@ Madhu I stand self corrected ignore my first post
Arup ji,
See following white paper extract. Means the lady (author of this post) has option for not only claiming civil but criminal damages too only if her side gets the cellphone records admitted as "admitted documents".
Interesting find you may comment further !
In Mr. ‘X’ v. Hospital ‘Z’ [1998 (8) SCC 296 for the first time the Supreme Court articulated on sensitive data related to health. In this case, the appellant’s blood test was conducted at the respondent’s hospital and he was found to be HIV (+). His marriage, which was already settled, was called off after this revelation. Several persons including the members of his family and those belonging to their community came to know of his HIV (+) status and was ostracized by the community. He approached the National Commission against the respondent hospital claiming damages from them for disclosing information about his health, which, by norms of ethics, according to him, ought to have been kept confidential. The National Commission summarily dismissed his complaint. Consequently he moved the Supreme Court by way of an appeal.
The appellant argued that the principle of ‘duty of care’ as applicable to persons in medical profession also included the duty to maintain confidentiality and that since this duty was violated by the respondents, they were liable to pay damages. “Right of privacy may, apart from contract, also arise out of a particular specific relationship, which may be commercial, matrimonial, or even political. Doctor-patient relationship, though basically commercial, is professionally, a matter of confidence and, therefore, doctors are morally and ethically bound to maintain confidentiality.” It however, held that although it was the basic principle of jurisprudence that ‘every Right has a correlative Duty and every Duty has a correlative Right’, the rule was not absolute and was ‘subject to certain exceptions’ in the sense that ‘a person may have a Right, but there may not be correlative Duty, and the instant case fell within exceptions.
The court observed that even the Code of Medical Ethics carved out an exception to the rule of confidentiality and permitted the disclosure in certain circumstances ‘under which public interest would override the duty of confidentiality’ particularly where there is ‘an immediate or future health risk to others’. According to the court, the ‘right to confidentiality, if any, vested in the appellant was not enforceable in the present situation, as the proposed marriage carried with it the health risk from being infected with the communicable disease from which the appellant suffered.
As regards the argument of the appellant that his right to privacy had been infringed by the respondents by disclosing that he was HIV (+) and, therefore, they were liable in damages, the Supreme Court observed that as one of the basic human rights, the right of privacy was not treated as absolute and was ‘subject to such action as may be lawfully taken for the prevention of crime or disorder or protection of health or morals or protection of rights and freedom of others.”
---------------------------------------------------------------------------------------------------------------
If one follows the judgments given by the Hon’ble Supreme Court, three themes emerge:
(1) that the individual’s right to privacy exists and any unlawful invasion of privacy would make the ‘offender’ liable for the consequences in accordance with law;
(2) that there is constitutional recognition given to the right of privacy which protects personal privacy against unlawful governmental invasion;
(3) that the person’s “right to be let alone” is not an absolute right and may be lawfully restricted for the prevention of crime, disorder or protection of health or morals or protection of rights and freedom of others;
Privacy and Data Protection
Privacy is closely connected to Data Protection. An individual’s data like his name address, telephone numbers, profession, family, choices, etc. are often available at various places like schools, colleges, banks, directories, surveys and on various web sites. Passing on such information to interested parties can lead to intrusion in privacy like incessant marketing calls.
It would be a misnomer to say that India does not have ‘data protection’ legislation at all. This is factually wrong. The fact is that there exists data protection legislation in India. The subject matter of data protection and privacy has been dealt within the Information Technology Act, 2000 but not in an exclusive manner.
The Information Technology Act, 2000 provides for civil liability in case of data, computer database theft, privacy violation etc.
The Act provides a complete Chapter (Chapter IX) on cyber contraventions, i.e., section 43 (a) – (h) which cover a wide range of cyber contraventions related to unauthorised access to computer, computer system, computer network or resources.
Section 43 of the Act covers instances such as: (a) computer trespass, violation of privacy etc. (b) unauthorised digital copying, downloading and extraction of data, computer database or information;. theft of data held or stored in any media, (c) unauthorised transmission of data or programme residing within a computer, computer system or computer network (cookies, spyware, GUID or digital profiling are not legally permissible), (d) data loss, data corruption etc., (e) computer data/database disruption, spamming etc., (f) denial of service attacks, data theft, fraud, forgery etc., (g) unauthorised access to computer data/computer databases and (h) instances of data theft (passwords, login IDs) etc.
The Information Technology Act, 2000 provides for criminal liability in case of data, computer database theft, privacy violation etc.
The Act also provides a complete Chapter (Chapter XI) on cyber offences, i.e., sections 65-74 which cover a wide range of cyber offences, including offences related to unauthorised alteration, deletion, addition, modification, alteration, destruction, duplication or transmission of data, and computer database.
For example, section 65 [Tampering with computer source documents] of the Act is not limited to protecting computer source code only, but it also safeguards data and computer databases; and similarly section 66 [Hacking with Computer System] covers cyber offences related to (a) Illegal access, (b) Illegal interception, (c) Data interference, (d) System interference, (e) Misuse of devices, etc.
Interestingly, section 72 [Penalty for breach of confidentiality and privacy] is aimed at public (and private) authorities10, which have been granted power under the Act to secure access to any electronic record, book, register, correspondence, information, document or other material information. The idea behind the aforesaid section is that the person who has secured access to any such information shall not take unfair advantage of it by disclosing it to the third party without obtaining the consent of the disclosing party.
Source acknowledgement : https://www.iamai.in/Upload/IStandard/White%20Paper%20on%20Privacy.%202007.pdf