Uncategorized

The Princess and her photos: a modern day fairy tale of internet kingdom by Dr.Debarati Halder

Photo credit: internet

We the common civilians are mostly obsessed with the tales of princes and princesses, their kingdoms, their lifestyles and obviously, their richness, the wealth they display and the wealth of wisdom that is displayed by the media. Today majority of the countries have democratic setup with an elected president as the head of the State. Some countries in Europe, Asia and Africa however have monarchial systems with Kings and Queens as the head of the State. These monarchs ascend the throne as a hereditary right. Post second world war, some monarchs have been ousted either to accommodate the best in the line or to bring in a democratically elected head of the state. In either cases, the lifestyle of the royal families attracts lot of public attention always. It is alleged that this public inquisitiveness is monetized by professional photographers: the more the images of royal women are captured the more these photographers gain monetarily. The tragic death of Diana, princess of Wales is a glaring example. Images of her last moments in the car crash are still floating in the internet and these are heavily searched, giving more profits to those creators who keep on sharing such images with extra touch of editing.

Recently another royal woman, the present Princess of Wales has attracted unwanted attention for an image featuring herself with her three children including future heir to the throne. Apparently Catherine (popularly known as Kate) had undergone for an abdominal surgery which many speculated to be connected with cancer. Post-surgery, Kate and her family had to break this speculation so that neither her family nor the  country may be targeted for an unwanted bash on the health and lifestyle of the Royals which may lead to many diplomatic and  political speculations. All these were finally triggered with a single photograph.

What was the issue: the photograph, shared by the official handles of  Prince and Princess of Wales showed a happy mother holding two children with her hands  and  her three children happily laughing with her. Photo scrutinizers figured out that the photo has been edited and the presentation suggests that the mother’s hand and the daughter’s waist do not match in an ideal way. There was some more editing which raise questions as to whether the children were really sitting with the mother in the outdoors for the happy photograph. Kate later apparently shared an apology to accept that the photograph was (badly) edited. This further raised the speculation of the health update of the Princess and the authenticity of the information shared by the social media handles of the couple (prince and princess of Wales).

What is the legal issue: After the tragic death of Diana, princess of Wales, her son Prince of Wales had emphasised for privacy of the family like any other common civilian family. The introduction of UK Data Protection Act, 2018 made the right to privacy a significant right for all including members of royal family. While this may prevent third party infringement of the right to privacy for the members of royal family, question arises about legal protection against public expression through comments on the specific photograph shared by the social media handles. Here two main issues may be identified: what was shown by the image creator/distributor and what expression /actions are being generated by various stakeholders about the data owner (in this case, the Princess of Wales). Courts in England have highlighted the need for protecting privacy of medical records which may be ‘presumed’ and shared for ‘public interest’ on the basis of photographs : Naomi Campbell’s case is the best example in this regard.  In Kate’s case, the issue may be connected to a certain extent because she and her children are not ‘photographed’ like Naomi. Rather, she had consensually been photographed and had apparently taken right to edit the photograph. Here emphasis is shifted to expressed comments /speech that may affect her reputation, her health records and obviously the privacy of her children. But can an individual or a family (even if it is a Royal Family) silence the speech which expresses speculations and  may build up theories of non-reliance of information shared by individuals who are followed and watched by many?  judicial precedents to a large extent have removed that protection from public figures unless such speech is passing through clear and present danger test.

The risk-factor for all: But in this case apprehend harm is more intense. The photo scrutinizers have not only checked the blurred parts, additions and deletions, they have revealed information about possible stay of the family including the children in specific locations, vulnerable mental health factors and obviously the ‘body search’ of the mother and children. This throws a challenge for all women across the globe who would wish to share their selfies, images of their children and locations. Any one now can scrutinise the dress, sitting positions and the facial images to understand the body size (which may fall within the category of sensitive personal data), specific identifiable marks in the face and geo locations. This may make it easy for predators for image cloning for criminal purposes, virtual striptease and online sexual assault of women and children by using Artificial intelligence supported by human imagination.

Is there any suggestion for protection? Yes off course! While the application of copyright laws is being prescribed worldwide to prevent unwanted usage of the images and get relief, Data protection laws and penal codes are offering solutions for preventing the wrong doer from causing more harm and punishing for wrong doer. But the originators/creators may still need to take the responsibility for controlling who may access the images and when they may access such images. We may not control the public interest into the lives of celebrities. But definitely a growing awareness about privacy and respect to privacy may go a long way to let the princes and princesses, actors, players, influencers who have become highly ‘consumable’ in the era of internet live safely forever.

Please don’t violate the copyright of this writeup. Please cite as Halder Debarati (2024).The Princess and her photos: a modern day fairy tale of internet kingdom. Published in https://internetlegalstudies.com/2024/03/22/the-princess-and-her-photos-a-modern-day-fairy-tale-of-internet-kingdom-by-dr-debarati-halder/ on 22-03-2024

Uncategorized

Looking for 5 star restaurants or amenities or service providers? Here is the reality by Dr.Debarati Halder

Image courtesy: author

Recently there was a news report of a woman losing a little fortune for a pencil marketing scam in India. In the contemporary world, digital marketing has become a lucrative job for all. This promises a good income from the home comfort zone and just needs two tools: internet connection and a digital technology enabled device (it can be either a smart phone or a laptop or desktop computer). But this is a myth bursting report for everyone who may read this article. I have been contacted by a recruiter agency recently and I got to see a practical example as how such agencies dupe people, especially women.

