





















Study with the several resources on Docsity
Earn points by helping other students or get them with a premium plan
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Community
Ask the community for help and clear up your study doubts
Discover the best universities in your country according to Docsity users
Free resources
Download our free guides on studying techniques, anxiety management strategies, and thesis advice from Docsity tutors
An overview of jurisdictional issues in cyber law, focusing on liability under technology laws, including tort law and biotechnology regulations. It discusses the IT Act, data protection laws, and international protocols like the Cartagena Protocol on Biosafety. The document also covers individual rights regarding personal data and the role of the Data Protection Authority of India. It is a useful resource for understanding the legal framework surrounding data protection and privacy. The document touches upon intellectual property rights, particularly celebrity rights and patent laws, highlighting differences between Indian laws and WTO provisions. It explores strict liability in tort law, especially in biotechnology and product liability, examining potential exemptions and challenges.
Typology: Summaries
1 / 29
This page cannot be seen from the preview
Don't miss anything!
The evolution of computers began with the Abacus for calculations, followed by Pascaline for speedometers, and Leibniz Stepped Reckoner, which used binary numbers for computing. Initially, traditional circuit switching was used for internet connection, which was then replaced by packet switching technology. ARPANET (Advance Research Projects Agency Network) was established in 1969 between Stanford and UCLA. In 1971, AlohaNET was created in Hawaii, and Ray Tomlinson invented email. The Transmission Control Protocol (Cerf’s Protocol) was developed. Tim Berner Lee created the World Wide Web (WWW) in 1989, utilizing dial-up and telephone networks.
The internet is a global network that allows computers to send small packages of digital data at high speed. Key terms include TCP (Transmission Control Protocol), IP (Internet Protocol), HTML (Hyper Text Markup Language), HTTP (Hyper Text Transfer Protocol), URL (Uniform Resource Locator), and WWW (World Wide Web).
In Reni v. American Civil Liberties Union , the internet was defined as an 'International connection of networks'. The issue was whether the Communication Decency Act violated freedom of speech by banning obscene content on the internet.
Technology is an instrument of social and economic change, and social and economic change drives technology. Kranzberg’s Law studies the relationship between socioeconomical changes and technology, stating that technology is human friendly.
John Stuart Mill, in On Liberty , argued that freedom of speech enables people to understand truths about the world, and censorship prevents this understanding. He drew an analogy to the economic marketplace, where competition leads to superior products. He condemned censorship and encouraged the free flow of ideas. Free speech is an aspect of self- fulfillment and development, integral to an individual’s right to self- development.
The Universal Declaration of Human Rights (UDHR) states that everyone has the right to freedom of opinion and expression. Article 19(1)(a) of the Indian Constitution guarantees freedom of speech and expression with reasonable restrictions as outlined in Article 19(2), including sovereignty and integrity of India.
The First Amendment to the US Constitution prevents Congress from making laws that abridge freedom of speech or the press. Certain categories of speech, such as obscenity and libel, are not constitutionally protected. US law allows speech to be abridged if it is obscene, libelous, lewd, and profane, while Indian law subjects it to the eight elements mentioned under Art. 19(2).
Commercial speech is the advertising of a product or service. It is regulated to protect consumers from misleading advertisements.
In TATA PRESS V. MTNL (1995) , the Supreme Court declared that commercial speech is part of the fundamental right to freedom of speech and expression guaranteed by Article 19(1)(a).
In AOL v. Cyber Promotions (1996) , AOL successfully sued spammers due to the cost burden imposed. Some countries have laws prohibiting Unsolicited Commercial Email (UCE) and Unsolicited Bulk Email. In the absence of statutory protection, traditional tort law principles of trespass to goods and nuisance may be used. There is no specific law against spamming in India.
In Whitney v California , J. Brandeis argued that citizens have an obligation to participate in the governing process through free discussion and criticism. Limits to political speech in India include Sections 153A and 153B of the IPC, which punish acts promoting enmity between groups, and Section 295A of the IPC, which punishes speech intended to insult religion. The Protection of Civil Rights Act, 1955, penalizes hate speech against Dalits. Section 66(A) of the IT Act criminalizes sending offensive messages through a computer or communication device.
