fortunately, there are steps we can take to prevent it, including by using cybersecurity software, and being aware of how much data we are giving away for free - particularly on publicly available social media profiles, or to organisations," said Jacoby.

People can avoid such risks by taking several easy security steps, which should become an integral part of any Internet user's digital life.

To stay safe from phishing, always check that the link address and the sender's email are genuine before clicking anything. A robust security solution will also warn you if you attempt to visit a phishing web page.

To avoid one data leak harming all your digital identities, never use the same password for several websites or services, researchers said.

Your complete digital life - including data from your social media accounts, banking and credit card details -- can be sold by cybercriminals for less than US $50, scientists say.

Your complete digital life - including data from your social media accounts, banking and credit card details -- can be sold by cybercriminals for less than US $50, scientists say. While many of us have heard of, or even fallen victim to, cybercrimes such as data and identity theft, it seems that relatively few know the value of the information stolen from us. Scientists from the Kaspersky Lab, a cybersecurity company in Russia, found that while our identity may not be worth a lot in terms of dollars, it is a significant asset to criminals in other ways. The research uncovered an appetite among cybercriminals for data stolen from popular services - including via social media accounts and remote access to gaming websites. User confusion about what their data is worth could result in a haphazard approach to security, making it all too easy for thieves to steal data and commit crime. Data stolen due to people's lax security may have limited resale value, but can be put to many uses. This can cause huge problems for an individual victim, who may lose money and their reputation, find themselves being chased for debt that somebody else has incurred in their name, or even suspected of a crime that somebody else has committed using their identity as a cover. Kaspersky Lab investigated 'Dark Web' markets to find out how much personal data is worth, and how it is used by criminals. The dark web, also referred to as the darknet, is an encrypted portion of the internet that is not indexed by search engines. These networks use the internet but require specific software, configurations, or authorisation to access. The researchers found that criminals can sell someone's complete digital life for less than US $50; including data from stolen social media accounts, banking details, remote access to servers or desktops, and even data from popular services like Uber, Netflix, and Spotify, as well as gaming websites, dating apps, and porn websites which might store credit card information. Meanwhile, researchers found that the price paid for a single hacked account is lower, with most selling for about US $1 per account, and with criminals offering up discounts for bulk-buying. The most common way criminals steal this sort of data in the first place is via spear phishing campaigns or by exploiting a web related security vulnerability in an application's software. After a successful attack, the criminal gets password dumps which contain a combination of emails and passwords for the hacked services. With many people using the same password for several accounts, attackers might be able to use this information to access accounts on other platforms too. Some criminals selling data even provide their buyers with a lifetime warranty, so if one account stops working, the buyer will receive a new account for free. "It is clear that data hacking is a major threat to us all, and this applies at both an individual and societal level, because stolen data funds many social evils," said David Jacoby, Senior Security Researcher at Kaspersky Lab. "Fortunately, there are steps we can take to prevent it, including by using cybersecurity software, and being aware of how much data we are giving away for free - particularly on publicly available social media profiles, or to organisations," said Jacoby. People can avoid such risks by taking several easy security steps, which should become an integral part of any Internet user's digital life. To stay safe from phishing, always check that the link address and the sender's email are genuine before clicking anything. A robust security solution will also warn you if you attempt to visit a phishing web page. To avoid one data leak harming all your digital identities, never use the same password for several websites or services, researchers said.

Your digital data could be on sale for less than US $50: Study

Your complete digital life - including data from your social media accounts, banking and credit card details — can be sold by cybercriminals for less than US $50, scientists say.

While many of us have heard of, or even fallen victim to, <a href="http://www.wionews.com/india-news/cyber-crimes-rose-between-2014-and-2017-government-28660">cybercrimes</a> such as data and identity theft, it seems that relatively few know the value of the information stolen from us.&nbsp;

Scientists from the Kaspersky Lab, a cybersecurity company in Russia, found that while our identity may not be worth a lot in terms of dollars, it is a significant asset to criminals in other ways.

