Behind every data storage mechanism , there is a human intelligence that works to decide how the data store house will be managed, protected and which data may be exposed and how. For Long I have been arguing that behind every breach of data security, there is a human brain. He/she can be a data collector, data fiduciary, data manager, data protection engineers or a designated data protection officer of any website and tech company. My argument becomes stronger with every day update on data breaching methods: this time it is a two member group of  university officials in western India who have been accused for leaking cloud storage password to another university located in central India. while the accused persons have the right to defense for such allegation, such information may suggest that no organization including the banks, hospitals, universities and government departments dealing with civilian’s data are safe.   

Let us first understand what is an intermediary:

Often, we tend to confuse the term intermediary with website, internet service provider and internet. All  three of them denote different meanings but the concept is over lapping with each other. Indian information technology Act 2000 (amended in 2008) defines  intermediary  especially in respect to electronic records and data in S.2(w) as

any person who on behalf of another person (i) receives, stores or transmits that record or

(ii)provides any service with respect to that record and

(iii) includes telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes.

Interestingly the word “any person” has got different meanings in this section: when it says “any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record”, it may mean a natural person, i.e. human beings (especially adult human beings, who may be capable to take rational decisions, enter into contracts  etc.) again, when it says “telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes” etc, it may mean a juristic person who has legal personality and who may be represented by its human representatives like the CEOs or the  nodal officers etc.

In its preamble (para 4)in  Recommendation CM/Rec(2018)2 of the Committee of Ministers to member States on the roles and responsibilities of internet intermediaries, the Committee of Ministers, Council of Europe has shared some functions of such intermediaries which are as follows: …………………. “internet intermediaries”, facilitate interactions on the internet between natural and legal persons by offering and performing a variety of functions and services.

Some connect users to the internet, enable the processing of information and data, or host web-based services, including for user-generated content.

 Others aggregate information and enable searches; they give access to, host and index content and services designed and/or operated by third parties.

Some facilitate the sale of goods and services, including audio-visual services, and enable other commercial transactions, including payments.

Individual responsibility of the natural person intermediary for failure to protect the confidentiality of the data

As the above discussion may lead us to understand the meaning of intermediary as both natural person as well as juristic person (who may be represented by a natural person), let me now explain how intermediary (natural person) including the data manager and /or the data protection officer as appointed by the data fiduciary may be responsible for leaking of the data saved in data storehouse under the body corporate . He/she may

1. Intentionally violate the obligation of confidentiality and share the security password for the data to third party without consent of the body corporate or the data fiduciary who may have collected the personal data for specific purpose.
2. Negligently passes over the security information to third party to allow the confidentiality of the data to be breached.

In both these cases the primary responsibility of data breach may fall upon the Body corporate who may need to pay compensation under S.43A of the information Technology Act, 2000(amended in 2008) to the data principals whose data has been breached while the same was under his custody. But then such individual (natural persons) may also be held responsible under numbers of legal provisions. These may necessarily include S.72A of the Information Technology Act which prescribes punishment for disclosure of information in breach of lawful contract. This bag of penal provisions against such intermediary (including the data manager or the data protection officer) may also include S.43 read with S.66 of the Information Technology Act which prescribes punishment computer related offences.

What we understand from the above especially about universities as intermediaries as well as body corporates?

Universities are also intermediaries and body corporates who collect personal data including sensitive personal data of the teaching and non-teaching staff and of the students.

The personal data of the above-mentioned stakeholders are connected with their family members. Hence it may be easy for the possible perpetrators to fish out sensitive personal data of university employees and students as well as their family members.

Universities as body corporates also hold information about their own examinations, public examinations and data related to foreign university collaborations (which may also include domestic -foreign trade collaborations).

As a matter of fact, then if data is leaked from the university data base or the university is attacked by ransomware attacks, all stakeholders connected with the universities may be affected and women will be particularly vulnerable targets. It is necessary therefore that all universities must set up proper cyber security infrastructure and employ trained data protection officers and data managers who may be providing safe services for all as university intermediaries.

Please don’t violate the copyright of this writeup. Please cite as Halder Debarati (2023)Intermediary liability: Are universities countable? Published on 31-10-2023 @https://wordpress.com/post/internetlegalstudies.com/1463