The IT Act describes cyber crimes and prescribes punishment. Sections 43, 65, 66, and 67 deal with Cyber Crimes. Intermediaries are exempted from liability if they do not initiate the transmission, select the receiver, and modify the information.
Liability under the law of tort is relevant. Salmond’s Pigeon Hole Theory and Winfield’s theory of Law of tort are considered. Forms of liability include strict liability and vicarious liability. Liability in Biotechnology is also a consideration.
Davies and Levine's article discusses Biotechnology's Challenge to the Law of Torts. The Biotechnology Rules, 1989, and the Biotechnology Regulatory Authority of India Bill, 2003, are relevant. The Cartagena Protocol on Biosafety is also important.
Liability in Information Technology is addressed under the IT Act, 2000. Shreya Singhal vs Union of India is a notable case.
Privacy Policy and Information Handling
A body corporate must clearly publish its privacy policy on its website. This policy should detail the type of information collected, its purpose, and the security measures implemented to protect its confidentiality.
Rule 5 outlines guidelines for body corporates when collecting information, imposing specific duties:
Obtain explicit consent (written, fax, or email, including electronic communication) before collecting sensitive personal data. Collect information only for lawful purposes and when necessary. Inform individuals about the collection, its purposes, recipients, and the contact details of the agencies retaining the information. Retain information only as long as necessary for lawful use or as required by law. Maintain the security of the provided information. Designate a Grievance Officer with contact details on the website to address information provider grievances promptly.
Rule 6 mandates prior permission from the information provider before disclosing information to a third party. Exceptions exist for government agencies mandated by law or third parties with a legal order.
International Standards (IS / ISO / IEC 27001) can be implemented by a body corporate to maintain data security.
Invasion of Privacy - Common Law
This involves three elements:
A private fact. Public disclosure of that fact. The disclosure being offensive to a reasonable person.
Examples of non-public disclosure include sharing information with a lawyer, doctor, counselor, close family, or friends. Defenses include public interest, consent, and public record.
This involves:
Publishing false information or information that puts a person in a false light. The information being highly offensive to a reasonable person. Publication with knowledge or reckless disregard for the truth or effect.
Polydoros vs Twentieth Century Fox is a relevant case.
This involves:
Using information without permission. Using a protected aspect of the information. The plaintiff using the information for immediate and direct benefit. Application when put to use for commercial purposes.
Christoff vs Nestle illustrates this. In 1986, Russell Christoff, a model, was paid $250 for a photo shoot. The contract stipulated a payment of $2, plus commission if Nestlé Canada used the picture on a Taster’s Choice coffee label. The discovery rule extends the limitation period to two years after discovery, but cannot undermine the single publication rule.
Shah Rukh Khan vs State of Rajasthan provides relevant defenses.
Informational Privacy
This involves the distinction between protected information (personal vs. private) and the relationship between:
Collection and dissemination of information. The subject’s expectation of privacy.
Data Protection Principles
These principles must be considered when balancing interests:
Data Minimization Purpose Limitation Data Retention Data Security
Data Protection Laws
- Data Protection Act 2018
The UK's Data Protection Act 2018 is an umbrella legislation that differs from GDPR in several ways:
Child Consent: 16 for GDPR, 13 for DPA. Criminal Data: Official authority required for GDPR, absent for DPA. Data Subject’s Right Against Automated Profiling: DPA is silent. Privacy and Freedom of Speech and Expression Automated decision making
Data protection and privacy laws rely on a combination of legislation, regulation, and self-regulation.
Privacy Act, 1974 HIPAA 1996 (Health Insurance Portability and Accountability Act) - Privacy Rules Financial Services Modernization Act, 1999 DMCA 1998
The purpose of the Data Protection Bill is to protect the privacy of individuals regarding their Personal Data and to establish a Data Protection Authority of India. It proposes to supersede Section 43-A of the Information Technology Act, 2000, deleting provisions related to compensation for failure to protect personal data.
The PDPB proposes to protect 'Personal Data' relating to the identity, characteristics trait, attribute of a natural person and 'Sensitive Personal Data such as financial data, health data, official identifier, sex life, sexual orientation, biometric data, genetic data, transgender status, intersex status, caste or tribe, religious or political beliefs.