The research uncovered an appetite among cybercriminals for data stolen from popular services - including via social media accounts and remote access to gaming websites.

User confusion about what their data is worth could result in a haphazard approach to security, making it all too easy for thieves to steal data and commit a crime.

Data stolen due to people's lax security may have limited resale value, but can be put to many uses.

This can cause huge problems for an individual victim, who may lose money and their reputation, find themselves being chased for debt that somebody else has incurred in their name, or even suspected of a crime that somebody else has committed using their identity as a cover.

Kaspersky Lab investigated 'Dark Web' markets to find out how much personal data is worth, and how it is used by criminals.&nbsp;

The dark web also referred to as the darknet, is an encrypted portion of the internet that is not indexed by search engines. These networks use the internet but require specific software, configurations, or authorisation to access.

The researchers found that criminals can sell someone's complete digital life for less than US $50; including data from stolen social media accounts, banking details, remote access to servers or desktops, and even data from popular services like Uber, Netflix, and Spotify, as well as gaming websites, dating apps, and porn websites which might store credit card information.

Meanwhile, researchers found that the price paid for a single hacked account is lower, with most selling for about US $1 per account, and with criminals offering up discounts for bulk-buying.

The most common way criminals steal this sort of data in the first place is via spear phishing campaigns or by exploiting a web related security vulnerability in an application's software.

After a successful attack, the criminal gets password dumps which contain a combination of emails and passwords for the hacked services. With many people using the same password for several accounts, attackers might be able to use this information to access accounts on other platforms too.

Some criminals selling data even provide their buyers with a lifetime warranty, so if one account stops working, the buyer will receive a new account for free.

"It is clear that data hacking is a major threat to us all, and this applies at both an individual and societal level because stolen data funds many social evils," said David Jacoby, Senior Security Researcher at Kaspersky Lab.

"Fortunately, there are steps we can take to prevent it, including by using cybersecurity software and being aware of how much data we are giving away for free - particularly on publicly available social media profiles, or to organisations," said Jacoby.

People can avoid such risks by taking several easy security steps, which should become an integral part of any Internet user's digital life.

To stay safe from phishing, always check that the link address and the sender's email are genuine before clicking anything. A robust security solution will also warn you if you attempt to visit a phishing web page. 
To avoid one data leak harming all your digital identities, never use the same password for several websites or services, researchers said.

Your complete digital life - including data from your social media accounts, banking and credit card details — can be sold by cybercriminals for less than US $50, scientists say.

Your complete digital life - including data from your social media accounts, banking and credit card details — can be sold by cybercriminals for less than US $50, scientists say. While many of us have heard of, or even fallen victim to, cybercrimes such as data and identity theft, it seems that relatively few know the value of the information stolen from us. Scientists from the Kaspersky Lab, a cybersecurity company in Russia, found that while our identity may not be worth a lot in terms of dollars, it is a significant asset to criminals in other ways. The research uncovered an appetite among cybercriminals for data stolen from popular services - including via social media accounts and remote access to gaming websites. User confusion about what their data is worth could result in a haphazard approach to security, making it all too easy for thieves to steal data and commit a crime. Data stolen due to people's lax security may have limited resale value, but can be put to many uses. This can cause huge problems for an individual victim, who may lose money and their reputation, find themselves being chased for debt that somebody else has incurred in their name, or even suspected of a crime that somebody else has committed using their identity as a cover. Kaspersky Lab investigated 'Dark Web' markets to find out how much personal data is worth, and how it is used by criminals. The dark web also referred to as the darknet, is an encrypted portion of the internet that is not indexed by search engines. These networks use the internet but require specific software, configurations, or authorisation to access. The researchers found that criminals can sell someone's complete digital life for less than US $50; including data from stolen social media accounts, banking details, remote access to servers or desktops, and even data from popular services like Uber, Netflix, and Spotify, as well as gaming websites, dating apps, and porn websites which might store credit card information. Meanwhile, researchers found that the price paid for a single hacked account is lower, with most selling for about US $1 per account, and with criminals offering up discounts for bulk-buying. The most common way criminals steal this sort of data in the first place is via spear phishing campaigns or by exploiting a web related security vulnerability in an application's software. After a successful attack, the criminal gets password dumps which contain a combination of emails and passwords for the hacked services. With many people using the same password for several accounts, attackers might be able to use this information to access accounts on other platforms too. Some criminals selling data even provide their buyers with a lifetime warranty, so if one account stops working, the buyer will receive a new account for free. "It is clear that data hacking is a major threat to us all, and this applies at both an individual and societal level because stolen data funds many social evils," said David Jacoby, Senior Security Researcher at Kaspersky Lab. "Fortunately, there are steps we can take to prevent it, including by using cybersecurity software and being aware of how much data we are giving away for free - particularly on publicly available social media profiles, or to organisations," said Jacoby. People can avoid such risks by taking several easy security steps, which should become an integral part of any Internet user's digital life. To stay safe from phishing, always check that the link address and the sender's email are genuine before clicking anything. A robust security solution will also warn you if you attempt to visit a phishing web page. To avoid one data leak harming all your digital identities, never use the same password for several websites or services, researchers said.

