Tag: cyber crime against children

Editor's column, Uncategorized August 24, 2023August 24, 2023

THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: can women expect any meaningful protection for Data privacy now? by Dr.Debarati Halder

On 11^th August, 2023 the much awaited The Digital Personal Data Protection Act, (DPDA) 2023 came into existence finally. Drafted majorly in the shadow of the EU general Dara Protection Regulations, DPDA offers certain rights to the data principals and certain duties to the data fiduciaries. But first, let me break a myth: DPDA is not an exclusive statute for providing privacy to our Data. The words ‘protection’ and ‘privacy’ may not be synonymous always.

If we look into the preamble of DPDA we would see that the preamble offers four reasons for enacting this law:

To provide for the processing of digital personal data in a legalised manner
To recognise the right of individuals to protect their personal data and
To recognise the need to process such personal data
To recognise the lawful purposes for processing the data

Every individual is a data principal according to S.2(J) of the DPDA. Irrespective of gender and age a data principal is a person to whom the concerned data is related. However, this provision clarifies the status of children and disabled by stating that for the former the parents or the lawful guardians will become the data principal and the for later, the lawful guardian will be the data principal. As we know from the Information Technology Act, 2000(amended in 2008), data means nothing but information that may represent many profiles of individuals: these may include financial status, health status, educational status, maturity status, marital status, and what not. Data itself may be extremely costly especially when it is processed and formally associated with specific organizations or institutions. According to S.2(x) “processing” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction

Interestingly, DPDA therefore advocates not only for the protection of the integrity of the data while it is being processed, it also bats for right to be forgotten.

For years I have been observing that women are targeted on the cyberspace for many illegal acts. I have witnessed the amendment of Indian Penal Code whereby a dedicated series of S.354 was introduced for penalizing several patterns of criminalities on cyber space. These included cyber stalking, voyeurism, disrobing women in the physical space and photographing the assault, sexual harassment and using sexually explicit language, gestures etc. Several other laws such as The sexual harassment at workplace (prevention, prohibition and redressal) Act, Indecent representation of women (prohibition) Act etc, were introduced, amended to provide further protection to women and support Information Technology Act, 2000(amended in 2008). None could actually completely prevent online crimes against women. On the contrary, perpetrators have found new ways to commit cyber-crimes against women. At present we get to see women are targeted more by fraudsters who are tricking them for financial loss.

DPDA creates a layer of protection against the data processing stakeholders. A processed data may contribute for creating identity of the data principal, educational degrees, health records, financial records etc. Most of these are vulnerable sensitive personal data. DPDA therefore has enhanced the responsibility of the data fiduciaries to protect the consensual data that is shared with them.

But now let us see how DPDA may not protect the interest of women:

Who manages the Artificial intelligence that will be applied for processing of the data under S.2(X) of the DPDA?

The Act indicates that the Data fiduciaries and the data processors may be responsible for controlling the AI for processing the data. But where is the data pool for the AI which will be working with the data ? we must not forget that most data fiduciaries may use foreign based AI for processing data. In that case is there any specific rule to control the foreign entity who may be controlling the AI? The answer may be found in S.3(b) of the DPDA which shares about the scope of the Act. It says as follows:

Subject to the provisions of this Act, it shall (b) ………..also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India ;

The answer may also be found in S.11 which speaks about rights of the data principal. But again, this needs a clear explanation.

It is not very clear if the AI system (that will be applied for data processing) falls within the meaning of “services to data principles within the territory of India”. If this falls within this category, then we need to see whether the contractual obligations between the data fiduciary and the AI creator company/entity can be made transparent to the data principal.

2.How would the non-digitized data be digitized without manipulating the original data?

Let us go back to S.3 of the DPDA again. While explaining the scope of the DPDA, S.3 (a) mentions that this Act shall apply to the processing of digital personal data within the territory of India where the personal data is collected…….in non-digital form and digitised subsequently. In such case and also in the case of processing digital data, DPDA does not mention what security procedure may be applied to restrict the leaking of sensitive personal data of data principals, especially women. Such question may be answered through the DPDA Rules that we are looking forward for. But honestly, there may be many occasions where data would be exposed unauthorisedly by the data protectors themselves. We need to see how far the statute would be implemented to heal the harm and compensate the data principal directly especially when the data principal is a senior citizen or a minor or educationally challenged or a disabled woman.

