If you are stuck in such a situation, here is what to do.

A recent incident came to light involving a resident of Suryanagar, Mr. Ajay Khanna, who discovered a disturbing practice by a corporate matchmaking service named ‘PerfectMatch Solutions’. He found that the company was using his personal information—including his name, age, profession, and photographs—to create a matrimonial profile and present it to their paying clients, all without his knowledge or consent. The company allegedly scraped this data from publicly accessible online platforms like professional networking sites and social media accounts.

PerfectMatch Solutions was packaging this publicly available information into a formal-looking profile, giving their clients the false impression that Mr. Khanna was an active and willing participant in their matchmaking services. They were essentially using his identity to attract and retain paying customers, falsely representing that they had a large and verified database of prospective partners. This practice is not only unethical but also a significant violation of privacy and potentially fraudulent, as it misleads clients who are paying for a genuine service.

Advice in such cases

• Gather Evidence: Collect all possible proof, such as screenshots of your profile on their platform, emails or messages from the bureau, and any communication where they claim to represent you. If possible, get testimonies from their paying clients who were shown your profile.
• Send a Legal Notice: The first formal step is to have a lawyer send a cease and desist notice to the company, demanding they immediately remove your data and provide a written apology. This notice can also claim damages for the violation of your privacy and for misrepresentation.
• File a Complaint: You can file a complaint with the Data Protection Board of India (once fully operational under the DPDPA, 2023) for the unauthorised processing of your personal data. Additionally, a police complaint can be filed for cheating and identity theft.
• Consumer Complaint: A complaint can also be lodged with the consumer protection authorities for unfair trade practices, as the bureau is misleading its paying customers.

Applicable Sections of Law

Such actions by a company fall foul of several key Indian laws, particularly the new acts replacing older legislation:

• The Digital Personal Data Protection Act, 2023 (DPDPA): This is the primary legislation governing data privacy. The company’s actions violate key principles, including the requirement for clear and specific consent before processing personal data (Section 6) and the obligations of a Data Fiduciary to use data only for the purpose for which it was collected (Section 8). Non-compliance can lead to substantial penalties.
• The Bharatiya Nyaya Sanhita, 2023 (BNS): The act of presenting your profile to lure paying clients can be considered cheating. Section 318 of the BNS, which deals with cheating and dishonestly inducing delivery of property, would be applicable. The bureau is dishonestly inducing clients to pay money under the false pretense that you are a registered member.
• The Information Technology Act, 2000: While the DPDPA is more specific to data privacy, certain provisions of the IT Act concerning identity theft and cheating by personation using a computer resource may also be invoked.

If you are the complainant

If you are a paying client of such a bureau and discover that you are being shown profiles of individuals who never consented, you are a victim of an unfair and deceptive trade practice.

• Demand a Refund: You have paid for a service under false pretenses. You should immediately demand a full refund from the company.
• File a Consumer Complaint: You can file a complaint in the District Consumer Disputes Redressal Commission for deficiency in service and unfair trade practices. You can claim a refund of the fees paid, along with compensation for the mental agony and harassment caused.
• Act as a Witness: You can assist the person whose profile was misused by providing a statement or affidavit confirming that the bureau presented their profile to you as a genuine, registered client.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

If your personal information has been used without your consent, you are the primary victim of a privacy breach and misrepresentation.

• Send a Takedown Notice: Your first action should be to send a formal written communication, preferably a legal notice through a lawyer, to the bureau demanding the immediate removal of your profile and all associated data from their systems.
• File a Police Complaint (FIR): You should file an FIR at your local police station for cheating under Section 318 of the BNS and for offenses related to identity theft. The police are obligated to investigate the matter.
• Report to the Data Protection Board: Under the DPDPA, 2023, you have the right to file a complaint with the Data Protection Board of India against the company (the Data Fiduciary) for processing your personal data without consent.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

How the police behave in such cases

Upon receiving a complaint, the police will typically conduct a preliminary inquiry. If they find merit in the complaint, they will register a First Information Report (FIR) under the relevant sections of the BNS. The investigation will involve summoning the officials of the matchmaking company, examining their records and electronic devices, and recording statements from you and any other witnesses (such as the paying clients). The Cyber Crime cell is often involved in such cases to trace the digital footprint and collect electronic evidence. Cooperation with the police and providing them with all the evidence you have gathered is crucial for a successful investigation.

FAQs people normally have

Is it illegal if the information they used was already public on my social media?

Yes, it is illegal. Under the DPDPA, 2023, even if data is publicly available, it cannot be processed (collected, stored, and used) for a specific purpose like creating a matrimonial profile and selling it as a service without your explicit consent. The context and purpose of its use are key.

Can I sue the company for money?

Yes, you can file a civil suit for damages. You can claim compensation for the violation of your right to privacy, for the mental distress caused, and for any damage to your reputation. The legal notice sent initially should quantify these damages.

Should I name and shame the company online?

While public awareness is important, it is advisable to first proceed through legal channels. Sending a legal notice and filing a formal complaint creates a legal record and puts you on a stronger footing. Naming the company publicly without a legal basis could expose you to a defamation lawsuit, however unlikely. It is best to follow your lawyer’s advice on this.

What evidence is required?

Strong evidence is key to building a solid case. You should try to collect:

• Screenshots or printouts of your profile as it appears on the bureau’s platform or in their communications.
• Any emails, text messages, or recorded phone calls between you and the company.
• Copies of the legal notice you sent and their response, if any.
• Written statements or affidavits from paying clients of the bureau who were shown your profile.
• Any digital evidence showing the source of your data (e.g., a screenshot of your LinkedIn profile that matches the one they used).

How long will the investigation take?

The duration of an investigation can vary significantly. A police investigation can take anywhere from a few months to over a year, depending on the complexity of the case, the cooperation of the accused, and the workload of the investigating agency. Proceedings before the Data Protection Board are expected to be quicker, but timelines will become clearer once it is fully functional. Consumer court cases also have their own timelines, typically ranging from six months to a couple of years.

Advocate Sudhir Rao, Supreme Court of India