The PDPB applies to the processing of personal data collected, disclosed, shared, or processed within India:
By the government, any Indian Company, any citizen of India or any person or body of persons incorporated in India. Foreign companies dealing with personal data of individuals in India.
The PDPB does not apply to anonymized data, other than the anonymised data or other non personal data to enable better targeting of delivery of services or formulation of evidence-based policies by the Central Government.
The processing of Personal Data will be subject to certain purpose, collection and storage limitations such as:
For specific clear and lawful purpose. Collection of Personal Data shall be limited to such data that is necessary for the purposes of processing. Notice is required to be given to the individual/data principal for collection or processing of personal data. Personal data shall be retained only for the purpose for which it is processed and shall be deleted at the end of the processing. Data Fiduciary must verify the age and obtain parental consent when processing sensitive personal data of children.
In addition, the data fiduciaries must undertake certain transparency and accountability measures such as:
Prepare privacy policy. Take necessary steps to maintain transparency in processing personal data. Implementing security safeguards (such as data encryption and preventing misuse of data). Inform the Authority by notice breach of any personal data. Audit its policies and conduct of policies every year. Undertake data impact assessment where significant data fiduciary undertakes data processing that involves new technologies or sensitive personal data. Significant data Fiduciary shall appoint a data protection officer for the purpose of advising and monitoring the activities of the data fiduciary. Institute grievance redressal mechanisms to address complaints of individuals.
Processing of personal data is also exempted from provisions of the Bill for certain other purposes such as:
Prevention, investigation, or prosecution of any offence. Personal, domestic, or journalistic purposes. For research archiving or statistical purpose.
There are two tier of penalties and compensations:
Failure of the data fiduciary to fulfil its obligations for data protection may be punishable with a penalty which may extent to Rs.5 crores or 2% of its total worldwide turnover of the preceding financial year, whichever is higher. Processing data in violation of the provisions of the PDPB is punishable with a fine of Rs.15 crores or 4% of the annual turnover of the data fiduciary, whichever is higher. Re-identification and processing of de-identified personal data without consent is punishable with imprisonment of up to three years, or fine, or both.
IT Act, 2000
This law deals with e-commerce and cyber crimes. It was passed to legalize online transactions and amended in 2008 to include cyber crimes and punishments. It incorporates offenses like hacking, invasion of privacy, publication of obscene content, and frauds committed using electronic signatures. The Act is not applicable to NI, Trust, Will, POA, transfer of Immovable Property, notified transactions.
Controller of Certifying Authorities- CH Granting legal recognition to all transactions done through electronic data exchange, other means of electronic communication or e-commerce in place of the earlier paper- based communication.
The IT Act is the primary law recognizing and regulating e-commerce transactions. It provides legal recognition to e-contracts and electronic formats. It defines and penalizes cyber crimes. It establishes Certifying Authorities and regulates digital signatures. It establishes the Cyber Appellate Tribunal and Controller of Certifying Authorities. It amends the IPC, Evidence Act, RBI Act, and Bankers’ Book Evidence Act.
Internet of Things (IoT)
The Internet of Things (IoT) is a network of interconnected computing devices, mechanical and digital machines, objects, animals, or people. These entities possess unique identifiers (UIDs) and can transfer data over a network without direct human interaction. An IoT ecosystem comprises web-enabled smart devices utilizing embedded systems (processors, sensors, communication hardware) to gather, transmit, and act upon environmental data. IoT devices share collected sensor data by connecting to an IoT gateway or edge device, where data is either sent to the cloud for analysis or analyzed locally. These devices can also communicate and act upon information received from each other. The term "Internet of Things" was coined to incorporate the internet trend of 1999. Machine-to-Machine (M2M) communication involves connecting a device to the cloud for management and data collection. IoT expands upon M2M by creating a sensor network of billions of smart devices that connect people, systems, and applications for data sharing. The IoT concept gained prominence around 2010, partly due to China's government making it a strategic priority. IoT aims to improve lives and work efficiency, providing greater control.