3.Now comes the question of grievance redressing mechanism system that must be set up by data fiduciary as has been mentioned in S.8(10) of the DPDA.

The Act remains silent about the infrastructure of the said mechanism. If we look into Information Technology Act, 2000(amended in 2008) we get to see the court system where the qualification of the forum members (for example, Administrator for civil offences etc) are clearly mentioned. But neither the Information Technology Act, 2000(amended in 2008) mention anything about the qualification of the grievance redressal officers. IT(intermediary guidelines and digital media ethics) Code, 2021 discusses in detail about engaging grievance redressal mechanism by the intermediaries in Rule 3(focusing on due diligence by intermediaries ) and Rule 10 (furnishing and processing of grievance), and Chapters 2, 3 and 4(which discuss about level 1, 2 and 3 of self regulating mechanism and oversight related mechanism. We have to see if DPDA applies parts of IT(intermediary guidelines and digital media ethics) Code, 2021 for mandating the data fiduciaries to set up grievance redressal mechanisms. In my opinion, data fiduciaries must consider engaging women officers to look after the grievances from women data principals. This may make the female data principals (especially those coming from orthodox societies and those who may be educationally and/or socio-economically challenged to access the male dominated grievance redressal mechanisms) feel comfortable to share their grievances. This may also encourage better reporting of criminal activities on cyber space.

DPDA under S.3© very clearly withdraws its scope from the data principals in the following situations:

(i) personal data processed by an individual for any personal or domestic purpose; and

(ii) personal data that is made or caused to be made publicly available

by—(A) the Data Principal to whom such personal data relates; or (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

The explanation to S.3 of the DPDA explicitly shows that if a data principal voluntarily shares her personal data publicly, DPDA provisions (regarding the responsibilities of data fiduciaries) will not be applicable here. In my capacity as cybercrime victim counsellor, I have seen the unfortunate rise of cybercrime cases and more unfortunate cases of victim blaming in cases such as those mentioned in the exception of S.3© of the DPDA: bloggers, digital creators and social media influencers intentionally share their personal data for profit gain. In case of infringement of their data integrity or data breach, they will now become ‘guardian-less victims’ who should brace themselves to face challenges in the system of criminal justice. But here lies the legal twist: such women may claim the protection of DPDA if their sensitive personal data integrity is violated due to the negligence of the data fiduciary i.e., the intermediary/website/web domain etc, who are providing them platforms to publish their blogs, write-ups, opinions, videos, business related information etc. As such, women bloggers, digital creators and social media influencers must go ahead with their data sharing and data processing contracts with the primary data fiduciary (the web domains, websites etc) with extreme care. Such women (and men too) must now consult lawyers to prepare an agreement for entering into contract with such intermediaries etc, who have always tried to dominate the contractual relationships with their custom made agreements which may enable them to escape the liabilities by using immunity veils.

4. Last, but not the least is the question of “lawful purposes” that makes the data fiduciaries liable to share the personal sensitive data with the government stakeholders.

The issue of surveillance is mention-able here. While there may be surveillance in the name of safety of the nation, peace and security of the community, friendly relationship with neighbouring countries and even for protecting the rights of the fellow citizens as has been stated under Article 19(2) of the Constitution, misuse of power by government officials including police officers to breach the integrity of personal data of women may be a serious blow on the right to protection and privacy of digital data.

DPDA, 2023 offers many positive aspects for data protection. But this is a beginning of a new understanding of data protection regime in India. We need to have lot more research on the practical applicability of the Law to provide safety to women. Let this ‘new beginning’ bring more positive attitude and awareness for a holistic safety on cyber space.