  1. How do these agencies get the phone numbers of the target victims?

Apparently they have a super research team who may go for data mining from every possible source: this can be data base of the shops where we may have recently visited and shared the phone numbers, our phone data recharging agencies where our phone numbers are supposedly saved for processing the data, third party service providers who may be working with our phone numbers, Aadhar data etc., for our professional workspaces etc. The one who contacted me (un)smartly shared that they collect ‘verified numbers’ by partnering with telecom companies for the purpose of market survey for their clients. Now the question is: who are these telecom companies? Apparently they are the digital communication service providers like Airtel, Jio, Vodafone etc. But not really: there are many telecom agencies who are middlemen. They are the agents of the main data fiduciary. They are data collectors, recharge service providers and they are all bound in the same legal chain, namely Digital Personal Data Protection Act, 2023 and Information Technology Act, 2000(amended in 2008).

  • Modus operandi: These ‘agency’ people filter the profile of data profiles on the basis of certain criteria. This may include age, gender and geo-location. They may contact the target through SMS or through WhatsApp. In the case of later, they may start the conversation by stating about the daily estimated income and after that they may share the trial task. It is but obvious that they do not stick to a static number. Hence if one completes the trial task and shares the bank details, the scammer may ‘vanish’ with account details and some essential confidential information that may enable them to access the account without much hard work.
  • Now comes the question as what type of task would be given and what is the ‘job’. This surprised me because I am a foodie and I really trust the ‘stars’. But its time to come out of the myth. No restaurant may have a neat 5 star from customers and diners. It’s the manipulative work of digital marketing companies that may outsource the job to people like me and you and in between some scammers may join to mint money from both the parties. I was asked to rate restaurants from Google map and the ‘task’ restaurant was somewhere 260 kilometers away from where I stay. I have never visited the restaurant and the place where it is situated. I have never seen their menu card nor I have tasted their food (nope, not even by Zomato  or Swiggy because they wont deliver any food item so far).

Now probably you may know how some restaurants, shops, hotels or even health care service providers may get 5 stars and stay at the top of search list!

But that’s not all. These agencies may necessarily provide links to upload positive comments and stars. A click on them may invite many more digital trouble.

  • Would they be worried if you tell them you have lifted the ‘innocent veil’ and found out who they are? Answer is ‘no’. That’s because they would take seconds to change their phone numbers and delete all texts shared with the victims to disable the latter to take any evidence to the police.

Why are they targeting women? A possible answer is women, especially undergraduate students and home makers may need to make money from the comfort of home. It’s a moonlighting while the home makers are involved in full time household chores.  And yes, most the targets may not be able to suspect the scammers because they may use women’s photographs in their WhatsApp profiles. As such, we may never know who accesses our WhatsApp or Instagram profile pictures and how they may be misused.

The laws that may help: First of all, understand why they are called scammers and what sort of crime they are doing. Digital personal data protection Act , 2023 has mandated that all data collectors must mandatorily explain the reason behind colleting the personal data (including the phone numbers) of data principals. All data fiduciaries are also mandated to explain why and how the collected data will be processed. Have you ever heard from your shopping mall or any other service provider stating you clearly why they are collecting your number? It’s not n for future connection. But its for sharing our phone numbers (whether consciously or unconsciously) with scammers who may continue to feed other business establishments   by providing unauthorized information. S.43A of the Information Technology Act, 2000(amended in 2008) makes the body corporate liable to pay damages to data owners for negligence to protect the integrity of the data. But this is the live example as how all stakeholders in this regard dupe the actual data principle.

Often victims who may understand that they are trapped, may try to counter these scammers by calling them, sharing photos and numbers of the scammers on the social media portals, or even try to reach out to them searching for the physical office addresses. Each of these may invite different kinds of trouble. The best way to address this is to be aware of the patterns of  fraudulent activities done by such scammers, block and report the phone  numbers to the intermediary and report the matter to the portal of https://cybervolunteer.mha.gov.in/webform/Volunteer_AuthoLogin.aspx  . Remember, we women are the chosen target for cyber crooks because they feel women are less empowered. It is our right to be safe and duty to prove them wrong!

Stay safe.

Please don’t infringe the copyright of this write-up. Please cite this as Halder.D(2023). Looking for 5 star restaurants or amenities or service providers? Here is the reality. Published on 11-11-2023 @https://wordpress.com/post/internetlegalstudies.com/1472

Cyber Law

Intermediary liability: Are Universities countable? By Dr.Debarati Halder
Image Courtesy: Internet

Behind every data storage mechanism , there is a human intelligence that works to decide how the data store house will be managed, protected and which data may be exposed and how. For Long I have been arguing that behind every breach of data security, there is a human brain. He/she can be a data collector, data fiduciary, data manager, data protection engineers or a designated data protection officer of any website and tech company. My argument becomes stronger with every day update on data breaching methods: this time it is a two member group of  university officials in western India who have been accused for leaking cloud storage password to another university located in central India. while the accused persons have the right to defense for such allegation, such information may suggest that no organization including the banks, hospitals, universities and government departments dealing with civilian’s data are safe.   

Let us first understand what is an intermediary:

Often, we tend to confuse the term intermediary with website, internet service provider and internet. All  three of them denote different meanings but the concept is over lapping with each other. Indian information technology Act 2000 (amended in 2008) defines  intermediary  especially in respect to electronic records and data in S.2(w) as

any person who on behalf of another person (i) receives, stores or transmits that record or

(ii)provides any service with respect to that record and

(iii) includes telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes.

Interestingly the word “any person” has got different meanings in this section: when it says “any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record”, it may mean a natural person, i.e. human beings (especially adult human beings, who may be capable to take rational decisions, enter into contracts  etc.) again, when it says “telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes” etc, it may mean a juristic person who has legal personality and who may be represented by its human representatives like the CEOs or the  nodal officers etc.