IoT enables process automation and reduces labor costs for companies. It minimizes waste, improves service delivery, lowers manufacturing and delivery expenses, and offers transparency in customer transactions. Key advantages include: accessing information from anywhere at any time on any device, improved communication between connected devices, efficient data packet transfer, and automated tasks that enhance service quality and reduce human intervention.
Increased connectivity and data sharing raise the risk of confidential information theft by hackers. Managing data from potentially millions of IoT devices presents a significant challenge for enterprises. The absence of a universal compatibility standard hinders communication between devices from different manufacturers. Securing the billions of devices and data points connected to the internet is a major concern due to the expanded attack surface, leading to IoT security and privacy issues. The Mirai botnet attack in 2016, which exploited poorly secured IoT devices to disrupt Dyn's domain name servers, exemplifies these security risks. Hackers can exploit a single vulnerability to manipulate all data due to the close connection of IoT devices. Connected devices often collect personal information, making users vulnerable to data breaches. Companies could potentially misuse consumer IoT devices to collect and sell users' personal data, raising privacy concerns.
Data collected by IoT devices can serve as evidence in legal proceedings. Internet-enabled devices can be installed in automobiles as payment assurance devices, raising new legal and regulatory questions.
Article 2 of the Uniform Commercial Code (UCC) should play a central role in determining liability for vulnerable IoT products. The lack of clarity in the UCC regarding its applicability to hybrid transactions (goods, services, and software) has led to conflicting case law. Existing approaches for evaluating Article 2's applicability to hybrid transactions are inadequate for assessing IoT contracts. A functionality approach is preferable for considering how services and software are provided with IoT devices. Hybrid transactions involve goods and non-goods, such as services or software, often where software is combined with hardware. Even if software is considered a good, additional services can create a hybrid transaction. Companies routinely offer services, goods, and software in a single transaction with IoT. Courts have varied in their decisions on including software transactions under Article 2. IoT companies may separate services and software from device sales to avoid Article 2 application. A company facing a data breach lawsuit may argue that services provided with the device do not qualify as a good under Article 2, thus avoiding implied warranty claims.
Courts assess whether the primary purpose of a transaction is for goods or services. Different factors are used to determine the predominant purpose, leading to conflicting case law in disputes involving sales and installations. Services and software provided with IoT devices are as important as the device itself. One aspect of a hybrid IoT transaction may not predominate, or the provision of software and IoT services may be the predominant purpose. In transactions involving goods and services, Article 2 may apply only to the goods aspect, with common law applying to the services portion. The nature of the seller's business should also be considered. Applying the test to IoT transactions presents difficulties, such as plaintiffs framing complaints to imply disputes are about goods when they are about services.
While technological aspects of IoT are well-documented, its social and political impacts have received less attention. The European Commission (EC) identified privacy, security, ethics, and competition as key governance challenges. The US Federal Trade Commission (FTC) published a report on privacy and security in a connected world, acknowledging the benefits and risks of IoT, especially in privacy and security. In IoT, objects interact without human commands, affecting people. The availability of devices and sensors can drastically increase the amount of personal data gathered. Emerging privacy issues relate to the spread of sensors and the increasing
accuracy of collected data. Strict security risks can be identified within the potential risks posed by IoT.
Principles to Protect Citizens and Consumers
To foster trust in the IoT infrastructure, data protection legal frameworks must adapt to new technologies. Four key principles guide the construction of IoT application rules: notice and choice, data minimization, access to personal data, and accountability. IoT governance involves various elements and actors. Manufacturers should incorporate reasonable security measures into IoT devices. Rigorous security checks, authentication, and data verification are essential. The inclusion of manufacturers in IoT regulation requires a global perspective encompassing IoT norms, rules, and privacy governance in cyberspace. Transparency in data collection and clear assignment of data treatment responsibility are also necessary.
Governance mechanisms can address IoT challenges like security, interoperability standards, and protocols, similar to the general Internet. Privacy governance should oversee data collection control centers, but limits on the amount and nature of personal data collected are needed. Identifying rights and liabilities in IoT transactions is crucial, including how to regulate, protect rights, ensure performance of obligations, and address data ownership. Stakeholders include device manufacturers, data beneficiaries, data processors, and platform providers (ISPs). Contractual rights must be protected in case of online contract breaches, addressing product liability and consumer issues.