Since India&rsquo;s Information Technology Act came into existence in the year 2000, the concept of data privacy has gained more importance. &nbsp;

&nbsp;

The Information technology Act, 2000(amended in 2008) defined data as a representation of knowledge, facts, concept or instructions which have been processed in a computer system in a formalised way, and are stored internally in the memory of the computer.&nbsp;

&nbsp;

With this definition coming into force, stakeholders seriously started considering more about the privacy of data since digital data, particularly private and financial is vulnerable. The Information Technology Act, 2000 already had provisions prohibiting unauthorised access to digital data. With the 2008 amendment, unauthorised accessing, vandalising or re-fabricating the data for misuse has been made punishable. All these penal provisions actually contribute to the concept of data privacy law.&nbsp;

&nbsp;

It needs to be understood that data can be of several types: publicly available data, private data and financial data. The concept of private data has got a wider scope, covering health data, professional profiles that may be used by workplaces, private pictures, pan card or Adhar card details so on and so forth. Financial data has been considered as a separate type of private data where data generator can be the bank as well as the person who uses the banking facilities, including online money transactions.&nbsp;

&nbsp;

On the other hand, public data may include those which has been made public either by the data generator, including the owner of the data or the data procession unit.&nbsp;

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>The Information Technology Act, 2000 (amended in 2008) makes the corporates responsible for the protection of the sensitive personal data, which it is dealing with, handling or processing</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=The Information Technology Act, 2000 (amended in 2008) makes the corporates responsible for the protection of the sensitive personal data, which it is dealing with, handling or processing" target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

&nbsp;

&nbsp;

The Information Technology Act, 2000 (amended in 2008) makes the corporates responsible for the protection of the sensitive personal data, which it is dealing with, handling or processing. This means that any organisation, including any corporate farm, bank or Internet service provider may become responsible for protecting the data. It may be punished for a failure in its duty, particularly if it does not show due diligence to protect the data under its purview.

&nbsp;

In my experience as a cyber victim counselor,&nbsp; I have seen many victims whose private data privacy has been breached. There are several ways of breaching the data privacy and some of these have been recognised by the existing laws as well.&nbsp;

&nbsp;

One of the well-known ways of breaching data privacy is unauthorised access to the data. Popularly, this is known as hacking. Notably, the term &lsquo;hacking&rsquo; is not used in the Information Technology Act 2000. Unauthorised access to data may be done by accessing the password and username.&nbsp;

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>In most cases of interpersonal cyber victimisation, the victim may unknowingly make personal data available to the perpetrator.</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=In most cases of interpersonal cyber victimisation, the victim may unknowingly make personal data available to the perpetrator." target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