In its preamble (para 4)in  Recommendation CM/Rec(2018)2 of the Committee of Ministers to member States on the roles and responsibilities of internet intermediaries, the Committee of Ministers, Council of Europe has shared some functions of such intermediaries which are as follows: …………………. “internet intermediaries”, facilitate interactions on the internet between natural and legal persons by offering and performing a variety of functions and services.

Some connect users to the internet, enable the processing of information and data, or host web-based services, including for user-generated content.

 Others aggregate information and enable searches; they give access to, host and index content and services designed and/or operated by third parties.

Some facilitate the sale of goods and services, including audio-visual services, and enable other commercial transactions, including payments.

Individual responsibility of the natural person intermediary for failure to protect the confidentiality of the data

As the above discussion may lead us to understand the meaning of intermediary as both natural person as well as juristic person (who may be represented by a natural person), let me now explain how intermediary (natural person) including the data manager and /or the data protection officer as appointed by the data fiduciary may be responsible for leaking of the data saved in data storehouse under the body corporate . He/she may

  1. Intentionally violate the obligation of confidentiality and share the security password for the data to third party without consent of the body corporate or the data fiduciary who may have collected the personal data for specific purpose.
  2. Negligently passes over the security information to third party to allow the confidentiality of the data to be breached.

In both these cases the primary responsibility of data breach may fall upon the Body corporate who may need to pay compensation under S.43A of the information Technology Act, 2000(amended in 2008) to the data principals whose data has been breached while the same was under his custody. But then such individual (natural persons) may also be held responsible under numbers of legal provisions. These may necessarily include S.72A of the Information Technology Act which prescribes punishment for disclosure of information in breach of lawful contract. This bag of penal provisions against such intermediary (including the data manager or the data protection officer) may also include S.43 read with S.66 of the Information Technology Act which prescribes punishment computer related offences.

What we understand from the above especially about universities as intermediaries as well as body corporates?

Universities are also intermediaries and body corporates who collect personal data including sensitive personal data of the teaching and non-teaching staff and of the students.

The personal data of the above-mentioned stakeholders are connected with their family members. Hence it may be easy for the possible perpetrators to fish out sensitive personal data of university employees and students as well as their family members.

Universities as body corporates also hold information about their own examinations, public examinations and data related to foreign university collaborations (which may also include domestic -foreign trade collaborations).

As a matter of fact, then if data is leaked from the university data base or the university is attacked by ransomware attacks, all stakeholders connected with the universities may be affected and women will be particularly vulnerable targets. It is necessary therefore that all universities must set up proper cyber security infrastructure and employ trained data protection officers and data managers who may be providing safe services for all as university intermediaries.

Please don’t violate the copyright of this writeup. Please cite as Halder Debarati (2023)Intermediary liability: Are universities countable? Published on 31-10-2023 @https://wordpress.com/post/internetlegalstudies.com/1463

Editor's column, Uncategorized

THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: can women expect any meaningful protection for Data privacy now? by Dr.Debarati Halder
Women for women

On 11th August, 2023 the much awaited The Digital Personal Data Protection Act, (DPDA) 2023 came into existence finally. Drafted majorly in the shadow of the EU general Dara Protection Regulations, DPDA offers certain rights to the data principals and certain duties to the data fiduciaries. But first, let me break a myth: DPDA is not an exclusive statute for providing privacy to our Data. The words ‘protection’ and ‘privacy’ may not be synonymous always.

 If we look into the preamble of DPDA we would see that the preamble offers four reasons for enacting this law:

  1. To provide for the processing of digital personal data in a legalised manner
  2. To recognise the right of individuals to protect their personal data and
  3. To recognise the  need to process such personal data
  4. To recognise the  lawful purposes for processing the data

Every individual is a data principal according to S.2(J) of the DPDA. Irrespective of gender and age a data principal is a person to whom the concerned data is related. However, this provision clarifies the status of children and disabled by stating that for the former the parents or the lawful guardians will become the data principal and the for later, the lawful guardian will be the data principal. As we know from the Information Technology Act, 2000(amended in 2008), data means nothing but information that may represent many profiles of individuals: these may include financial status, health status, educational status, maturity status, marital status, and what not. Data itself may be extremely costly especially when it is processed and formally associated with specific organizations or institutions. According to S.2(x) “processing” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction

Interestingly,  DPDA therefore advocates not only for the protection of the integrity of the data while it is being processed, it also bats for right to be forgotten.

For years I have been observing that women are targeted on the cyberspace for many illegal acts. I have witnessed the amendment of Indian Penal Code whereby a dedicated series of S.354 was introduced for penalizing several patterns of criminalities on cyber space. These included cyber stalking, voyeurism, disrobing women in the physical space and photographing the assault, sexual harassment and using sexually explicit language, gestures etc. Several other laws such as The sexual harassment at workplace (prevention, prohibition and redressal) Act, Indecent representation of women (prohibition) Act etc, were introduced, amended to provide further protection to women and support Information Technology Act, 2000(amended in 2008). None could actually completely prevent online crimes against women. On the contrary, perpetrators have found new ways to commit cyber-crimes against women. At present we get to see women are targeted more by fraudsters who are tricking them for financial loss.

DPDA creates a layer of protection against the data processing stakeholders. A processed data may contribute for creating identity of the data principal, educational degrees, health records, financial records etc.  Most of these are vulnerable sensitive personal data. DPDA therefore has enhanced the responsibility of the data fiduciaries to protect the consensual data that is shared with them.

