Failing to protect privacy online
Failing to Protect Privacy Online in India
Indiadailyupdate.com – Failing to protect privacy online has consequences that reach far beyond a single technology company or data breach. A New Mexico court has imposed a $25 billion penalty on Meta for misleading Facebook users about the privacy of their information. Meta plans to challenge the ruling, but the case underlines a wider concern: digital platforms often collect vast amounts of personal data while giving users limited meaningful control over it.
“Facebook promised users that they controlled their data. This was false.”
The ruling recalls the Cambridge Analytica scandal, in which information linked to about 87 million Facebook accounts was collected and used for voter targeting during the 2016 United States election. It revealed how data about online activity, purchases, locations and interactions can be transformed into profiles that influence commercial and political decisions.
Since then, the digital ecosystem has become even more dependent on personal information. Smartphones, shopping apps, financial services and connected devices continuously generate data. Consent notices may appear to offer choice, but most people have little practical ability to understand complex terms, refuse unnecessary collection or regain control once information has been shared.
India’s Data-Security Concerns
India faces an equally serious challenge in safeguarding personal information. State Bank of India disclosed that customer records were among roughly 375,000 records reportedly found on the dark web. The bank filed its disclosure five days after the alert, without clearly stating whether affected customers had been informed or how the information may have left its systems.
Such uncertainty leaves people exposed to fraud, impersonation and targeted scams. Mobile numbers, addresses and dates of birth can be combined with other leaked details to make fraudulent messages appear convincing. Once information reaches criminal marketplaces, individuals may have no way of knowing how widely it has spread or who may attempt to misuse it.
The eMudhra episode raised another concern. The Bengaluru-based company, relied upon by major global browsers to authenticate websites, was found to have created security keys so weak that one key was simply the number 4. If attackers had compromised such keys, they could potentially have impersonated websites and intercepted user traffic.
This is not merely a technical failure. People rely on browser security signals while banking, shopping, communicating and using public services. The ransomware attack on AIIMS in 2021 likewise showed that weak cyber defences can put sensitive patient information at risk while disrupting essential healthcare services.
Clear Disclosure Must Be Mandatory
When a breach occurs, affected people need prompt and specific information. They should be told what happened, which categories of data may be involved, what remedial steps are being taken and how they can protect themselves. Without timely disclosure, customers cannot watch for suspicious activity, change passwords or take extra care with unexpected calls and messages.
At present, citizens have limited legal protection in this regard. The Digital Personal Data Protection Act is intended to create a notification obligation, but the relevant requirement will begin only on May 13, 2027. Until then, organisations may reveal too little, act too late or fail to inform those affected altogether.
The response to the eMudhra matter also deserves scrutiny. The IT ministry described the impact as “very limited” and warned against “fear mongering” while ordering an investigation. Public reassurance is valuable only when it is supported by transparent facts. The inquiry should establish what failed, how many systems were exposed and whether accountability will follow.
Privacy Needs Enforcement, Not Just Recognition
India’s Supreme Court recognised privacy as a fundamental right in 2017. Yet that recognition has not created a dependable system that ensures people are informed when their data is compromised. Failing to protect privacy online weakens public trust in banks, government services, healthcare systems and digital platforms.
Strong enforcement, transparent breach reporting and meaningful penalties are essential. Organisations that collect personal information must be responsible for protecting it, while regulators must ensure that affected individuals are not left to discover risks long after the damage is done.
FAQ: Protecting Your Personal Data in India
What should I do if I suspect my data has been leaked?
Change important passwords, enable two-factor authentication, monitor bank and credit-card activity, and remain cautious about calls, emails or messages seeking personal details. Never share OTPs, PINs or banking credentials with anyone.
How can I reduce the risk of online fraud?
Use unique passwords for important accounts, install updates promptly, review app permissions and avoid clicking links from unknown senders. Verify requests through an organisation’s official website or customer-care channel before responding.
Why does breach disclosure matter?
Timely disclosure gives people a chance to take protective action before leaked information is used for fraud or identity theft. It also encourages institutions to treat data security as a continuing responsibility rather than a public-relations issue.