&nbsp;

&nbsp;

&nbsp;What concerns me more is the victim&rsquo;s participation in breaching the privacy of the person&#39;s own data. In most cases of interpersonal cyber victimisation, the victim may unknowingly make personal data available to the perpetrator. This enables the perpetrator to carry on several types of online harassments and crimes, including the creation of fake avatar of the victim in the social media and adult entertainment sites to defame the victim, sextortion, blackmailing or spreading defamatory information about the victim to others. In this case,&nbsp; besides the perpetrators, the websites from where the personal data has been leaked may be held responsible, and even prosecuted if they fail to restrict further circulation and misuse of the data.&nbsp;

&nbsp;

Victim participation may also be noted in cases of privacy breach of financial data.&nbsp; In this case, the victim, unknowingly, reveals information about banking details like banking password, Pin Numbers, etc. This is also known as phishing. In cases like this, the banks may be held responsible for failure to protect data as the verification from the bank&rsquo;s side failed to detect unauthorised users.&nbsp;

&nbsp;

However, it must also be understood that in cases where the mobile phone device of the victim may also have been unauthorisedly accessed as a part of victimisation, the banks may argue no responsibility as they may not be aware of the &lsquo;phone hacking&rsquo;.

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="row">
<div class="article-blockquote">
<div class="col-sm-10 col-sm-offset-1 blockquote-content quoteshare">
<blockquote>
<h5>It is unfortunate to note that India still does not have any law for the protection of the privacy of the data</h5>
</blockquote>
</div>

<div class="col-sm-1 blockquote-content">
<div class="share-blockquote"><a class="twitter popup" href="http://twitter.com/intent/tweet?text=It is unfortunate to note that India still does not have any law for the protection of the privacy of the data" target="_blank">&nbsp;</a></div>
</div>
<a class="close-mark close-div" href="#" id="jqquoteclosemark">&times;</a></div>
</div>
</div>

&nbsp;

&nbsp;

It is unfortunate to note that India still does not have any law for the protection of the privacy of the data, including digital even though Data Privacy Bill was drafted way back in 2011. While the existing laws, including the Indian Penal Code (especially after 2013 Criminal Law amendment) have been supporting the victims, lacunas do exist in legal procedures and legal understanding in this regard.&nbsp;

&nbsp;

Further, a majority of the victims are not even aware of the privacy settings that are offered by websites. By privacy settings,&nbsp; I mean the reporting mechanism to inform of privacy breaching. When a victim identifies a breach of privacy of data, he/she must report the content that contains the private data to the website concerned.&nbsp;

&nbsp;

Further, the victims must also remain cautious of any kind of suspicious activities in the form of suspicious emails or bank verification messages. Any such activity must be reported to the body corporate and in more serious cases, to the police.&nbsp;

&nbsp;

Also, the victim should not adopt an irrational coping mechanism to negotiate with the breach of data privacy; it is never advisable to contact a hacker to recover the data or approach the perpetrator.&nbsp; Often it leads to an escalation of the problem. It is, therefore, best to report the matter to the police with all evidence in hand. Above all, data privacy may be prevented if the data owner remains cautious and aware. We need to remember that we live in a digital era and, hence, we have to be extra careful about our digital data.

&nbsp;

The amended Information Technology Act (2008) has made unauthorised accessing, vandalising or re-fabricating of data a punishable offense