But now let us see how DPDA may not protect the interest of women:

  1. Who manages the Artificial intelligence that will be applied for processing of the data under S.2(X) of the DPDA?

The Act indicates that the Data fiduciaries and the data processors may be responsible for controlling the AI for processing the data. But where is the data pool for the AI which will be working with the data ? we must not forget that most data fiduciaries may use foreign based AI for  processing data. In that case is there any specific rule to control the foreign entity who may be controlling the AI? The answer may be found in S.3(b) of the DPDA which shares about the scope of the Act. It says as follows:

        Subject to the provisions of this Act, it shall (b)        ………..also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India ;

The answer may also be found in S.11 which speaks about rights of the data principal. But again, this needs a clear explanation.

It is not very clear if the AI system (that will be applied for data processing) falls within the meaning of “services to data principles within the territory of India”. If this falls within this category, then we need to see whether the contractual obligations between the data fiduciary and the AI creator company/entity can be made transparent to the data principal.

2.How would the non-digitized data be digitized without manipulating the original data?

Let us go back to S.3 of the DPDA again. While explaining the scope of the DPDA, S.3 (a) mentions that this Act shall apply to the processing of digital personal data within the territory of India where the personal data is collected…….in non-digital form and digitised subsequently. In such case and also in the case of processing digital data, DPDA does not mention what security procedure may be applied to restrict the leaking of sensitive personal data of data principals, especially women. Such question may be answered through the DPDA Rules that we are looking forward for. But honestly, there may be many occasions where data would be exposed unauthorisedly by the data protectors themselves. We need to see how far the statute would be implemented to heal the harm and compensate the data principal directly especially when the data principal is a senior citizen or a minor or educationally challenged or a disabled woman.

3.Now comes the question of grievance redressing mechanism system that must be set up by data fiduciary as has been mentioned in S.8(10) of the DPDA.

The Act remains silent about the infrastructure of the said mechanism. If we look into Information Technology Act, 2000(amended in 2008) we get to see the court system where the qualification of the forum members (for example, Administrator for civil offences etc) are clearly mentioned. But neither the Information Technology Act, 2000(amended in 2008) mention anything about the qualification of the grievance redressal officers. IT(intermediary guidelines and digital media ethics) Code, 2021 discusses in detail about engaging grievance redressal mechanism by the intermediaries in Rule 3(focusing on due diligence by intermediaries ) and Rule 10 (furnishing and processing of grievance), and Chapters 2, 3 and 4(which discuss about level 1, 2 and 3 of self regulating mechanism and oversight related mechanism. We have to see if DPDA applies parts of   IT(intermediary guidelines and digital media ethics) Code, 2021 for mandating the data fiduciaries to set up grievance redressal mechanisms. In my opinion, data fiduciaries must consider engaging women officers to look after the grievances from women data principals. This may make the female data principals (especially those coming from orthodox societies and those who may be educationally and/or socio-economically challenged to access the male dominated grievance redressal mechanisms) feel comfortable to share their grievances. This may also encourage better reporting of criminal activities on cyber space.

  • DPDA under S.3© very clearly withdraws its scope from the data principals in the following situations:

(i)    personal data processed by an individual for any personal or domestic purpose; and

(ii)   personal data that is made or caused to be made publicly available

by—(A)   the Data Principal to whom such personal data relates; or (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

The explanation to S.3 of the DPDA explicitly shows that if a data principal voluntarily shares her personal data publicly, DPDA provisions (regarding the responsibilities of data fiduciaries) will not be applicable here. In my capacity as cybercrime victim counsellor, I have seen the unfortunate rise of cybercrime cases and more unfortunate cases of victim blaming in cases such as those mentioned in the exception of S.3© of the DPDA: bloggers, digital creators and social media influencers intentionally share their personal data for profit gain. In case of infringement of their data integrity or data breach, they will now become ‘guardian-less victims’ who should brace themselves to face challenges in the system of criminal justice. But here lies the legal twist: such women may claim the protection of DPDA if their sensitive personal data integrity is violated due to the negligence of the data fiduciary i.e., the intermediary/website/web domain etc, who are providing them platforms to publish their blogs, write-ups, opinions, videos, business related information etc.  As such, women bloggers, digital creators and social media influencers must go ahead with their data sharing and data processing contracts with the primary data fiduciary (the web domains, websites etc) with extreme care. Such women (and men too) must now consult lawyers to prepare an agreement for entering into contract with such intermediaries etc, who have always tried to dominate the contractual relationships with their custom made agreements which may enable them to escape the liabilities by using immunity veils.

4. Last, but not the least is the question of “lawful purposes” that makes the data fiduciaries liable to share the personal sensitive data with the government stakeholders.

The issue of surveillance is mention-able here. While there may be surveillance in the name of safety of the nation, peace and security of the community, friendly relationship with neighbouring countries and even for protecting the rights of the fellow citizens as has been stated under Article 19(2) of the Constitution, misuse of power by government officials including police officers to breach the integrity of personal data of women may be a serious blow on the right to protection and privacy of digital data.

DPDA, 2023 offers many positive aspects for data protection. But this is a beginning of a new understanding of data protection regime in India. We need to have lot more research on the practical applicability of the Law to provide safety to women. Let this ‘new beginning’ bring more positive attitude and awareness for a holistic safety on cyber space.

