Vodafone Idea Ordered To Pay 2.75 Crores To HHI Group For Data Negligence

In a case involving cyber negligence under the Information Technology Act, 2000, the Cyber Adjudicating Officer has directed Vodafone Idea to compensate HHI Group with approximately 2.75 Crores for financial losses.

The dispute arose when unauthorised SIM replacement requests were sent to HHI Group’s business mobile number, 9830105389. On February 18, 2023, at 3:16 PM, an SMS requesting a SIM placement was received, leading to immediate deactivation of the SIM. Neither HHI personnel nor the complaints had initiated such a request. The incident was promptly reported to the service provider’s operational team (OP-1) on February 20, 2023 by Esha Roy, Corporate Public Relations Manager of HHI. A duplicate SIM was issued and activated on February 21, 2023. However, the complainant received a similar fraudulent SMS on March 11, 2023. Although another duplicate SIM was promptly issued in a couple of days, unauthorised transactions amounting to 70,00,500 was detected on scrutiny of two bank accounts.

The bank managed to recover 59,01,000 from the fraudulent Rs 70,00,500 transfer, which was credited back to the complainant’s account. However, the remaining amounts led to multiple FIRs lodged under various sections of the Indian Penal Code (IPC) including 120(B), 419, 420, 467, 468 and 471.

The Cyber Adjudicating Officer dismissed Vodafone Idea’s contention that the petition was unmaintainable due to the pending Digital Personal Data Protection Act, 2023, noting that the Act had not yet come into force. Examination of the Bank’s documents revealed that the fraudulent transactions were authorised through OTPs sent to a compromised mobile number, adhering to the two factor authentication system. 

However, the court found Vodafone negligent in verifying the legitimacy of the SIM replacement requests, which facilitated unauthorised access. Further investigation identified that an imposter named Mohammed Ashfaque, had sent fraudulent emails and provided fake SIM card details to activate HHI Group’s mobile number. The adjudicating officer was of the opinion that Vodafone failed to perform due diligence in confirming the authenticity of these requests, violating Section 43(g) and 43A of the IT Act, which mandate the protection of sensitive personal data and reasonable security practices.

During the proceedings, several precedents were put before the adjudicating officer, including:

Cyber Appeal No. 3 of 2018 (India Vs Shri Sandeep & Anr)

Cyber Appeal No. 5 of 2018 (Vodafone Idea Ltd vs Shri Sandeep Singhal & Anr)

Cyber Appeal No. 1 of 2014 (Vodafone Cellular Ltd Vs Sanjay Govind Daude & Ors)

These cases established the liability of telecom service providers in instances of fraudulent SIM swapping when proper diligence is not exercised.

The adjudicator found Vodafone Idea liable on account of failure to implement security measures and verify SIM replacement requests, causing financial loss to HHI group as a consequence.

United Hotels and Properties (HHI Group) was represented by Argus Partners. The Argus Team was led by Soorjya Ganguli and Pooja Chakrabarti (Partners) along with Debomita Sadhu (Senior Associate)