Please note: please do not violate the copy right of this writeup. If you want to use it for your article, assignment, project etc, please cite it has Halder Debarati (August, 2023) THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: can women expect any meaningful protection for data privacy now? Published in https://wordpress.com/post/internetlegalstudies.com/1433 on 24-08-2023

Uncategorized April 23, 2019

The TikTok ban : Why the ban may fail to prevent online victimization of women

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER

Image credit: Google

On 24^th April Madras High court would decide on the plea of Bytedance, which owns TikTok regarding the much talked about ban of the app. Tik Tok, , a nongaming app launched in 2019 has given a tough competition in regard to its popularity to all the social media giants because of the unique features which allows users to create and share short videos with special effects. Teenagers and adults in India loved the app because unlike other social media platforms including YouTube, TikTok has simple features to upload and publish videos. Unlike PubG however, this did not necessarily have gaming features.

In early April, 2019, the Madurai bench of Madras High court had in an interim order directed the government stakeholders in the State and Centre to ban the video app TikTok as the Public Interest Litigation in this regard emphasized that it encourages pornography and underage users are vulnerable to be exposed to sexually explicit contents, pornography etc, which may not be good for their mental and physical health.[1] Incidentally the Madurai Bench of the Madras High court was the first court in India to take suo motu cognizance in BlueWhale game case and asked the Central government and the social media website, web companies like Google etc to monitor what is being generated and catered to the users through their platform.[2]But in this case, the situation stands on a different platform: consequent to the interim order, Google and Apple removed TikTok app from their Play Stores. Resultant, Bytedance had incurred huge loss. But the later has now challenged this interim order on the ground that the interim order was passed on the basis of ex parte hearing. The company had stated that the app allows users to create videos and circulate them for fun and amusement and it does not pose any threat to security of individuals. Bytedance also stated that such bans are against right to speech and expression.[3]

We can see here two important points:

First : before the governments took prohibitory actions (like what happened for PubG ban in Gujarat, where police started arresting those who downloaded and played PubG even after the ban order was conveyed to the public)[4], Web company like Google and phone and software manufacturing company Apple had followed the mandates of S.79 (exemption of liability of intermediary in certain cases) and Rule 3 of Information technology (Intermediaries guidelines) Rule, 2011 : specially mentionable are Rules 3(3) and 3(4) which states as follows:

Rule 3(3) states that The intermediary shall not knowingly host or publish any information or shall not initiate the transmission, select the receiver of transmission, and select or modify the information contained in the transmission as specified in sub-rule (2): provided that the following actions by an intermediary shall not amount to hosing, publishing, editing or storing of any such information as specified in sub-rule: (2) — (a) temporary or transient or intermediate storage of information automatically within the computer resource as an intrinsic feature of such computer resource, involving no exercise of any human editorial control, for onward transmission or communication to another computer resource; (b) removal of access to any information, data or communication link by an intermediary after such information, data or communication link comes to the actual knowledge of a person authorised by the intermediary pursuant to any order or direction as per the provisions of the Act;

And Rule 3(4) of the above rule states The intermediary, on whose computer system the information is stored or hosted or published, upon obtaining knowledge by itself or been brought to actual knowledge by an affected person in writing or through email signed with electronic signature about any such information as mentioned in sub-rule (2) above, shall act within thirty six hours and where applicable, work with user or owner of such information to disable such information that is in contravention of sub-rule (2). Further the intermediary shall preserve such information and associated records for at least ninety days for investigation purposes.

These companies apparently did not want to invite any more troubles like the past when they were repeatedly called by the court to explain why they had not taken any action to block and ban contents and materials victimizing children which are regularly shared through their platforms.

Second: Bytedance, the parent company of TikTok has alleged that they were not heard by the court before pronouncing the ban order. Apparently, they may become the first web company to stress upon the point as why they should be banned when they have their flagging system and they do take care of the contents that are flagged. This case would make a history in India where the court has taken a decision influenced by the happenings of the past, and the concerned web company promises to break the glass ceiling because they know this is not the end. While many information as how to use (activate/download) TikTok without Google/Apple Play stores have started surfacing on internet,[5] my concern is not how the app may or may not be downloaded legally or illegally.

