Private Data Breach at Air India

Air India announced on 15th May 2021 that due to a cybersecurity attack, personal data of the customers registered
between August 2011 to February 2021 was leaked and which included passenger names, date of birth, contact information, passport information, ticket information, frequent flyer and credit card data. The Air India’s data leak incident affected around 45 lakh customers globally.

Who is liable?

Those users whose data has been leaked can file a suit against these companies for damages under the Consumer Protection (e-commerce) Rules, 2019, also, companies can be held accountable under Section 43A of the IT Rules 2011, if they fail to protect personal data of users.

Why should companies proactively disclose breaches? Because it not only helps in maintaining trust and transparency amongst customers, but reduces the cost incurred by such breaches.

What can you do to protect your data?

• Mandatory turning on two-factor authentication for all accounts and utilizing recommended apps such as Authy. People should also have a secondary email address that doesn’t contain personal information.
• If a breach involves financial information, notify banks where you hold an account.
• Change your passwords if you receive any security alerts.

Other recent incidents of data breaches in India

• Data breaches in India were increased by 37 percent in 2020 compared to that in 2019.
• In 2021, data of 18 crore Domino’s orders was leaked online and included name, email, mobile number, and even the GPS location of the user.
• Similarly, sensitive data of millions of customers were leaked in the data breaches at Mobikwik, Upstox, Big Basket and Facebook.

Also Read: What is Social Engineering and How Does it Work?

European Union’s GDPR

Unlike current Indian laws, European Union’s General Data Protection Regulation (GDPR) requires airlines to put in place measures for data protection and report cases of data breach to regulators within 72 hours of becoming aware of it. Noncompliance or negligence with the GDPR can result in a fine being imposed on the company up to $24.1 million or 4% of annual global turnover of the company (whichever is higher).

Also Read: 4 Reasons Why You Need an Actively Scanning Antivirus Software

India’s data protection laws

• India’s Personal Data Protection (PDP) Bill, 2019 provides power to the consumers over their data. The Bill makes it mandatory for businesses to report data breaches and inform consumers if their personal data have been compromised.
• Additionally, provision is also made under the PDP wherein, companies can be fined if found violating rules laid down under PDP and the fine would be between 2% and 4% of global turnover of the company or Rs 15 Crore (whichever is higher).
• Sadly, the Bill still lacks implementation.