Please note: please do not violate the copy right of this writeup. If you want to use it for your article, assignment, project etc, please cite it has Halder Debarati (August, 2023) THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: can women expect any meaningful protection for data privacy now? Published in https://wordpress.com/post/internetlegalstudies.com/1433 on 24-08-2023

Cyber Law, Editor's column

ChatGPT : a new legal challenge? by Dr.Debarati Halder

Since November 2022, several stakeholders including those in the education sector have been widely discussing about the new Artificial intelligence based  chatbot ChatGPT.[1] Not so long ago we got to see few AI based human assistance apps Alexa and Siri. These were also connected with internet of things. They answered many questions, guided clients for accessing information of any type and generated any cyber security and data privacy issues. In the legal profession we got to see possibilities of AI based judges. Many lawyers and human-right activists were strongly against this while some actually felt triumphant thinking that AI based judicial work will be accurate and would be giving needed justice to the parties. ChatGPT has created new sensation: not only because it is solving test series[2], but also there are possibilities of probable clash with copyrights of many contents. 

As many resources on ChatGPT had suggested, it works on human fed information and attempts to answers put up before it. There are few implications for this:

  1. For academic evaluations, the chatbot is fed the information and probable assessment questions. The success depends on how accurately and how quickly the AI system matches the correct answers.
  2. Students may misuse the system and possibilities of wide range copyright violation cannot be overruled.
  3. The chatbot is fed about probable legal issues and the nearest legal solutions for the same. The scope of said legal solutions may be expanded by accessing several other contents available on the internet. This may actually make the chatbot more accurate than an attorney farm or a practitioner whose research team may need several days to prepare the brief to support the client. In short, , human emotional intelligence may be lacking while counselling clients, especially in cases of private injuries.
  4. The chatbot interacts with human beings for assistance. Even though the makers of the chatbot claims that it has better data security, at present all AI based human assistance apps are questionable for providing data privacy and security. There is no guarantee that the personal data including sensitive personal data will be protected.

ChatGPT is heavily supported by LargeLanguage Model (LLM) model tools and this may necessarily have a third-party moderator of the information/data. Within four months of its inception, usage of ChatGPT has become questionable from all sectors including the legal sector: consider this thought provoking article on digital literacy training of the judiciary touching upon the usage of ChatGPT in delivering judgements in the USA[3]: Gutiérre raises question on probable errors in the judgement as judges may not know to check the authenticity of the  information received from ChatGPT. Gutiérre suggests for development of a policy to use the AI based human assistance tools for legal professionals and I completely agree with the same.

Let us not forget that emotional intelligence plays havoc in providing healing touch for cases falling in the category of personal injury. Chatbots or any other robot legal researcher would not be able to map and match the emotional injury with physical injury and quantity of damages and compensation. Similarly an assessment designed to evaluate the positive learning process of a student can not achieved properly if the AI based assistance tools are used without any proper guidelines. It is time that we humans tame our machine intelligence  by setting certain guidelines first. Otherwise the precious human intelligence for creating artificial intelligence will be used only for destruction and overpowering the good by evil intentions.

[1] For more understanding, see https://openai.com/blog/chatgpt/ Accessed on 21.02.2023

[2] See Rosen Kalhan (2023) . ChatGPT passes MBA exam given by a Wharton professor. Published in https://www.nbcnews.com/tech/tech-news/chatgpt-passes-mba-exam-wharton-professor-rcna67036 on 24-01-2023. Accessed on 25-01-2023

[3] Juan David Gutiérrez(2023) ChatGPT in Colombian Courts:

Why we need to have a conversation about the digital literacy of the judiciary. Published in https://verfassungsblog.de/colombian-chatgpt/?fbclid=IwAR3X2r9vVJH5HeYcGf_O4cBNoKae4_TouFLH36TOJqZ1B954NTqLFnrgFug on 23-02-2023 . Accessed on 23-02-2023

Cyber Law

Moonlighting and data security issue for children by Dr.Debarati Halder

Photo courtesy : Internet

Off late several companies had become extremely concerned for moonlighting by their employees. Moonlighting is a term that signifies involving in a second job for profit  while being in a full time employment. The 2020 covid pandemic has increased the tendency for moonlighting for employees in several companies including the tech companies as most of the workplaces reduced the salaries of employees and this caused huge financial tension for many. Legally moonlighting may or may not be safe for many: many European countries, US, Canada, Australia etc, may allow employees for moonlighting. Even academicians including teachers, university professors may also choose for a second job when they are off duty. But the problem arises when the employees go for moonlighting with the company data.

Why and how Moonlighting becomes an offence and who are the victims? in 2022, Tesla terminated an employee for showcasing and discussing  certain automobile features in his YouTube channel. Interestingly running a YouTube channel had not been considered as moonlighting even though such activities may help the YouTuber to earn profit.  But this was considered as offensive by the company because the employee actually criticised certain products using the company data which only he could access being an employee. Now consider the other side of the coin: if this employee had secretly sold the company data to other competing company for profit or may had been engaged in moonlighting works like consumer preference analysis, product marketability analysis, business analysis or even employee data analysis with the help of the confidential data of his employer company, he would have been definitely subjected for legal liabilities and he may even have the chance for being jailed.  This may no longer remain simple harmless moonlighting. Rather, it may involve data privacy breach by the concerned employee because he may  have  violated the integrity and confidentiality of the data owned and maintained by the companies.

Here we have to understand the types of the data and the types of the ‘victims’ that may be affected:

First victim would be the company itself as the company secrets including trade secrets would be affected. The designs, company logo, manufacturing process, company policies for marketing, specific software etc, may fall within the meaning of company’s intellectual properties which many employees fail to acknowledge or may not know. 

