How to file complaints against unauthorized online data sharing by companies?

In the digital age, consumers share a significant amount of personal data with online companies. Whether purchasing goods, signing up for services, or using digital platforms, this data can include sensitive information such as names, addresses, contact details, financial information, and even biometric data. When companies misuse or share this data without the consumer's consent, it can lead to serious privacy violations. Understanding how to report such breaches and what legal protections are available is crucial for consumers to safeguard their data.

Steps to File Complaints Against Unauthorized Online Data Sharing:

1. Understand the Legal Framework Protecting Your Data

• GDPR (General Data Protection Regulation) (EU): If you are in the EU or dealing with an EU-based company, the GDPR provides strict guidelines on how companies must handle personal data. It gives consumers the right to access, rectify, and delete their personal data.
• India’s IT Rules 2011: In India, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 provide a framework for the protection of sensitive personal data shared by users in online services. Companies must implement reasonable security practices to protect this data and obtain explicit consent before sharing it with third parties.

2. Check Company’s Privacy Policy

• Review the Privacy Policy: Before filing a complaint, examine the company’s privacy policy to verify if they have breached their own terms. The policy should state how your personal data is used, shared, and stored.
• Consent Verification: If you did not give explicit consent for your data to be shared, this is a clear violation. Ensure you have evidence, such as screenshots or emails, to prove that the company has shared your data without permission.

3. Contact the Company’s Customer Support

• Report the Incident: Before escalating the issue to authorities, contact the company directly. Inform them of the unauthorized data sharing, and request immediate action.
• Request Data Deletion: Under data protection laws like GDPR, you can request that your personal data be deleted, especially if it was shared without your consent.
• Demand Compensation: If the breach has caused financial or emotional harm, you may request compensation, depending on the severity of the violation.

4. File a Complaint with Data Protection Authorities

• GDPR (for EU Consumers): Under the GDPR, consumers can file complaints with the National Data Protection Authority in the country where they reside. The authorities must investigate the matter and may impose fines on the company if a breach is confirmed.
• How to file: Go to the relevant Data Protection Authority’s website, fill out a complaint form, and submit any evidence of unauthorized data sharing.
• India - Data Protection Authorities: In India, the Data Protection Authority of India is expected to be set up under the Personal Data Protection Bill (which is still in draft stages). Until then, consumers can file complaints with:
  • Indian Computer Emergency Response Team (CERT-In): CERT-In handles cybercrimes and can intervene in cases of data breaches.
  • National Consumer Helpline (NCH): You can also approach the National Consumer Helpline for help in escalating the issue.
  • State Cyber Crime Cells: For more severe data breaches, you can contact local cybercrime police stations for further assistance.

5. Lodge a Complaint with Consumer Forums or Regulatory Bodies

• Consumer Courts: If you feel that the unauthorized data sharing has caused you harm or financial loss, you can approach consumer courts for redressal. Under the Consumer Protection Act, you can file a complaint for violations related to personal data misuse.
• Approach the Reserve Bank of India (RBI): If the breach involves financial information, such as credit card details or bank account information, you can also file a complaint with the RBI.

6. Filing a Cybercrime Complaint

• Cyber Crime Portal: In cases of fraud or identity theft resulting from unauthorized data sharing, file a report on India’s cybercrime.gov.in portal or equivalent portals in other countries.
• File an FIR: If the unauthorized sharing leads to financial loss, identity theft, or fraudulent transactions, file a First Information Report (FIR) with the cybercrime division or local police.

7. Monitor Your Financial Accounts

• Check for Fraudulent Transactions: After discovering unauthorized data sharing, closely monitor your bank statements, credit card statements, and any online accounts for unusual activity.
• Freeze Accounts: If your financial data has been exposed, freeze your bank or credit accounts and inform the institution about the breach.

Example:

Scenario: A consumer has signed up for an online shopping platform and provided personal information such as name, address, and credit card details. Later, they discover that the platform shared this data with a third-party marketing company without their consent, leading to spam calls and phishing attempts.

Steps Taken:

• The consumer reviews the platform’s privacy policy and confirms that there is no clause giving permission to share personal data with third parties.
• The consumer contacts customer support to report the breach and requests the deletion of their data.
• After no action from the platform, the consumer files a complaint with the Data Protection Authority (GDPR for EU consumers, CERT-In for India).
• The consumer files a complaint with the National Consumer Helpline and the Cybercrime Portal to report potential fraud and misuse of their personal information.

As a result, the platform is fined for violating privacy laws, and the consumer receives compensation for distress caused by the breach.

Conclusion:

Unauthorized online data sharing by companies is a serious violation of consumer privacy. Consumers have the right to take legal action through data protection authorities, consumer courts, or cybercrime cells to seek redress for privacy violations. By understanding data protection laws and knowing how to report breaches, consumers can protect themselves from identity theft, financial fraud, and other risks posed by unauthorized data sharing. Always ensure you read the privacy policy and terms of service of any platform before sharing your personal information online.