Madras High Court
Himanshu Pathak vs Ministry Of Electronics And ... on 23 October, 2024
Author: M.Dhandapani
Bench: M.Dhandapani
W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
IN THE HIGH COURT OF JUDICATURE AT MADRAS
DATED : 23.10.2024
CORAM :
THE HONOURABLE MR.JUSTICE M.DHANDAPANI
W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
and
WMP.No.31369 of 2024
W.P.No.12042 of 2023:
Himanshu Pathak,
Proprietor of Cyberx9,
Flat No.B-3, 504, Shurya Green Apartment,
Surya Enclave, Jalandhar-I,
Jalandhar, Punjab – 144 009. ...Petitioner
Vs.
1. Ministry of Electronics and Information Technology,
Electronics Niketan,
6, CGO Complex,
Lodhi Road, New Delhi – 110 003.
2. Ministry of Finance,
3rd Floor, Jeevan Deep Building,
Sansad Marg, New Delhi – 110 001.
3. Ministry of Home Affairs,
North Block, New Delhi – 110 001.
4. Ministry of Corporate Affairs,
A Wing, Shastri Bhawan,
Rajendra Prasad Road, New Delhi – 110 001.
Page No.1 of 12
https://www.mhc.tn.gov.in/judis
W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
5. Insurance Regulatory and Developmental Authority of India (IRDAI),
Sy No.115/1, Financial District,
Nanakramguda, Gachibowli,
Hyderabad – 500 032.
6. Security Exchange Board of India,
SEBI Bhawan,
Plot No.C-4-A, 'G' Block,
Bandra Kurla Complex, Bandra(East),
Mumbai – 400 051.
7. Star Health and Allied Insurance Company Limited,
Having its registered office at,
No.1, New Tank Street, Valluvar Kottam High Road,
Nungambakkam, Chennai – 600 034.
Represented by its Authorised Signatory. ...Respondents
Pryaer in W.P.No.12042 of 2023: Writ Petition filed under Article 226 of
Constitution of India, praying for issuance of Writ of Mandamus, directing
the 2nd respondent to take action against the 7th respondent company based on
the complaint given by the petitioner on 07.03.2023.
In all W.P's.:
For Petitioner : Mr.Nithyaesh Natraj
for M/s.Keerthikiran Murali
For Respondents : Mr.ARL.Sundaresan, ASG, Assisted by
Mr.Prasad Vijayakumar, SPC,CG, for R1 to R4
: Mr.M.B.Raghavan, for R5
: Mr.SVM.Shivakumar
for M/s.Shivakumar & Suresh, for R6
: Mr.Krishna Srinivas
for M/s.S.Ramasubramaniam & Associates, for R7
Page No.2 of 12
https://www.mhc.tn.gov.in/judis
W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
COMMON ORDER
Since the issue involved in all these Writ petitions are similar in nature, they are disposed of by way of this common order.
2. The petitioner has filed these Writ petitions seeking direction to the 2nd respondent to take action against the 7th respondent company based on the complaint given by the petitioner on 07.03.2023.
3. The case of the petitioner is that he is a customer under the 7 th respondent and is provided with access to see his details with regard to the insurance policy. The 7th respondent caters to the insurance requirements of various customers, who are also provided the said access. However, when the petitioner accessed the website of the 7th respondent, the petitioner was able to see the vulnerabilities in the website, which revealed the personal details of the various policy holders, as the avocation of the petitioner related to cyber security. Though the petitioner, through his representations brought this to the notice of the 7th respondent as also the other respondents, no action Page No.3 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023 was taken on the said representations, prompting the petitioner to file the present writ petitions.
4. Learned counsel for the petitioner submitted that, the petitioner reported the vulnerabilities in web application of the 7th respondent through detailed report dated 19.12.2022, however, the 7th respondent took no steps to cure the same and the 7th respondent suddenly made allegation as against the petitioner, as if the petitioner unauthorisedly entered into the data collected by the 7th respondent and stolen the same and thereby, filed a suit in C.S.No,1 of 2023 and obtained an interim injunction as against the petitioner. However, irrespective of the interim injunction granted by this Court, it is the grievance of the petitioner that his interest is nothing personal, but to safeguard the interests of more than 62 crores of vulnerable data stored by the 7th respondent. Further, as feared by the petitioner, already hackers from China have stolen data available in United States of America and the same is available in the public domain and the same is very much sufficient to show that the vulnerabilities in the website which stores the data of the persons by the 7th respondent is not in terms of the policy of the Central Government and Page No.4 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023 IRDA. Thereby, the petitioner sought to ventilate his grievance before the concerned authorities, who are also the respondents herein, however, the respondents failed to consider the same. Accordingly, he prayed for appropriate orders.
5. Per contra, the learned Additional Solicitor General appearing on behalf of the respondents 1 to 4 submitted that, it is an individual dispute in between the petitioner and the 7th respondent, for which, already the 7th respondent filed a suit in C.S.No.1 of 2023 against the petitioner for the interference caused by it in collection of data by the 7 th respondent and obtained an interim injunction on 03.01.2023 and the same was also confirmed by this Court. Aggrieved by the same, the petitioner preferred an appeal before the Division Bench of this Court. When such a suit and appeal is pending between them, the proper remedy available to the petitioner is to approach the civil court. Even otherwise, the competent authority to redress the grievance of this petitioner is the 5th respondent and instead of approaching the 5th respondent, filing the present petitions and frivolous complaints before the respondents 1 to 4 is not sustainable. Page No.5 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
6. Learned counsel appearing on behalf of the 5th respondent submitted that, in fact the petitioner's complaint was examined and security guidelines were already issued on 7.4.2017 and subsequently after the petitioner's complaint, on 29.12.2020, a detailed procedure for conducting security checks were prescribed and apart from that, other circular was issued on 11.10.2022 and 24.04.2023 and periodical procedure was created for curbing hackers from hacking the website in order to protect the data of all the customers. Hence, the petitioner's complaint does not deserve to be considered by the 5th respondent, since, already a dispute is pending before the Criminal court as well as before this Court.