The second typology  of the victims has a wider scope than the first: it includes individuals and their  personal data that may have been collected by the companies in the name of customer data, patient data, government beneficiary data, banking related data etc. Presently almost all companies have become body corporates who collect certain kinds of personal as well as sensitive persona data: Tesla itself collects customer data that may include sensitive personal data like birthdates, banking information, social security numbers etc. There are several big tech companies that may be involved directly or indirectly involved  in government data collection and  processing work.

Moonlighting with such data may become extremely dangerous for the second type of the victims, especially children. There are 5 basic reasons for this:

  1. Children’s data including health data, school data, parent’s financial data etc, may be misused by different types of perpetrators. This may also aide in physical space kidnapping, abduction and assault on the child.
  2. Profiles of children may be sold to criminal gangs operating in deep and dark nets for online child sexual abuse related purposes. Often job seekers or individuals looking for moonlighting opportunities may fall in the trap of such gangs who may make them sell such sensitive personal data for a handsome amount. Here the criminal gangs may finely create a very much convincing agreement for the job seekers that in reality may not have much legal value as employer-employee contract. But the language of such agreements may be so finely constructed that it may actually make the employee fall in legal trouble if the entire operation is unearthed by the law enforcement agencies while the actual criminals may escape the clutches of the law.
  3. Child and adolescent victims may not be aware of the victimhood unless they are made aware of the data breach by their peers or by the acquaintances of their parents. Resultant, their online and offline security may be hugely breached and it may be beyond repairing especially for children who may come from socio-economically challenged backgrounds.
  4. Such kind of illegal moonlighting may enlarge the risks of ransom attacks for hospital, schools, public welfare data etc.
  5.  Companies or stakeholders who are engaged in the outsourced work of data collection, processing may also have to face legal action for not providing proper security to the confidential data. In such cases these cases may be held primarily liable as the burden of proof for innocence and strict diligence complied with may fall on the companies.

What is the way out then? EU General Data Protection Regulation has emphasised on the issue of privacy, security and consent for data collection, data processing, data archiving etc. Even though EUGDPR does not mention about moonlighting with confidential data as an offensive behaviour, it however focuses on right to privacy, data collection and processing rules etc.  We also have to look into several international conventions including the 2001 Budapest cybercrime conventions which throws light on content related online crimes, intellectual property rights related crimes and online child abuse related issues. All these prohibit data theft and unethical profit gain from misuse of data. Moonlighting with public, personal and sensitive confidential personal data falls off from the line of ethical moonlighting on the basis of skills of the job seeker/employee and thereby it becomes a punishable offence. But we must note that moonlighting with data involving children can be extremely dangerous because immediate harm to children may not be repaired by restorative and reparative justice quickly. But there is still a silver lining behind the vicious cloud of malicious data and activities. Companies and body corporates who primarily deal with public and personal data of general individuals can strengthen their data protection mechanism by applying stricter surveillance on the access on the said data, purpose of access to such data and mapping footprints of the usage of such data. They may also apply stricter policies against moonlighting especially against those employees who may directly deal with confidential data. Further, punishment for such kinds of moonlighting may not be restricted to termination and other penal actions by the primary companies alone. Such employee must also be made liable for breaching the data confidentiality of the children and he must be made to cooperate with the criminal justice machinery to track the data, pull down the data from vicious domains and also should be responsible for payment of compensation. Above all, courts must also consider banning them from using multiple profiles and they must be put under surveillance for their usage of information and communication technology.

cyber crime against women, Cyber Law

Gender and internet : Cyber law magazine for women news update May 31-June 08, 2022

Derbyshire Police community security officer who was in charge for safeguarding children from cyber crimes gets 27 months sentence from Derby Crown court for filming, possesing and unauthorized distribution of images of children in the changing rooms.
https://www.bbc.com/news/uk-england-derbyshire-61645416

Pakistani nationals get arrested for secretly filming women in Turkey and sharing objectionable images of them on social media.
https://tribune.com.pk/story/2359589/two-pakistanis-arrested-for-secretly-filming-women-in-turkey

Nepali women strengthen their protest against sexual exploitation through #metoo movement on the social media and share horrific details of such exploitation over social media platforms.
https://kathmandupost.com/national/2022/05/21/metoo-gathers-force-but-calls-for-sustained-movement

Male university student from Nigeria posing as American widow pleads guilty in the court for defrauding and impostering for fraudulent monetary gain from victims. Court awards conviction and strict punishment.
https://tribuneonlineng.com/court-sentences-fake-american-widow-to-3-years-imprisonment-in-kwara/

