The Additional Solicitor General (ASG) of India has conveyed to the Ministry of Electronics and Information Technology (MeitY) that the Central Bureau of Investigation (CBI) may conduct a preliminary enquiry against Cambridge Analytica for data breach.

The MeitY had recently asked for a legal opinion from the ASG on filing a first information report (FIR) against Cambridge Analytica under the ‘IT Act and the Rules therein’, a senior official at MeitY told BusinessLine .

“The ASG has said that the matter requires further investigation by appropriate agencies. Sincethe present case relates to the breach of IT Act, a Central legislation with pan-India ramifications, it will be administratively expedient if a single investigative agency such as the CBI investigates the matter,” the ASG has opined, the official pointed out.

Preliminary enquiry

The ASG, in his opinion, has said that the CBI may conduct a preliminary enquiry after following prescribed procedure under the CBI Manual.

“As soon as sufficient material disclosing the commission of a cognizable offence is available during the course of preliminary enquiry, a regular case should be registered against Cambridge Analytica and persons-in-charge of the company,” Vikramjit Banerjee, ASG, said in the letter seen by BusinessLine .

The ASG said that the company (Cambridge Analytic), and its directors, may also be investigated for ‘conspiracy under Section 120-B (criminal conspiracy)’ read with relevant offences under the IT Act. “Specific averments constituting the commission of offence will have to be made to implicate the directors of Cambridge Analytica,” the ASG observed.

As such, a violation of privacy rights, such as in this case, where user data was transferred without consent, entails deprivation of property the person has in these rights. Further, the ‘act of retaining’ such data by Cambridge Analytica to influence Indian voters in the free exercise of their franchise amounts to a wrongful gain under the Indian Penal Code (IPC), he said.

“With respect to vicarious liability of every person who, at the time the contravention was committed, was in charge of and was responsible to the company for the conduct of business of the company, it is advised that Section 85 of the IT Act (a person/company guilty of the contravention and liable for punishment) may be invoked for registering an FIR against such persons at the appropriate stage,” the ASG added in his opinion.

Last month, Minister of Electronics and IT, Ravi Shankar Prasad, had also asked the CBI to look into the issue and how the case could be brought under the ambit of the Indian IT Act.