If you are stuck in such a situation, here is what to do.
A student, let’s call him Rohan, recently found himself in a distressing situation. Following his participation in several national-level competitive exams, he began receiving an overwhelming barrage of calls and emails from various educational institutions across the country. These were not generic marketing messages; they contained highly specific and personal information, including his exam scores and unique application numbers. The communications, often sent by a marketing firm named “EduPrime Solutions” on behalf of these colleges, created a sense of violation and harassment. Despite blocking numerous numbers and email addresses, the spam continued relentlessly, with Rohan receiving up to 40-50 calls per day from new numbers. He suspected that his personal data was leaked from the examination authority, the “National Assessment Body (NAB),” and was unsure of the legal steps he could take to stop this invasion of privacy.
Advice in such cases
Document Everything: Keep a detailed record of all spam communications. Take screenshots of emails, text messages, and call logs. Note the date, time, phone number, and content of each interaction. This documentation is crucial evidence.
Do Not Engage: Avoid responding to these calls or emails. Do not click on any links or provide any further personal information. Engaging with them can sometimes lead to an increase in spam.
Use Reporting Tools: Report the spam numbers to your telecom service provider. Most smartphone operating systems have built-in features to report and block spam calls and messages. Similarly, report the emails as spam through your email client.
Activate DND: Ensure that your number is registered on the National Do Not Disturb (DND) registry. While this may not stop fraudulent callers, it is a necessary first step.
File a Complaint with TRAI: You can file a formal complaint with the Telecom Regulatory Authority of India (TRAI) for Unsolicited Commercial Communication (UCC).
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think
Applicable Sections of Law
Several laws in India can be invoked in such a scenario, particularly with the introduction of new legislation.
The Digital Personal Data Protection Act, 2023 (DPDPA): This is the primary law governing data privacy in India. The act mandates that personal data can only be processed for a lawful purpose and with the explicit consent of the individual. In this case, the educational institutions and the marketing firm are processing Rohan’s data without his consent, which is a clear violation. Significant penalties can be imposed on entities that fail to protect personal data or misuse it.
The Information Technology Act, 2000: While the DPDPA is now in place, certain provisions of the IT Act remain relevant. Section 43A provides for compensation for failure to protect data, and Section 66C deals with punishment for identity theft. Using someone’s personal application number could be interpreted as a form of identity theft.
The Bharatiya Nyaya Sanhita, 2023 (BNS): Provisions related to cheating could potentially apply. If the institutions are using the data to make false promises or deceive students, sections like Section 318 (Cheating) of the BNS could be invoked.
The Consumer Protection Act, 2019: Unsolicited marketing calls and emails can be classified as an “unfair trade practice” under this Act. A complaint can be filed in the consumer forum seeking compensation and a halt to such practices.
If you are the complainant
As the person filing the complaint, you need to be proactive and systematic.
Consolidate Evidence: Gather all the screenshots, call recordings (if any), email printouts (including full headers), and a detailed log of the harassment. The more detailed your evidence, the stronger your case.
Send a Legal Notice: Your lawyer can draft and send a legal notice to the identified educational institutions and the marketing firm, demanding that they cease and desist all communication and reveal the source of your data.
File a Police Complaint: File a complaint with the local police or the Cyber Crime Cell. Provide them with all the evidence you have collected. An FIR can be registered under the relevant sections of the law.
Approach the Data Protection Board: Once fully operational, you can file a complaint with the Data Protection Board of India under the DPDPA for the misuse of your personal data.
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think
If you are the victim
If you find yourself in this situation, take these immediate steps to protect yourself.
Secure Your Accounts: While not directly related to calls, if you suspect a data breach, it’s wise to change passwords for important online accounts, especially email.
Inform the Source: Write a formal complaint to the suspected source of the leak (in this case, the “National Assessment Body”). While they may not admit fault, it creates an official record of your complaint.
Stay Calm and Methodical: The sheer volume of spam is designed to overwhelm you. Do not get flustered. Continue to block, report, and document each instance methodically.
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think
How the police behave in such cases
The police response to such complaints can be mixed. Initially, a local police station might perceive it as a non-cognizable issue or a minor nuisance. They may be reluctant to file an FIR and might direct you to the Cyber Crime Cell. The Cyber Crime units are generally better equipped to handle such cases but are often overburdened. Having a lawyer accompany you or sending the complaint through a lawyer can ensure it is taken more seriously. The investigation will involve technical analysis, such as tracing IP addresses of emails and tracking the ownership of the multitude of phone numbers used, which can be a time-consuming process.
FAQs people normally have
What evidence is required?
To build a strong case, you will need concrete evidence. This includes:
A complete log of incoming calls with the numbers, dates, and times.
Screenshots of SMS and WhatsApp messages from the spammers.
The original spam emails, with full header information visible, as this helps trace the origin server.
A written transcript or note of what was said during the calls, especially instances where your personal exam scores or application numbers were mentioned.
Any other document that proves the entities contacted you without your consent.
How long will the investigation take?
The duration of an investigation into a data leak and spamming case can vary significantly. Simple cases where the culprits are easily identifiable might be resolved in a few months. However, if the spammers are using sophisticated methods like VoIP calls, masked numbers, or servers located in other countries, the investigation can become complex and may take a year or even longer. The timeline depends heavily on the efficiency of the investigating agency and the cooperation received from telecom companies and internet service providers.
Advocate Sudhir Rao, Supreme Court of India