Editor's column

বৈদ্যুতিন যুগে ভাষা দিবসের কিছু চিন্তা ভাবনা

দেবারতি হালদার

বেশ অনেকগুলো বছর ভাষা অধিকার নিয়ে অনেক বিশ্লেষণ করার পর কিছু জ্ঞান উপলব্দি করেছি : ভাষা অধিকার একমাত্র মাতৃভাষায় চিন্তা প্রকাশের অধিকার মাত্র নয়. সেই ভাষা যেন এমন ভাবে ব্যবহার না করা হয় যা অন্য মানুষের চিন্তা ধারাকে আঘাত করে. এটা অধিকারের থেকেও দায়িত্ত্বকে বেশি করে বাড়িয়ে দেয়।  বিগত অনেক বছর ধরে এই রকম অনেক কমপ্লেন দেখে নিজেও শিখেছি কোন ভাষা কিভাবে প্রয়োগ করলে ভাষা অধিকার টি খুইয়ে ফেলতে হয়. তবে এই অধিকার খুইয়ে ফেলাটা বেশির ভাগ ক্ষেত্রে সরকারের বিরুদ্ধে প্রতিবাদের ক্ষেত্রেই আমরা বেশি দেখে থাকি। এই নিয়ে কত বাগ -বিতন্ডা। কোন প্রতিবাদী ভাষা আইনের চোখে বেআইনি নয় আর কোন প্রতিবাদী ভাষা সত্যি ই বেআইনি এ নিয়েও বিচারকদের কম মন্তব্য  নেই. প্রতিটি দেশের নিজস্ব আইনি বিশ্লেষণ আছে এই নিয়ে। সে থাকলেও আমরা অনেক সময়েই দেখি সেই আইনি বিশ্লেষণ অনেকটাই এক ধাঁচের হয়. মহিলাদের বাক স্বাধীনতা নিয়ে অনেক রিসার্চ হচ্ছে। আমার রিসার্চ একটু অন্য রকম. আমি ঠিক বাক স্বাধীনতা নয়, ভাষা স্বাধীনতা আর দায়িত্ব নিয়েই মেতে থাকতে ভালোবাসি। বেশ কিছু দিন আগে এই রকম দু-একটি কেস দেখছিলাম:  বিবাহিত পুরুষ অধ্যাপক তাঁর দায়িত্বাধীনে অনুসন্ধানরতা  কন্যাসমা ছাত্রীকে অত্যন্ত উত্তক্ত করেছিলেন এই ভাষা স্বাধীনতার সুযোগ নিয়ে। বৈদ্যুতিন মাধ্যমে ক্রমাগত একটি বা দুটি শব্দ, ছন্দ এবং ছত্র  ছাত্রীকে পাঠাতেন। সেই শব্দ, ছন্দ ও ছত্র  গুলি এতটাই ভয়াবহ হয়ে উঠলো যে ছাত্রীটিও আর সহ্য করতে পারলোনা। সংখ্যায় গুনলে এগুলি অতি   নগন্য। কিন্তু সেই সবই, ছন্দ , ছত্রের মধ্যে নিহিত অর্থ টি শালীন নয়. অধ্যাপক যখন দেখলেন ছাত্রী টি কোনো সাড়া দিচ্ছেনা , তিনি কিছু নির্বাক অত্যন্ত সংক্ষিপ্ত ভিডিও পাঠাতে শুরু করলেন।  এবারে সেই ছাত্রীটি শালীনতা হানির অভিযোগ আনতে বাধ্য হলো. অধ্যাপক পাল্টা জবাব দিলেন : যখন শব্দ বা ছত্র গুলি দেখেও সে চুপ করেছিল , মানে কোনো রকমের অস্বস্তি প্রকাশ করেনি, তখন কি করে ধরে নেওয়া যাবে সে এগুলি পছন্দ করেনি?  পাঠক /পাঠিকা  , এই ধরণের কেস খুব চেনা চেনা লাগছেনা? অধ্যাপক- ছাত্রীর জায়গায় সহকর্মী, বন্ধু, কাছের বা দূর দম্পর্কের আত্মীয় যে কাউকে বসাতে পারেন। ভাষা যে কত শক্তিশালী হতে পারে তা এই ধরণের তথাকথিত “নগন্য” কেস থেকেও বুঝতে পারবেন সবাই। ভাষার অপব্যবহার (বিশেষত মহিলাদের  বিরুদ্ধে ) টেনে আনতে পারে অনেক রকম আইনি বিপদ। ছোটদের কথা টা আজ আর বললাম না. আজকে একটি বিশেষ কেস দেখে মনে হলো এই বিষয়েও কিছু বক্তব্য প্রকাশ করা উচিত। কেরালা হাই কোর্ট রায় দিয়েছেন যখন কোনো স্ত্রী তাঁর স্বামীর বারংবার বারণ অমান্য করে তৃতীয় অচেনা পুরুষের সঙ্গে সময় অসময় না দেখে ক্রমাগত অবান্তর ফোনে কথা বলে যান তখন সেই ব্যবহার মানসিক নির্যাতনের পর্যায়ে পরে. না না! মনে করবেন না আমি আবার ফেমিনিজম নিয়ে বুলি কপচাবো। কিন্তু এই এক রায় সেই স্বামীদের ক্ষেত্রেও প্রযোজ্য হওয়া চাই যাঁরা তাঁদের স্ত্রীদের বারণ  অমান্য করে অন্য মহিলার সঙ্গে ক্রমাগত অবান্তর কথা বলে যান. একটু ভেবে দেখুন: এই কথা বলা যদি কর্ম ক্ষেত্রে জন্যে, কাজের জন্যে জরুরি হয় তাহলে আইনি বুমেরাং টি যিনি অভিযোগ করছেন তাঁর দিকে  ঘুরে যাবে। আর নাহলে জোর করে নিজেকে প্রেমিক প্রবর ভেবে নেওয়াটা অত্যন্ত বিপজ্জনক হয়ে যাবে। ভাষার আর  দোষ কি? ভাষাকে যে যেভাবে ব্যবহার বা অপব্যবহার করতে চাইছে দায়িত্বটি তাঁর।

এবার সময় এসেছে আমরা সবাই ভাষার অপব্যবহার নিয়ে একটু আলোচনা করি, ভাবি আর সেই বিবেচনা গুলি আমাদের পরবর্তী প্রজন্মকে জানাই। কারণ তারা আমাদের জানবার আগে অনেক কিছুই জেনে গেছে। 

২১/২/২০২২

monthly newsletter, Monthly Newsletter on Cyber crimes against women

Gender and internet : Cyber law magazine for women monthly news update :1st January -2nd February 2022
Photo courtesy : Internet

