WRIT PETITION BEFORE THE DELHI HIGH COURT SEEKING ISSUANCE OF DIRECTIONS TO CERT-IN

YARLAGADDA KIRAN CHANDRA VS. UNION OF INDIA & ANR. – WRIT PETITION BEFORE THE DELHI HIGH COURT SEEKING ISSUANCE OF DIRECTIONS TO CERT-IN ON DATA BREACHES

CASE SUMMARY

SFLC.in has provided legal assistance to Y. Kiran Chandra, in a Writ Petition which was filed before the Hon’ble Delhi High Court, seeking issuance of directions to CERT.in, in relation to the data breaches that have happened in the recent past.

The Petitioner in this case, Yarlagadda Kiran Chandra, is the General Secretary of FSMI (Free Software Movement of India). FSMI is a coalition of various regional and sectoral free software movements operating in different parts of India.

The Writ Petition has been filed seeking issuance of directions to Computer Emergency Response Team-India (CERT.In), for taking appropriate and necessary action in relation to the representations which were sent to it by the Petitioner.

Following is a list of representations which were sent by the Petitioner to Respondent No. 2 (CERT.In):

Sl. No.	Date	Details of the Representation
	11.11.2020	BigBasket Data Breach – The Petitioner wrote to CERT.In, requesting it to initiate an investigation into the incident and to update the citizens on the details of what transpired.
	30.03.2021	MobiKwik Data Breach – The Petitioner sent a representation to CERT.In, requesting the institution to conduct an investigation into the incident and to disseminate information about what transpired.
	21.04.2021	Dominoes Data Breach – The Petitioner sent a letter to CERT.in, placing a request to initiate an investigation into the incident and to update citizens on what exactly happened.
	22.05.2021	AirIndia Data Breach – The Petitioner sent a representation to CERT.in, highlighting the AirIndia data breach. The letter contained a request which was similar to the ones which were placed in the previous representations.
	17.06.2021	Prompted by the inaction of CERT.In, the Petitioner sent a legal notice to CERT.In, asking them to conduct an investigation into the aforementioned data breaches.

Some of the major grounds which the Writ Petition relies upon, are given below:

The data breaches at MobiKwik, BigBasket, AirIndia and Dominoes, have leaked sensitive personal information of millions of users and it has had a detrimental impact on the privacy of users who were affected.
Under Section 70B of the Information Technology Act, 2000, CERT-In is responsible for collecting and analyzing information on cyber incidents and for taking emergency measures for handling cyber security incidents, among other responsibilities.
Since there is no law in India which governs data protection, the aggrieved users do not have a legal resource under a statutory remedy, against such data breaches. In light of this fact, an investigation by CERT-In becomes necessary to safeguard the privacy of users.

The Writ Petition prays for the following reliefs:

Issuance of a Writ which directs CERT-In to comply with its Citizen’s Charter and to respond to the grievances raised by the Petitioner in the representations made before the organization.
Issuance of directions to CERT-In, to respond to the Petitioner’s representations, seeking an investigation into the data breaches.

UPDATES FROM HEARINGS

13.08.2021

The case was listed before Hon’ble Justice Rekha Palli. Prasanth Sugathan (Legal Director, SFLC.in) appeared on behalf of the Petitioner. He highlighted the indifference which was displayed by CERT.In and emphasized on the issue of the data breaches which caused serious detriment to the privacy of the users who were affected. He also mentioned the response which was given by CERT.IN wherein it stated that “CERT-IN is aware of its responsibilities and does not require your client’s directions to investigate data breaches as highlighted by you.”

On the point about the aforementioned response given by CERT.In, the Counsel appearing on behalf of the Respondents acknowledged that it was not proper. He further prayed for more time to obtain instructions in the matter, which was granted. The matter was listed on 23.09.2021.

23.09.2021

The matter was listed before the Court but it was not taken up. The next date of hearing in the matter is 20.12.2021.

20.12.2021

The matter was listed before the Court but it was not taken up. The next date of hearing in the matter is 28.01.2022.

28.01.2022

The matter was listed before the Court but it was not taken up. The next date of hearing in the matter is 25.05.2022.