With the constant rise in digitalization, the computer stores information in binary data form and deeply on the data form which is a way that the device tracks a lot of information in an effective way. Subsequently, with the invention of personal computers and microprocessors the idea of using computers for exclusive use of an individual rose. The process was not only affordable but also made management and storage of information easier. But this evolution has also led to increased interactions and sharing of private data using computer, ultimately leading to illegal activities known as cybercrimes. Identity theft is one such crime. Identity theft refers to a crime when a person fraudulently obtains information of another person and later uses it for economic or personal gain.  The theft happens in a two-step process. Firstly, the personal information gets stolen. Later, the information gets used to impersonate the victim and commit the fraud.  Identity theft has already made its place among the fastest growing sector in not only the developed countries but also the developing countries. The primary reason for US being affected stands firm to the fact that all the personal information is linked to a single social security number. The number allows an individual to avail all government schemes and records related to the individual whose social security number it is. This allows very little safeguarding to the individuals whose number gets leaked. Landing on Indian records, there has been an 11% increase in identity theft and ransom ware, followed by phishing attacks increase to 9%.  India also been ranked amongst top 5 countries to be affected by cybercrimes in 2013.  Problematically, there is a very low conviction rate despite the high levels of cybercrime.

There are provisions in Indian Penal Code, 1860 which governed the crimes of forgery and fraud but it was later amended by the Information technology Act, 2008 as it also included the electronic record, ultimately widening the ambit of such computer data related crimes. Provisions such as section 464 criminalizing forgery, Section 465 criminalizing making of false documents, section 468 criminalizing forgery for purpose of cheating, Section 469 criminalizing forgery for purpose of harming reputation, Section 469 criminalizing the use of a genuine document as forged and section 474 of having possession of a document with intention of using the genuine document as forged were coupled with IT Act. Section 420 could be used in circumstances when the Act requires including unique identification information of any individual. 

In the present scenario, the IT Act, 2000 is the main legislation governing cybercrimes in India. The objective of the Act, however, was to mainly recognize e-commerce and that’s why it did not define cybercrime. Before the 2008 amendment, the Act could impose civil liability for unauthorized access to computer or network which would have facilitated an illegal act under section 43 by way of compensation under the pecuniary limit of one crore. Also, Section 66 criminalized hacking which would result to destruction, deletion or alteration of any resource in the computer. 

The Amendment of 2008 introduced the term ‘Identity Theft’.  Section 66C of the Act governs the crime and provides punishment for the same.

The ‘sensitive personal data’ however required stronger laws to be formulated which could ensure the protection of private data. The ambit of the term has been defined by IT rules, 2011. It involves the data related to one’s password, financial information, sexual orientation, biometric information, medical records. Such a clause would be exceptional to the State or central government for monitoring, surveillance or interception. The same was provided under Section 69 of the Act. 

Data Protection Bill 2019 and Cyber-Crime are often used together these days. Not scholarly but indeed since the bill does come with serious implications for all technological and digital service provider companies and has already generated controversies. Despite India’s attempts to create a complex legal framework with the objective of protecting data but it comes with shortcomings which are inevitable. On a bare reading, there are three serious flaws with the current draft.

Firstly, the section of data localization requires data fiduciaries to store atleast one copy of personal data on a data centre or server which is located in India. However, the centre holds the upper hand to exempt categories falling under the personal data. Also the centre can declare certain datas as critical and require them to be stored in India. In the present, this would allow all the social sites also known as foreign internet services to physically able a user data in the country. This would allow law enforcement easy access to this data, which brings to the second issue.

The law enforcement access to data section would allow processing of data considered personal by an individual in the hands of centre and in the interest of security and public welfare, the state can utilize the information which would not be illegal as it would be according to procedure established by law. Now, this access stands as a threat to the right to privacy that exists in India. If combined with the section of data localization, the government shall have access to information about users in social media.

However, this legal framework for surveillance by the government is governed by the judgment in PUCL v Union of India in which the Apex Court stated rules to concentrate the power to order and review surveillance in the executive body which doesnot require court orders or supposedly, any third party review. The measure intended to act as a stopgap measure by the SC and if any subject falls short of international human rights then there will be very little to safeguard the citizens.

The last section is about the regulatory structure created. The Centre has control significantly over the controls. The bill further gives powers to data protection authority to appoint its members by merely the recommendation of an outside committee. For a person to be an effective regulator of an institution, one must have sufficient time to learn and the bill providing only five years of term seems ineffective.

The term white collar crime has grown to define the fraudulent crimes of business and government professionals over time. The characterization of such a crime is violation of trust, concealment of information, deceit through information and categorically not dependent on any kind of force or violence imposed. White collar crimes end up having huge impacts on the society. There have been various scams in the country like the Havala scam, 2g scam, fodder scam, banking scam and many more. This does not necessarily indicate towards the entire involvement to be criminal but it merely requires one financial fraud in greed of money or power to commit such an act. Cybercrime stands as one of the biggest causes to these types of crime in the country. It is the information that single handedly threatens a person’s security and financial status.

Since the actions of Government have direct impact on the society, it is easily identifiable that when a white-collar group is discussed, the Government is a part of it.

Now, bringing the recent proposed bill and the white-collar crime concept together, the question stands whether the bill in the name of data protection is actually for protection or is merely a tool of mass surveillance by the Government.

The SC in its judgment of right to privacy in K.S Puttuswamy case declared the right as a part of Article 21 guaranteed under the Constitution. The judgment clearly stated that the right is a natural right and is a measure to protect an individual from the scrutiny of the State. Thus, any action by the State would undoubtedly result in violation of such a right and would be subject to judicial review. But the right clarified to have reasonable restrictions which empower the State to impose restrictions in accordance with a law in the interest of State’s need and also the means should be in proportion to the objectives of law.

Even if not called the worst but if the bill is passed, it would bring in major implications especially in areas of national security, foreign investment as well as international trade.