The first link act here leads to a PDF where it seems the honourable authorities have prescribed letter consent for processing sensitive personal information like passwords . Now every account should have a password which the company generates or takes from user . Does this mean they need written consent from the people ?

  • 1
    In future please link directly to the document or page you wish to refernce. The order of search results is not the same for all ,users, and changes even for a give user over time. It is not a good form of citation to link to a search result. – David Siegel Feb 10 at 19:28
  • Actually site has a hyperlinking policy . You will see the date 11th April 2011 on it . – scientist Feb 10 at 19:33
  • Clarification: Is the document you want to refer to named GSR3_10511.pdf? – Hagen von Eitzen Feb 10 at 21:21
  • I have no idea what you mean by the site having a hyperlinking policy, but the first link for me is not dated 11th April 2011, but the second and third links both are. This is extremely unclear, and this is why you need to link directly. – Ryan M Feb 12 at 9:47

The document Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.(G.S.R. 313(E)) dated: 11th April, 2011 and commencing:

G.S.R. 313(E).—In exercise of the powers conferred by clause (ob) of sub-section (2) of section 87 read with section 43A of the Information Technology Act, 2000 (21 of 2000), the Central Government hereby makes the following rules ...

and occupying pages 7-11 of the linked PDF seems to be a rule modifying the Indian IT Act so as to impose information handling practices. It seems to be not unlike the GDPR or CCPA, althoguh different in detail. It requires consent for the collection and retention of personal information, requires that collection not be excessive, and requires that individuals be able to see what information a company holds about that person, and in many cases have it deleted.

Specifically, Rule 5 (1) provides that:

Body corporate or any person on its behalf shall obtain consent in writing through letter or Fax or email from the provider of the sensitive personal data or information regarding purpose of usage before collection of such information.

(A "body corporate" appears to be simply a company or business firm.)

"sensitive personal data" is defined in rule 3 to be any of a list of nine kinds of information, of which the first is a password.

Rule 5 (7) provides that:

Body corporate or any person on its behalf shall, prior to the collection of information including sensitive personal data or information, provide an option to the provider of the information to not to provide the data or information sought to be collected. The provider of information shall, at any time while availing the services or otherwise, also have an option to withdraw its consent given earlier to the body corporate. Such withdrawal of the consent shall be sent in writing to the body corporate.

It is not clear to me whether "letter or Fax or email from the provider" [from the information provider (aka the Data Subject)] could include a message automatically sent when a person using a web site clicks a button clearly indicating consent to collection of such information. It certainly does not require a letter mailed in the post. The provisions of sub-rule (7) clearly contemplate collection of information online as long as there is active consent and an option to withdraw consent.

I find it hard to imagine that a separate, manual, communication mu8st be sent in advance under rule 5 (1), and that does not seem to be how this rule has been enforced over the past 10 years. I think that "through letter or Fax or email" is being interpreted to include positive written consent through a web site. But I cannot find a cite of a law or rule explicitly saying as much, and I do not know Indian law very well, so I could be mistaken.

Additional info:

The Press note "Clarification on Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 under section 43A of the Information Technology Act, 2000" dated 24-August-2011 17:03 IST says:

... in Rule 5(1) consent includes consent given by any mode of electronic communication.

This seems to dispose of any suggestion that a separate letter or email is required, and permits the user to indicate consent though a button, checkbox, or other online interaction, as long as it is clear what consent this will be giving.

  • Its title should read Ministry of Communications and Information Technology . – scientist Feb 10 at 19:36
  • Date 11 April 2011 . – scientist Feb 10 at 19:37
  • It seems to list password as sensitive . – scientist Feb 10 at 19:39
  • I think you are reading clarification of the document I reffer to. – scientist Feb 10 at 19:40
  • @scientist What do you mean "list"? At quick glance, I find nothing list-like in said document -- unde rthe provisin we speak of the correct document, which is still hard to tell. – Hagen von Eitzen Feb 10 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.