Since India’s Information Technology Act came into existence in the year 2000, the concept of data privacy has gained more importance. The Information technology Act, 2000(amended in 2008) defined data as a representation of knowledge, facts, concept or instructions which have been processed in a computer system in a formalised way, and are stored internally in the memory of the computer. With this definition coming into force, stakeholders seriously started considering more about the privacy of data since digital data, particularly private and financial is vulnerable. The Information Technology Act, 2000 already had provisions prohibiting unauthorised access to digital data. With the 2008 amendment, unauthorised accessing, vandalising or re-fabricating the data for misuse has been made punishable. All these penal provisions actually contribute to the concept of data privacy law. It needs to be understood that data can be of several types: publicly available data, private data and financial data. The concept of private data has got a wider scope, covering health data, professional profiles that may be used by workplaces, private pictures, pan card or Adhar card details so on and so forth. Financial data has been considered as a separate type of private data where data generator can be the bank as well as the person who uses the banking facilities, including online money transactions. On the other hand, public data may include those which has been made public either by the data generator, including the owner of the data or the data procession unit. The Information Technology Act, 2000 (amended in 2008) makes the corporates responsible for the protection of the sensitive personal data, which it is dealing with, handling or processing × The Information Technology Act, 2000 (amended in 2008) makes the corporates responsible for the protection of the sensitive personal data, which it is dealing with, handling or processing. This means that any organisation, including any corporate farm, bank or Internet service provider may become responsible for protecting the data. It may be punished for a failure in its duty, particularly if it does not show due diligence to protect the data under its purview. In my experience as a cyber victim counselor, I have seen many victims whose private data privacy has been breached. There are several ways of breaching the data privacy and some of these have been recognised by the existing laws as well. One of the well-known ways of breaching data privacy is unauthorised access to the data. Popularly, this is known as hacking. Notably, the term ‘hacking’ is not used in the Information Technology Act 2000. Unauthorised access to data may be done by accessing the password and username. In most cases of interpersonal cyber victimisation, the victim may unknowingly make personal data available to the perpetrator. × What concerns me more is the victim’s participation in breaching the privacy of the person's own data. In most cases of interpersonal cyber victimisation, the victim may unknowingly make personal data available to the perpetrator. This enables the perpetrator to carry on several types of online harassments and crimes, including the creation of fake avatar of the victim in the social media and adult entertainment sites to defame the victim, sextortion, blackmailing or spreading defamatory information about the victim to others. In this case, besides the perpetrators, the websites from where the personal data has been leaked may be held responsible, and even prosecuted if they fail to restrict further circulation and misuse of the data. Victim participation may also be noted in cases of privacy breach of financial data. In this case, the victim, unknowingly, reveals information about banking details like banking password, Pin Numbers, etc. This is also known as phishing. In cases like this, the banks may be held responsible for failure to protect data as the verification from the bank’s side failed to detect unauthorised users. However, it must also be understood that in cases where the mobile phone device of the victim may also have been unauthorisedly accessed as a part of victimisation, the banks may argue no responsibility as they may not be aware of the ‘phone hacking’. It is unfortunate to note that India still does not have any law for the protection of the privacy of the data × It is unfortunate to note that India still does not have any law for the protection of the privacy of the data, including digital even though Data Privacy Bill was drafted way back in 2011. While the existing laws, including the Indian Penal Code (especially after 2013 Criminal Law amendment) have been supporting the victims, lacunas do exist in legal procedures and legal understanding in this regard. Further, a majority of the victims are not even aware of the privacy settings that are offered by websites. By privacy settings, I mean the reporting mechanism to inform of privacy breaching. When a victim identifies a breach of privacy of data, he/she must report the content that contains the private data to the website concerned. Further, the victims must also remain cautious of any kind of suspicious activities in the form of suspicious emails or bank verification messages. Any such activity must be reported to the body corporate and in more serious cases, to the police. Also, the victim should not adopt an irrational coping mechanism to negotiate with the breach of data privacy; it is never advisable to contact a hacker to recover the data or approach the perpetrator. Often it leads to an escalation of the problem. It is, therefore, best to report the matter to the police with all evidence in hand. Above all, data privacy may be prevented if the data owner remains cautious and aware. We need to remember that we live in a digital era and, hence, we have to be extra careful about our digital data.

Data privacy in modern day context

digital-data

Digital Data, News on Digital Data, stories on Digital Data, articles on Digital Data, Digital Data stories at Wion, Digital Data news, Digital Data latest news