Court denies bail for the creator of the offensive Bulli Bai app in India .
https://www.business-standard.com/article/current-affairs/delhi-court-denies-bail-to-bulli-bai-app-s-alleged-creator-niraj-bishnoi-122013000513_1.html

Clubhouse App case shows women from particular communities continue to get targeted by defamatory comments. Court grants bail to one accused who pleaded that he was arrested on mistaken identity of app creator.
https://www.hindustantimes.com/cities/mumbai-news/law-student-arrested-in-clubhouse-case-gets-bail-101643730586005.html

Federal Decree Law No 34 of 2021 strengthens Federal Law 5 of 2012 to increase punishment for cyber crimes against children in Dubai especially in image based abuse cases.
https://gulfnews.com/uae/how-uaes-new-cybercrime-law-protects-children-from-online-pornography-1.85272676

Romance fraud surges up in Ireland due to pandemic and it is now in a never ending situation.
https://www.irishtimes.com/life-and-style/people/romance-scams-these-guys-might-have-40-or-50-women-on-the-go-1.4780703

Singapore penal law takes strict action against users who upload/create obscenity, nudity, sexually explicit contents. User of OnlyFans, an internet content subscription service gets charged by police for uploading allegedly obscene contents. Research shows several Onlyfans users aim for earning money by uploading nudes, sexted photos.
https://www.theguardian.com/world/2022/jan/07/fear-and-uploading-in-singapore-after-onlyfans-creator-charged-over-obscene-material?fbclid=IwAR3cWYzgEfYUozVJMna7onUng_r8uy0EOFhGbbabM6i2s6yQgo-lydkcCrE

Madras High court in India observes that CCTV cameras in spas infringe the right to privacy and bodily autonomy.
https://www.barandbench.com/news/litigation/cctv-camera-in-spas-infract-right-to-privacy-bodily-autonomy-madras-high-court?fbclid=IwAR3D5R4vOIaSDbtys1tPcojErQkGp6g_KwrHRD5ojSK5sw-pMqeRahbYt_4

US law makers look for penalizing cyber flashing with the new draft Bill on Online safety Bill with minimum two years of imprisonment.
https://www.newstatesman.com/spotlight/cyber/2022/01/cyber-flashing-online-safety-bill

Nottingham man faces jail sentence for using tools for spying, hacking, voyeurism, infringing privacy of women and children.
https://www.2-spyware.com/hacker-arrested-for-spying-and-downloading-indecent-children-images

US based Woman & husband charged for illegal laundering and stealing bitcoins worth more than $5bn
https://www.bbc.com/news/world-us-canada-60310783

Uncategorized

What is meant by “Website”? by Dr.Debarati Halder

We are in 2022 and the pandemic has not left us yet. News channels are tirelessly sharing updates on surging cases, further closure orders for schools, virtual hearing of the courts etc. Where are we sharing the information? From where are we getting some information? It is “websites”. There are millions of websites hosted and also managed by different stakeholders who share different information on WorldWideWeb. Strangely, we do not find the definition of the term website in majority of legal documents but when we see from the perspective of cybercrimes, we cannot avoid the role of websites as websites provide a platform for sharing contents which may be offensive.

The term website is connected with the concept of world wide web which was invented in 1989  by British scientist Tim Barnes Lee who worked on Interlinking of webpage and websites as a scientist with European organization for  nuclear research (CERN). Lee’s work led to connect creation of worldwide web to attributing ip address, domain names, .ccreation of hypertext markup language , uniform resource locator (URL) etc. The major reason behind creating the web was to facilitate the demands of information sharing between the government stakeholders including the military, scientists in the universities and other institutes all over the world for the purpose of information sharing, gathering and strengthening national security including cyber security infrastructure and military intelligentsia. However, very soon in the millennium tech companies started appearing to create, host, maintain etc., of websites which were interactive, passive or hybrid types of websites and which could be used for either e-commerce purposes, or for interaction, peer to peer networking and information sharing or for all. At this juncture it became necessary to explain the term “website”. Even though, we do not get to see any uniform definition of the term in specific legal documents, the term has been attempted to be defined by different stakeholders. It may be broadly explained as collection of hyperlinked pages over the web and related contents which may be identified by common domain name and which may get published on world wide web by some web server.

Now we are dependent completely on different kinds of websites and we manage our homes and offices through these websites. Presently we get to see many legal persons, i.e., companies which may create their own websites which may be used mainly for information sharing, e-commerce purposes and interacting with people. There are different technology companies like Meta (earlier known as Facebook), specifically created for sponsoring, creating, maintaining websites and webpages who also collect data of the users/subscribers/.  We have heard a lot about liability of the websites. But websites in general are inanimate. They become legal persons only when they are operated by people who may create websites, connect to web pages, get a domain name for the websites, publish contents and facilitate peer to peer networking and/or share information as a passive website. Liability of the websites therefore depend on their activities that are decided by the creators/administrators/distributors/users of the websites.

Intermediary and Website are not the same: Even though there are several laws and policy guidelines have been made worldwide to consider liabilities of the websites including The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, we have not yet seen the proper definition of website.  Even though S.2w of the Information Technology Act, 2000(amended in 2008) defines the term intermediary as “any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, web-housing service providers, search engines, online payment sites, online auction sites, online market places and cyber cafes”, the same should not be confused with the term ‘website’. An intermediary however can create, maintain a website.

Please note: Please  do not violate the copyright of this writeup. Please site it as Halder Debarati (2022) What is a website? Published in https://internetlegalstudies.com/2022/01/03/what-is-meant-by-website-by-dr-debarati-halder/ on 03-01-2022