Exposing children to pornography, using women as items of sexual gratification, grooming, creating “dangerous contents” which may cause damage to public health, online victimization of women and children etc would not stop if one video creating and sharing app is banned. In that case, the courts must also consider picking up social media giants Facebook, Twitter, YouTube, Instagram etc, and search engines like Google for banning them because of their constant failure to monitor misogynist, sexist, child abusive contents. All social media companies including YouTube have data mined several images, contents and marked them as adult specific. Several videos are not available unless the users verify their age. But how will you search the needle in the hey stack? The courts could not yet make strict regulations for virtual age verification by the web companies. The web companies (hosted in US and other countries) are confused about the law relating to pornography because India does not have any focused law defining pornography still now. Further, the web companies also do not accept all contents (which are alleged to be porn as per Indian understanding) as offensive because the ever expanding free speech and expression jurisprudence of the US does not allow the web companies to take down the contents unless it is gravely threatening to the physical and virtual privacy and security of the person concerned or damages the reputation of the woman (in case the victim is a woman). Children can still be exposed to online dangers through Facebook, Instagram or YouTube. Women are continued to be victimized through all pockets of internet.

As such, there may be practically no solution for this and ban would encourage more law breaking. Google and Apple had already shown that they are willing to follow the local laws (or rather, not to fall in any legal tangles regarding web service providers liability). It is expected that India creates focused laws to address different emerging and existing types of online victimization and the same are implemented in proper way. Otherwise, the orders of banning may lead to ground ZERO.

Please note : Do not violate copyright of this blog. If you would like to use information provided in this blog for your own assignment/writeup/project/blog/article, please cite it as “Halder D. (2019), \”The TikTok ban : Why it may fail to prevent online victimization of women” 23^rd April, 2019 , published in http://debaraticyberspace.blogspot.com

[1] For more, see J.Sam Daniel (2019). Ban TikTok, Its encouraging pornography : Madras High court to Centre. Published in NDTV on April 4, 2019. URL https://www.ndtv.com/india-news/madras-high-court-directs-centre-to-prohibit-downloading-of-tik-tok-app-2017482Accessed on 12.04.2019

[2] Halder, D.(2018) The #Bluewhale challenge to the Indian judiciary: A

critical analysis of the response of the Indian higher judiciary to risky

online contents with special reference to Bluewhale Suicide game. In

Sourdin Tania & Zariski Archie (eds.), The responsive judges. USA:Springer ISBN no. 978-981-13-1022-5 pp 259-276.

[3] See Live law news network (2019). TikTok Ban : SC Says Ban Will Stand Lifted If Madras HC Fails To Decide On Interim Order By April 24. Available @https://www.livelaw.in/top-stories/tiktok-ban-sc-says-ban-will-stand-lifted-if-madras-hc-fails-to-decide-on-interim-order-by-april-24-144438 . Publshed in on 22^nd April, 2019. Accessed on 23^rd April, 2019

[4] See Ahaskar Abhijit (2019). Why playing PUBG Mobile can get you arrested in Gujarat. Published in https://www.livemint.com/news/india/why-playing-pubg-mobile-can-get-you-arrested-in-gujarat-1552849965539.htmlon 18th March, 2019. Accessed on 12.04.2019

[5] For example, see SC hearing on TikTok: Why it is difficult to ban the app in India. Published in https://www.businesstoday.in/technology/internet/tiktok-ban-after-madras-hc-decision-reality-banned-apps-tiktok-pubg/story/339286.html on April 22, 2019. Accessed on 22.04.2019

