Indians Worried About Data Misuse on Facebook

Indians Worried About Data Misuse on Facebook is a The Hindu Business Line article published on 1 October 2018. The report examines Indian user reactions to Facebook’s September 2018 security breach affecting 50 million accounts globally, highlighting the absence of mandatory breach disclosure requirements in Indian law and the urgent need for comprehensive data protection legislation.

Article Details
Full Text
Context and Background
External Link

Article Details

📰 Published in:: The Hindu Business Line
📅 Date:: 1 October 2018
👤 Author:: Varun Agarwal
📄 Type:: News Report
📰 Newspaper Link:: Read Online

Full Text

Shweta Nambiar, a final-year arts student in Mumbai was taken by surprise when, on Sunday, she was asked to login to her Facebook account again. And when she did, a message on Facebook showing a "security alert" talked about how her account details were breached in a recent hack that impacted at least 50 million accounts globally.

"I have no idea what kind of details from my account have been leaked out and Facebook hasn't provided any details either. I'm not even sure how safe it is to use Facebook any more," Nambiar said.

Several other Facebook users shared a similar experience as Facebook provided very little details of what exactly happened during the security incident that it reported.

While Facebook insists that it was successful in fixing the vulnerabilities that led to the breach, it said it is still investigating the incident, wherein the attackers exploited a vulnerability in Facebook's code that impacted "View As" — a feature that lets people see what their own profile looks like to someone else.

Access tokens

"This allowed them to steal Facebook access tokens which they could then use to take over people's accounts. Access tokens are the equivalent of digital keys that keep people logged into Facebook; they don't have to re-enter their passwords every time they use the app," Facebook said.

Facebook later said on Friday that the breach also affected third-party apps that have been linked to your Facebook account. As a precautionary measure, Facebook logged about 90 million people out of their accounts, the company said.

While the social networking giant reported the incident to the FBI as well as the Irish Data Protection Commission, Indians remain clueless about how safe their data is with Facebook. And there's still no word from the company on how many of the 90 million users are from India. Privacy activists feel that Facebook has been taking users for a ride for a long time and it's high time that the Indian government takes some action.

"Facebook is taking all users for granted. I don't see how Indians are being treated better or worse on this specific issue," said Sunil Abraham, President at Centre for Internet and Society. "Facebook is not willing to disclose the extent of breach in India because currently there is no obligation under Indian law to do so."

Mishi Choudhary, technology lawyer and online civil liberties activist said "They (users) can proceed under sections 43a and 72 of IT Act. Section 43A of the IT Act explicitly provides that whenever a corporate body possesses or deals with any sensitive personal data or information, and is negligent in maintaining a reasonable security to protect such data or information, which thereby causes wrongful loss or wrongful gain to any person, then such body corporate shall be liable to pay damages to the person(s)"

Other activists feel the breach highlights why Indian data protection law is urgently required in the country. "This is a clear example of why we need a data protection law with extra territorial applicability that will protect the data of Indian users, even if the entity collecting data is overseas," Namita Viswanath, Partner at IndusLaw, said. This is not the first time Indians were impacted by data breaches at Facebook.

Right to privacy

Recently, Facebook admitted that the data of 87 million users, including 5 lakh Indian users, was shared with Cambridge Analytica, which used it to attempt to sway elections in different places, including one in Uttar Pradesh.

The proposed Data Protection Bill 2018 has tried to address several such misuses of data by making individual consent central to data sharing. The report notes that the right to privacy is a fundamental right. Unless you have given your explicit consent, your personal data cannot be shared or processed. Of course, this also means that the onus lies on you to make an informed choice.

We have several laws, including the IT Act 2008, which can be used to protect users' personal information. What's required, however, is a strong enforcement of such acts to prevent companies from taking personal lives of citizens for granted.

Context and Background

This article appeared shortly after Facebook disclosed on 28 September 2018 that attackers had exploited a vulnerability in its “View As” feature, compromising access tokens for approximately 50 million accounts. The breach forced Facebook to reset authentication for 90 million users globally as a precautionary measure. Unlike the Cambridge Analytica incident, which involved misuse of data harvested through a third-party application, this breach represented a direct security failure in Facebook’s core infrastructure.

The incident occurred against the backdrop of ongoing fallout from the Cambridge Analytica scandal, which had affected 562,455 Indian users earlier that year. That controversy had prompted the Indian government to issue detailed questionnaires to Facebook and establish the Justice BN Srikrishna Committee to draft data protection legislation.

Sunil Abraham’s observation about the absence of mandatory breach disclosure requirements reflected a critical gap in Indian law at the time. Whilst the Information Technology Act 2000 (amended in 2008) contained provisions under Section 43A imposing liability for negligent data security practices, it did not mandate timely notification to affected users or regulatory authorities. This contrasted sharply with frameworks such as the European Union’s General Data Protection Regulation, which required breach notification within 72 hours.

The Justice Srikrishna Committee had submitted its report and draft Personal Data Protection Bill 2018 in July 2018, three months before this article’s publication. The proposed legislation included provisions for mandatory breach notification, extraterritorial application, and establishment of a Data Protection Authority, addressing many of the concerns raised by privacy advocates in this report.