The New Act defines e-commerce as buying or selling goods or services, including digital products, over digital networks. Electronic service providers, such as Amazon and Flipkart, are broadly defined to include online intermediaries. The CP Act and associated Rules outline the duties of electronic service providers towards consumers. Software has been considered as goods since 2005. Case law examples include CIT v. Oracle Software India Ltd (2010), which addressed copying onto CD as manufacturing, and Infotech Software Dealer Association vs UoI (2010), which concerned the constitutional validity of service tax on software. When software is sold online as a downloadable file without a physical medium, it may not be considered goods.
Monitoring in online shops is less noticeable than in physical shops, making privacy protection more challenging in cyberspace due to invisible data collection. The question arises whether the law should adapt to cyberspace or vice versa. Code, or the software and hardware of cyberspace, imposes constraints on behavior. Four modalities of regulation exist: law, social
Subjective territoriality grants a sovereign power over crimes committed within its borders. Objective territoriality allows jurisdiction over acts outside the territory with substantial effects within the state. The nationality principle allows a state to regulate its nationals' conduct anywhere. The protective principle allows jurisdiction over conduct outside the territory, by nationals or non-nationals, that threatens state security or interests. The passive personality principle allows jurisdiction over crimes committed outside the territory based on the victim's nationality. Universal jurisdiction allows national courts to prosecute individuals for serious crimes against international law.
Sec 34 of the Extradition Act, 1962, deems extradition offenses committed in a foreign state to have been committed in India, allowing prosecution in India. Extra-territorial jurisdiction exists for targeting computer resources. S. 3 of IPC addresses this.
Jurisdiction to prescribe involves applying a law to a particular category of persons. Sec 1(2) of the IT Act extends to the whole of India and applies to offenses committed outside India. S. 75 of the IT Act, 2000, applies to offenses committed outside India involving a computer, computer system, or computer network located in India. Jurisdiction to adjudicate involves deciding a dispute. To show a cause of action arose in the forum state via the internet, the plaintiff must show the website was specifically targeted at viewers in the forum state for commercial transactions. Private international law is meant to find solutions when disputes are between entities in different countries. Schultz suggests a middle path between narrow and broad jurisdictional bases for managing transborder externalities. The minimum contact test, as established in Int’l Shoe v. Washington (1945), allows personal jurisdiction if the defendant has sufficient minimum contacts with the state. This may not apply to remote torts, goods moved after purchase, or non-commercial transactions like internet defamation.
Jurisdiction in Cyberspace
A plaintiff must demonstrate that contracts resulted from the defendant's actions, creating a substantial connection with the forum state. In Cybersell v. Cybersell , an Arizona corporation sued a Florida corporation for service mark infringement. The court held it had jurisdiction to try the suit.
A passive website that merely provides information is insufficient for personal jurisdiction. Interactive websites, where users exchange information with the host computer, require examining the level of interactivity and commercial nature of the exchange to determine jurisdiction.
Determining the degree of interactivity for jurisdiction is problematic. In Millennium Enterprises Inc. v. Millennium Music L.P. , the Oregon district court declined jurisdiction over a South Carolina corporation selling products online and offline. The defendant must have consummated a transaction within Oregon and made deliberate, repeated contacts through the website to anticipate being sued in Oregon.
In Winfield Collection v. McCauley , the court held that the online sale format made it impossible for the defendant's website to target users of any particular state. Jurisdiction was limited to the state where the defendant's principal place of business was located.
The Zippo test has been criticized for lacking legal certainty due to evolving technology, which has shifted from passive to interactive websites. Jurisdiction in California was deemed proper based on the effects of the defendant's Florida conduct in California.
In the Yahoo case, Yahoo France provided a link to Yahoo US for accessing Nazi memorabilia, which was prohibited under French law. The French court ordered Yahoo to block access to its US website from France. The court applied the effects test, holding that Yahoo committed a wrong within France by allowing users there to participate in the sale of prohibited items.