Uncategorized April 24, 2014

Older generation and the risks in the digital era

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER

Summer vacation has started and all are heading towards numerous destinations, majority heading towards ancestral homes. Since the easy availability of tablets, ipads and smart phones ( well, not to speak about the laptops which are now considered as the older generation in digital gadgets), many children insist carrying them to their grandparents places to fight ‘boredom’ , to take selfies in so called ‘exotic’ locations ( well, I got to see children calling a village temple tank as an ‘exotic location’ too) and to instantly put the family pictures in the instagram, Facebook etc by various ways including whatsapp. Some parents and grandparents feel extremely proud to exhibit their children’s skill in digital technology; some feel children are getting addicted to the digital gadgets and thereby they should be given company in using the gadgets. While parents may make a horrible company in some cases due to their excessive interest in the digital day to day affair of the children, grand parents can make excellent companions, especially when the child understands that the grandparent is completely unaware of the digital tricks and can never play a detective’s role to pierce the privacy of the child. So what happens when an old man joins his young grandchild in exploring and contributing to the new digital communication systems? Here are some examples:

Ø Taking random pictures of the household things, members of the family ( even if they are not ready to face the camera) and storing them digitally;

Ø Putting them in the social media without knowing what could be the consequence.

Ø Exploring parent’s social media profiles with the grandparent by his/her side (especially when the child knows the password of the parent’s social media profiles) and thereby giving repeated shocks to the old heads.

Ø In course of teaching the grandparent some tricks, the child may start sending friends’ request to strangers, make profiles of the grand parent’s friends without permission, start ‘liking’ numerous posts and share stuffs which may be dangerous both for the adult as well as the children.

Ø Downloading private pictures from other’s profiles and storing them in the gadget (well, it is a ‘fun’ to teach the grandparent how to download pictures).

And why we, net immigrants should be bothered by these habits of net natives ( the children) or the net aliens ( the older generation)? Well, i have more than one reason to be worried. I got to see the tablet of one such grand parent who had stored my own photo without my knowledge. I am not ‘friend’ to him. Neither he has any profile in any social media. But one of his children is in my husband’s Facebook friend’s list. The tablet consists many more interesting pictures: a lady with face pack sitting awkwardly in her night gown, some naked children ready to jump in the bathtub and so on….. none of these pictures were taken from proper angles and they looked amateur. When I confronted the owner of the tablet regarding this, he was more than shocked. He instantly asked his children( both under 12 years of age) who proudly told it was none other than their grandfather who became a ‘good student’ of their digital technology class, who had taken these pictures and downloaded many other. After the initial shock, came the time to laugh away the matter. But it was not the matter to laugh away. It needs to be understood that even though a digital gadget may belong to a particular person, it can be misused by numerous persons who may get a chance to handle it according to their own wishes. If it is misused, it can give birth to various issues including identity theft, sending of anonymous offensive communication and not to mention, unauthorisedly storing other’s private data including images and voyeurism (which this grandfather-grandchild duo unknowingly did ). The laws regarding the safe digital communication, safer internet and safety of women and children are developing in India and one thing which every one must note is, any offence done by any digital gadget can first and fore mostly make the owner the gadget primarily liable if he has not established his innocence in such cases by lodging complaints of missing of the gadget or the theft of the gadget or the unauthorised usage of his digital data (including social media profiles). Laws relating to identity theft, sending of anonymous offensive, unauthorisedly storing other’s private data including images and voyeurism etc, are strict when it comes to the gender of the victim as well as the offender. The new Criminal Law amendment Act, 2013 has made several of such offences punishable especially when the victim is a woman. Not to mention about the Protection of the children from sexual offences Act, 2012 (POCSO), which has laid down stricter laws to prevent any sort of exploitation of children, whether physically or digitally. While the 2013 Act targets male offenders largely for several digital crimes, information technology act as well as the POCSO Act holistically apply to ‘all’. The child offenders are neither spared from punishments, including correctional punishments or fines, irrespective of the fact whether they knowingly or unknowingly do the mistake. Nonetheless, the owner of the gadget becomes vicariously liable in such cases and his/her journey through the whole legal procedure may neither be a cake walk.

Hence be careful. Teach the older generation how to use the gadget as well as the digital data just in the way children are to be taught. Do not make the innocents fall victims of new technologies.

Happy holidays

Please Note: Do not violate copyright of this blog. If you would like to use informations provided in this blog for your own assignment/writeup/project/blog/article, please cite it as “Halder D. (2014), “Older generation and the risks in the digital era

”, 24^th April, 2014 Published in http://debaraticyberspace.blogspot.com/

Uncategorized March 5, 2014

Equality for women still a dream?

