Lacunae in Indian privacy laws hit business

Recent events of data theft at high profile BPO's (HSBC and Mphasis BFL come to mind) have resulted in two biggies - Apple and Powergen - pulling their back office operations out of India. I remember NDTV did a scoop where they found mobile phone call information could be found out for less than Rs. 5000 (USD 100) for any given person.

I have commented elsewhere about the lacunae in India's Information Technology Act 2000, the only piece of legislation that directly deals with cybercrime. Unfortunately, it does not contain much on methods for investigation and forensics and guarantees little by way of data privacy.

Here's what I think is lacking in the Act:

1. Does not mandate the forensics procedure to be adopted for the evidence to be admissible in court.
2. Is too Draconian in some respects, especially sections related to Offences by companies, Confiscation, Hacking, and Publishing of Obscene information
3. Setting up of the Cyber Appellate Tribunal or posting of the adjudicating officer as mandated in section 46 and 57
4. Too much of a focus on digital signatures, digital certificates and certifying authorities - very few sections deal with actual cyber crimes
5. Data privacy is not addressed in either the Indian IT Act or anywhere else.
6. Does not address practical issues of actually implementing the measures it lists out
7. Although, cyber security cells have been set up in the major cities around the country, they’re often under-staffed and under-equipped

Although, there is an initiative by the Ministry of Information Technology to accept revisions and suggestions for the Act, nothing has come of it. NASSCOM for all it's statements about cyber-security as well as the launch of the Indo-US Cyber Security Forum have achieved naught.

Further reading:

1. What's wrong with our cyber laws
2. IT Act languishes thanks to government negligence
3. Loopholes in IT Act nag Indian corporates