Clarification on Sec 43A
The Ministry of Communications and Information
Technology has released the following clarification on Sec 43A dated
24th August 2011
Clarification on Information Technology (Reasonable
Security Practices and Procedures and Sensitive Personal Data or
Information) Rules, 2011 Under Section 43A of the Information Technology
ACT, 2000
PRESS NOTE
The Department of Information Technology had notified Information
Technology (Reasonable security practices and procedures and sensitive
personal data or information) Rules, 2011 under section 43A of the
Information Technology Act, 2000 on 11.4.2011 vide notification no.
G.S.R. 313(E).
These rules are regarding sensitive personal data or information and are
applicable to the body corporate or any person located within India. Any
such body corporate providing services relating to collection, storage,
dealing or handling of sensitive personal data or information under
contractual obligation with any legal entity located within or outside
India is not subject to the requirement of Rules 5 & 6. Body corporate,
providing services to the provider of information under a contractual
obligation directly with them, as the case may be, however, is subject
to Rules 5 & 6. Providers of information, as referred to in these Rules,
are those natural persons who provide sensitive personal data or
information to a body corporate. It is also clarified that privacy
policy, as prescribed in Rule 4, relates to the body corporate and is
not with respect to any particular obligation under any contract.
Further, in Rule 5(1) consent includes consent given by any mode of
electronic communication.
Ministry of Communications & Information Technology (Depatt. of
Information Technology)
Press Information Bureau, Government of India, Bhadra 2, 1933, August
24, 2011
SP/ska
(Release ID :74990
The exception that is being granted is in respect of the following
rules:
5. Collection of information.—
(1) Body corporate or any person on its behalf shall
obtain consent in writing through
letter or fax or email from the provider of the
sensitive personal data or
information regarding purpose of usage before collection of
such information.
(2) Body
corporate or any person on its behalf shall not collect sensitive
personal
data or information unless ―
(a) the information is collected for a lawful purpose connected
with a function
or activity
of the body corporate or any person on its behalf; and
(b) the collection of the sensitive personal data or information
is considered
necessary
for that purpose.
(3) While collecting information directly from the person
concerned, the body corporate or
any person on its behalf shall take such steps as are, in the
circumstances, reasonable to
ensure that the person concerned is having the
knowledge
of ―
(a) the fact
that the information is being collected;
(b) the
purpose for which the information is being collected;
(c) the
intended recipients of the information; and
(d) the name
and address of ―
(i) the agency that is
collecting the information; and
(ii) the agency that will
retain the information.
(4) Body corporate or any person on its behalf holding sensitive
personal data or information
shall not retain that information for longer than is required for
the purposes for which the information may lawfully be used or is
otherwise required under
any other law for the time being in force..
(5) The information collected
shall be used for the purpose for which it has
been collected.
(6) Body
corporate or any person on its behalf shall permit the providers of
information, as and when requested by them, to review the
information they had provided and ensure that any personal
information or sensitive personal data or information found to be
inaccurate or deficient shall be corrected or amended as
feasible:
provided that a body corporate shall not be responsible for the
authenticity of the personal
information or sensitive personal data or information supplied by
the provider of
information to such body corporate or any other person acting on
behalf of such body
corporate.
(7) Body corporate or any person on its behalf shall, prior to
the collection of information including sensitive personal data or
information, provide an option to the
provider of the information to
not to provide the data or information sought to be
collected. The provider of information shall, at any time while
availing the services or
otherwise,
also have an option to withdraw its consent given earlier to the body
corporate. Such withdrawal of
the consent shall be sent in writing to the body corporate. In
the case of provider of information not providing or later on
withdrawing his consent, the body
corporate shall have the option not to provide goods or services
for which the said information was sought.
(8) Body corporate or any person
on its behalf shall keep the information
secure as provided in rule 8.
(9) Body corporate shall address any discrepancies and grievances of
their provider of the information with respect to processing of
information in a time bound manner.
For this purpose, the body corporate shall designate a Grievance Officer
and publish his name and
contact details on its website. The Grievance Officer shall
redress the grievances of provider of information expeditiously but
within one month from the date of receipt of grievance.
6. Disclosure of information.—
(1) Disclosure of sensitive personal data or
information by body corporate to
any third party shall require prior permission from the provider of such
information, who has provided such information under lawful contract
or otherwise, unless such disclosure has been agreed to in the
contract between the body corporate and provider of information, or
where the disclosure is necessary for
compliance of a
legal obligation:
Provided that the information shall be shared, without obtaining
prior consent from provider of information, with Government agencies
mandated under the law to obtain information including sensitive
personal data or information for the purpose of
verification of identity, or for
prevention, detection, investigation including cyber incidents,
prosecution, and punishment of offences. The Government agency shall
send a request in writing to the
body corporate possessing the sensitive personal data
or information stating clearly the
purpose of seeking such information. The
Government agency shall also state
that the information so obtained shall not be
published or shared with any other
person.
(2) Notwithstanding anything contained in sub-rule (1), any sensitive
personal data or Information shall be disclosed to any third party by an
order under the law for the time
being in force.
(3) The body corporate or any
person on its behalf shall not publish the
sensitive personal data or
information.
(4) The third party receiving the sensitive personal data or information
from body corporate or any person on
its behalf under sub-rule (1) shall not disclose it
further.
However there is no information on the rule 8.
Naavi
August 25, 2011
Comments are Welcome at
naavi@vsnl.com
