One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

Mr.X visited XYZ Fashion Store in City A to exchange a product he had purchased earlier. When he approached the counter, the cashier demanded his mobile number, stating that without providing this information, they would refuse to process the exchange. Mr.X protested, citing government circulars that prohibit businesses from denying services based on a customer’s refusal to share personal contact details. Despite his valid objections and knowledge of consumer rights, the store staff remained adamant and refused to proceed with the exchange unless he complied with their demand for his mobile number. This forced data collection violated his privacy rights and consumer protection laws.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

• Document the incident immediately with photographs of store policies and staff responses
• File a complaint with the District Consumer Forum within two years of the incident
• Report the privacy violation to the appropriate data protection authorities

Applicable Sections of Law

This case involves violations under multiple legal frameworks. Under the Bharatiya Nyaya Sanhita (BNS), Section 318 addresses criminal breach of trust regarding personal data misuse. The Consumer Protection Act, 2019 provides remedies for unfair trade practices. Section 43A of the Information Technology Act deals with data protection violations. Additionally, BNSS provisions under Section 173 allow for filing complaints regarding service denial and consumer rights violations. The Digital Personal Data Protection Act, 2023 also applies to forced data collection practices by commercial establishments.

If You Are the Complainant

• Gather all purchase receipts and exchange policy documents from the store
• Record conversations or interactions with store personnel as evidence
• File a formal complaint with the District Consumer Commission within the prescribed time limit
• Approach the State Consumer Helpline for immediate grievance redressal
• Submit a written complaint to the store management documenting the incident and demanding resolution

If You Are the Victim

• Immediately refuse to provide personal information and state your legal rights clearly
• Ask for the store manager and demand written explanation for the data collection requirement
• Inform them about government guidelines prohibiting denial of services for refusing data sharing
• Document the entire incident with timestamps and witness details if available
• Seek alternative methods to complete your transaction without compromising personal data

How the Police Behave in Such Cases

Police typically treat such matters as civil consumer disputes rather than criminal cases unless there’s evidence of fraud or data misuse. They may direct you to consumer forums or cyber crime cells for privacy violations. However, if there’s systematic data collection without consent or evidence of data misuse, police may register an FIR under IT Act provisions and investigate the matter through specialized cyber crime units.

FAQs People Normally Have

• Can stores legally force me to share my mobile number? No, businesses cannot deny basic services for refusing to share personal contact information unless legally mandated.
• What compensation can I claim? You can claim damages for harassment, mental agony, and seek directions for policy changes at the consumer forum.
• Is this a privacy law violation? Yes, forced collection of personal data without valid business necessity violates data protection principles.
• Can I get refund without sharing details? Absolutely, legitimate business transactions should not require unnecessary personal information sharing.

What Evidence Is Required?

• Original purchase receipt and product exchange policy documents
• Audio or video recording of the conversation with store staff
• Written communication or emails with store management
• Witness statements from other customers who experienced similar treatment
• Screenshots of store’s written policies regarding data collection
• Documentation of any financial loss or inconvenience caused
• Expert testimony on data protection law violations if required

How Long Will the Investigation Take?

Consumer forum proceedings typically take 3-6 months for simple cases involving service denial or unfair trade practices. Privacy violation investigations by data protection authorities may take 6-12 months depending on complexity. Corporate internal grievance mechanisms usually respond within 15-30 days as per consumer protection guidelines, while legal proceedings may extend longer based on evidence presentation and counterarguments.

Advocate Sudhir Rao, Supreme Court of India