Cloud-Based Messaging Services In India: Data Security Obligations
Suneeth Katarki, PARTNER AND Namita Viswanath, Senior ASSOCIATE INDUSLAW, PUBLISHED ON MONDAQ.COM, February 2016.
'Cloud Computing' refers to internet based computing that allows access to a pool or network of computing resources that are owned and maintained by a third party via the internet. There is an emerging trend of smartphone companies in India operating a cloud-based messaging service which routes messages sent between service users via the internet instead of the telecom operator's SMS gateway. For instance, smartphone company Xiaomi Technology India Pvt. Ltd. operates the MIUI cloud messaging service and Apple India Pvt. Ltd. operates the iMessage service. Similarly, messaging service applications like WhatsApp also provide an alternative way for users to send video and text messages using an internet connection, instead of the traditional SMS. These cloud-based messaging services have certain inherent benefits that include bypassing a telecom operator's text messaging charges, permitting use even when the user is outside the home network of the telecom operator and does not have roaming services activated, indicating whether a message has been delivered or read, accessing the phonebook of a user to identify other users of the same cloud-based messaging services and enabling simultaneous delivery of a message to all devices configured to a single account. However, it has been noticed that in the course of providing this service, personal information such as the device's IMEI number, customer's phone number, phone contacts and text messages received from users is often shared with a server located in a foreign jurisdiction. There is hence a need for any company operating such cloud-based messaging services in India ("Company" or "Companies") to comply with the data security obligations imposed by law. In India there is no strong regulatory regime which exclusively deals with cloud computing or the legal issues attached to it. However, certain provisions of the Information Technology Act, 2000 ("IT Act") may be applied to cloud computing.