7. Learned counsel for the 6th respondent submitted that, this respondent has only limited role to conduct enquiry and in the present case, the issue is already pending before the civil court and unless the Civil court decides the issue, the 6th respondent cannot take any action on the representation.
Page No.6 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
8. Learned counsel for the 7th respondent submitted that, the petitioner is a customer of the 7th respondent and he already sent a report to the petitioner on 19.12.22 and even a bare perusal of the said report makes it clear that, the petitioner unauthorisedly entered into the data of the 7 th respondent, which is illegal. Hence, action has been taken by the 7th respondent which has penal consequences. Thereby, C.S.No.1 of 2023 came to be filed, in which, this court granted interim inunction on 03.01.2023 and the same was made absolute on 07.06.2023. Even prior to that, the 7th respondent filed criminal complaint before the jurisdictional police station on 05.01.2023 for the ofence u/s.66 & 43 (b) of Information Technology Act.
9. In response, the learned counsel for the petitioner submitted that, the said FIR has been stayed by this Court.
10. This Court gave its careful submissions to the submissions made by the learned counsel appearing on either side and perused the materials available on record.
Page No.7 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
11. It is borne out by record that as against the vulnerabilities alleged to have been pointed out by the petitioner, suit in C.S. No.1/2023 has already been filed along with application for interim injunction to injunct the petitioner herein from releasing the vulnerability report and after hearing either side exhaustively, learned single Judge had granted an order of interim injunction, wherein the court had made the following observation :-
"22. This is an act prima facie not only attracts penalty under Section 43 but it is also an offence punishable with imprisonment under Section 66 of the Act. Therefore, I am prima facie of the view that the act of the respondents in accessing and downloading the data of the applicant is illegal as being contrary to the Act. What the respondents now seek is to permit it to publish the vulnerability of the applicant based upon the aforesaid illegal act. This in my opinion would only perpetuate the illegality committed by the applicant to gain reputation."
12. It is to be pointed out that a suit has already been filed in which an order of injunction has been granted, meaning thereby, that the matter is already sub judice with regard to the very same issue, viz., vulnerability and data breach. When such being the case, the relief sought for by the petitioner Page No.8 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023 for consideration of his representation and passing of orders, would be wholly unsustainable as until an order is passed in the suit and in the light of the operation of the order of injunction, it would not be permissible for the respondents to pass any orders on the representations filed by the petitioner and rightly no orders have been passed till date. It is further to be pointed out that the criminal machinery has been set in motion by registration of FIR, which according to the petitioner has been stayed. Such being the case, the issue also involving penal consequences, no direction could be passed at this point of time as it would have a detrimental impact on the outcome of the pending litigations.
13. It is the further stand of the respondents that action has been taken to arrest the vulnerability and data loss by issuing circulars and further directions could be issued only upon the suit being decided. Such being the case, no order for mandamus as sought for could be granted by this Court.
14. In the aforesaid circumstances, this Court is of the considered view that the relief sought for cannot be granted and, accordingly, these Writ Page No.9 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023 petitions are dismissed. However, liberty is granted to the petitioner to workout his remedy in the manner known to law, upon disposal of the civil suit, the criminal complaint and other pending litigations. No costs. Consequently, the connected Miscellaneous petition is closed.
23.10.2024
skt
NCC : Yes/No
Index : Yes/No
Speaking Order : Yes/No
To:
1. Ministry of Electronics and Information Technology, Electronics Niketan, 6, CGO Complex, Lodhi Road, New Delhi – 110 003.
2. Ministry of Finance, 3rd Floor, Jeevan Deep Building, Sansad Marg, New Delhi – 110 001.
3. Ministry of Home Affairs, North Block, New Delhi – 110 001.
4. Ministry of Corporate Affairs, A Wing, Shastri Bhawan, Rajendra Prasad Road, New Delhi – 110 001.
Page No.10 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023
5. Insurance Regulatory and Developmental Authority of India(IRDAI), Sy No.115/1, Financial District, Nanakramguda, Gachibowli, Hyderabad – 500 032.
6. Security Exchange Board of India, SEBI Bhawan, Plot No.C-4-A, 'G' Block, Bandra Kurla Complex, Bandra(East), Mumbai – 400 051.
7. Star Health and Allied Insurance Company Limited, Having its registered office at, No.1, New Tank Street, Valluvar Kottam High Road, Nungambakkam, Chennai – 600 034.
Represented by its Authorised Signatory.
Page No.11 of 12 https://www.mhc.tn.gov.in/judis W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023 M.DHANDAPANI, J.
skt W.P.Nos.12042, 12045, 12049, 12054, 12055 & 12057 of 2023 and WMP.No.31369 of 2024 23.10.2024 Page No.12 of 12 https://www.mhc.tn.gov.in/judis