Categories of Cybercrime
Cybercrime includes: * Criminal activity targeting a computer or network, such as malware attacks. * Criminal activity using a computer or network, such as denial of service and phishing. * Damage to a computer or system (Section 43 of IT Act). * Tampering with source code documents (Section 65 of IT Act). * Hacking a computer system (Section 66 of IT Act). * Publishing obscene information electronically (Section 67 of IT Act). * Publication with fraudulent intent (Section 74 of IT Act). * Misrepresentation (Section 71 of IT Act). * Breach of confidentiality and privacy (Section 72 of IT Act).
Digital Signatures
Digital signatures are used to send and receive encrypted emails, conduct secure online transactions, identify participants in online transactions, apply for tenders, e-file with the Registrar of Companies (MCA), e-file income tax returns, and sign and validate Word, Excel, and PDF documents. Section 2(p) of the IT Act defines a digital signature as the authentication of an electronic record by a subscriber using an electronic method or procedure per Section 3.
Technology and IPR
Patents: A patent grants exclusive rights to an inventor for a designated period in exchange for a comprehensive disclosure of the invention. Copyright: Copyright grants the owner of intellectual property the exclusive right to reproduce the work. Utility Model Design: Utility models protect new technical inventions by granting a limited exclusive right to prevent others from commercially exploiting the protected inventions without consent. Geographical Indication: A geographical indication (GI) is a sign used on products with a specific geographical origin and qualities or reputation due to that origin. Trade Secrets: Information considered a trade secret gives a company an economic advantage over its competitors and is often a product of internal research and development.
Copyright law protects original forms of expression, including novels, movies, musical compositions, and computer software. Patent law protects inventions and some kinds of discoveries. Trademark law protects words and symbols that identify goods and services for consumers. Intellectual property rights are crucial for many businesses. William Fisher argues that IP rights can be viewed through four political lenses, including labor theory, which recognizes and rewards individuals for their hard work.
Copyright subsists throughout India in original literary, dramatic, musical, and artistic works, cinematograph films, and sound recordings. Copyright means the exclusive right to do or authorize specific acts concerning a work or a substantial part thereof. These acts vary depending on the type of work (literary, dramatic, musical, computer program, artistic work, cinematograph film, or sound recording). Section 51 provides for copyright infringement, and Section 52 states the provision of fair use.
Fair Use and Fair Dealing
Fair use is a judicially created doctrine originating from Folsom v. Marsh (1841). Fair dealing provisions under the Indian Copyright Act, 1957, as amended in 2012, exempt certain activities from copyright infringement. Certain exceptions under Section 52(1) of the Copyright Act apply to all works, while others are restricted to specific works. The term "fair use" is undefined in both US and Indian copyright law but is captured in legislation, with judicially derived factors listed under 17 USC § 107 and § 52 of the Copyright Act of 1957. US law uses "fair use," while British and Indian law use "fair dealing." Justice Joseph Story laid the foundation for fair use in Folsom v. Marsh with a four-factor test, which is now codified under US law. Before the enactment of 17 USC § 107 in 1976, fair use in US law was only a common law doctrine. Macmillan and Company v. K. and J. Cooper was one of the earliest Indian cases to discuss unfair use. The US approach gives judges more freedom to assess "fair use" and extend these factors to new areas of technology and copyright content.
Copyright Infringement and Fair Use
Several newspapers initiated legal action against the Internet forum Free Republic, alleging copyright infringement due to users reposting full newspaper articles. Free Republic defended its actions by invoking the doctrine of fair use and the First Amendment's guarantee of freedom of speech.
Leslie A. Kelley, the plaintiff, managed websites featuring images, including one promoting his photographs and another advertising corporate retreats. He also operated a subscription-based website and leased images.
The Fair Use Doctrine, a component of US Copyright law, permits specific uses of copyrighted material under particular circumstances. Four factors are considered when determining fair use: the purpose and character of the use, the nature of the copyrighted work, the amount and substantiality of the portion used, and the effect on the potential market or value of the copyrighted work.
Creating a simple hyperlink to another website's homepage is generally acceptable, akin to using footnotes. However, creating a link that facilitates unauthorized copying of copyrighted material, with knowledge or reason to know of the infringement and encouragement thereof, constitutes a violation.
A court issued a temporary restraint, preventing the copying of newspaper headlines and the creation of hyperlinks from those headlines to the corresponding articles without consent.
Framing involves displaying the content of one website within the framework of another, similar to a picture-in-picture feature.