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER

I was reminded of a beautiful reality of being a woman by the official Tweet of the #UNWomenWatch which showcased this year’s theme for internetnational women’s day as “equality for women means progress for all” ( see http://www.un.org/womenwatch/feature/iwd/). But the reality of being woman is not a beautiful experience for all women always. I would tell why I think so:

Very recently I was invited to be a panellist in a workshop on cyber security by Kerala child rights commission. I had a wonderful experience as a contributor. But I learnt more than what I contributed as a resource person and a panellist. Kerala like many other states in India is a beautiful place with lots of natural resources, beautiful water bodies and excellent schools. As an outsider to Kerala culture the first thing that striked me was the dressing of women and the freshness in their look. I noticed that bathing spots like temple tanks, river banks and falls are flocked by local women and children during specific times in the day and men avoid these ‘women only’ places . I was under the impression that social culture in here was very different from northern Indian states, and I started feeling happy about it especially when I get to hear that rape culture is most anticipated in such circumstances in Delhi and nearby places. But when I learnt the reality from other resource persons , I felt more than worried; many children are ‘employed’ by adults to take pictures of bathing women in such public bathing places . Nevertheless, Kerala could be the biggest contributor for Indian adult websites and this may be because of these innocent ‘employees’ or should I say ‘victims’ of the larger porno industry rackets. Kerala is just a model; I did notice many other places in other states where people throng to public bathing places, beaches and even public places like temples armed with smart phones to do their own bits of voyeurism with women’s body. Men may ask the children in their groups to take snaps of bathing women and later these children would be rewarded by delicious snacks to even one more opportunity to take such ‘reckless’ photographs of women. Have you ever thought of the scenes in rural of semi urban or even urban places when women take such snap shots of bathing men or general public where men are heavy in number than women? Such scenes are rare unless the women are not researchers, or journalists or even ‘citizen journalists’ who amaturely contribute news and clippings to the news media. Women cannot be ‘gazers’ in public places to men, leave the bathing men. If a woman dares to ape her male counterpart in this aspect just to show her boldness and try to make men realise the same feeling of embarrassment as women feel by her body language, she may either be subjected to counter sexual harassment by men present there or may be ridiculed by society for being ‘besharam’ ,a girl without any sense of morality. The society teaches inequality in this aspect from the very beginning of childhood. Resultant, girls grow up to be women constantly being victims of visual rape or sexual harassment right from their childhood days not only by men, but also by young children.

What would be the treatment of these girls and women when they go online with their bathing beauty sex bomb avatar? In most cases these victims of voyeurism may never get to know their victimhood status especially when they belong to the below the poverty line range where they can’t afford to have independent internet connection either through their mobile phones or through the cyber cafes or through home broadband connections. However, they may become ‘items’ for discussion in the local business junctions, pubs and clubs if their images are made available for public viewing. No one will actually come over to compensate them or fight for them because they may never be made aware of these as well. However, if the law agencies do come to know about the issue, hopefully actions can be taken against the people involved in the racket right from the kingpin to the children who may have been ‘employed’ by such people to do the ground work. Most likely prescribed penalty could be either a jail term for three years or a fine or both as has been described in S.66E of the Information Technology Act, 2008, or a jail term for three years or five years minimum with a fine, as prescribed by Ss. 67 or 67A of the Information Technology Act or S.354C of the Indian Penal code depending upon the nature of the offence as understood from the images and its effects. The issue of involvement of children may further attract questions of right to protection of children from such crimes as well as duty of the State to prevent the children from getting involved in such acts through various legal provisions.

Who remains unprotected without getting any notion of ‘equality’? Nonetheless these innocent poor women who may be again subjected to such acts by a fresh group of youngsters mentored by some other porn industry rackets. I feel time has come to teach not only the children, but also their parents about the possible misuse of gadgets by their children and to stop providing ‘soft corner’ for children’s unreasonable demands for smart phones even if it is a gift for getting excellent marks in the exams.