2014 (4) TMI 1326 - HC - SEBI

SEBI can obtain CDRs from telecom providers under statutory authority but must follow mandatory privacy safeguards

The Bombay HC held that SEBI has statutory authority under the SEBI Act to obtain CDRs and tower location data from telecom service providers, but this ... Power of SEBI to call for Call Data Records (CDRs) and details of tower location from Telecom Service Providers (TSP) - disclose the names of its officials who had called for such information from TSP and to take necessary action against such officials - Whether action of calling for CDRs from TSP by SEBI violates and infringes the fundamental right of privacy available to citizens of India? - HELD THAT:- There can be no dispute that the SEBI is authorized under the SEBI Act to call for CDRs from the TSP. However, this power is capable of misuse and can violate a citizen's right to privacy guaranteed by Article 21 of the Constitution. Therefore, it is made clear that such a power cannot be exercised by SEBI for conducting a fishing enquiry. It cannot be a blanket power to hunt out information without any pending inquiry or investigation. This power can only be exercised by SEBI in respect of any person against whom any investigation or enquiry is being conducted. Further,such information can be called for only by an officer duly authorized by SEBI to call for information with regard to CDRs from the TSP The provisions of Section 11(1), 11(2)(i) & (ia) (as amended by Ordinances promulgated by President of India on 16 July 2013, 16 September 2013 and 28 March 2014), Sections 11(3), 11C(3) and 11C(8) of the SEBI Act confer powers on SEBI to call for information and record of CDR of Tower Location from Telecom Service Providers, whether in public sector or in private sector. However, such power is to be exercised after complying with the following safeguards: (i) such CDRs or information regarding tower location can be called for only in respect of the person against whom any investigation or enquiry is being conducted by SEBI, (ii) the information may be called for only by an officer who is duly authorized by SEBI as per the delegation order, (iii) before calling for such information, the opinion of such authorized officer should be recorded in the file indicating application of mind to the effect that CDRs and/or information regarding tower location would be relevant for any investigation or enquiry by SEBI in respect of any transaction in securities, and (iv) the CDRs of any such subscriber and information regarding tower location is a matter of confidentiality and privacy and therefore such privacy cannot be invaded except in accordance with law. In our opinion, therefore, the safeguards indicated above are very important and mandatory and SEBI shall henceforth scrupulously observe the same before calling for any CDRs and/or information regarding tower location. We also make it clear that we are rendering this decision in light of the provisions of the SEBI Act as amended by Ordinances issued by President of India on 16 July 2013, 16 September 2013 and 28 March 2014. If any CDRs or information regarding tower location have been called for any period not covered by above Ordinances, we do not express any opinion as in this public interest litigation, the petitioner Council cannot espouse the cause of persons whose CDRs have been called for by SEBI for the purposes of investigation or enquiry in respect of any transaction in securities. PIL is accordingly disposed of in the above terms. Issues Involved:1. Power of SEBI to call for Call Data Records (CDRs) from Telecom Service Providers (TSP).2. Alleged violation of the fundamental right to privacy.3. Applicability of Section 5(2) of the Indian Telegraph Act, 1885.4. Safeguards necessary to prevent misuse of power by SEBI.Detailed Analysis:1. Power of SEBI to Call for CDRs:The primary issue in this case is whether the Securities and Exchange Board of India (SEBI) has the authority to request Call Data Records (CDRs) from Telecom Service Providers (TSPs). The petitioner argues that SEBI, being a statutory body under the SEBI Act, lacks the explicit power to call for CDRs, as TSPs are not associated with the securities market nor established under a Central, State, or Provincial Act. The petitioner further contends that the absence of specific legislative authority makes SEBI's actions illegal.In response, the court analyzed the provisions of the SEBI Act, particularly Sections 11(1), 11(2)(i), 11(2)(ia), and 11C(3), which empower SEBI to call for information from any person or entity if deemed necessary for investigations related to securities. The court noted that these provisions, especially after amendments by ordinances, allow SEBI to call for information from 'any person,' which includes TSPs. The court also referred to the Supreme Court's interpretation in Sahara India Real Estate Corporation Limited v. SEBI, emphasizing SEBI's broad powers to protect investors and regulate the securities market.2. Alleged Violation of the Fundamental Right to Privacy:The petitioner claimed that SEBI's actions infringe upon the fundamental right to privacy under Article 21 of the Constitution. The court acknowledged that while SEBI is authorized to call for CDRs, such power must be exercised with caution to prevent any breach of privacy. The court emphasized that SEBI's power cannot be used for fishing inquiries and must be limited to cases where an investigation or inquiry is already underway.3. Applicability of Section 5(2) of the Indian Telegraph Act, 1885:The petitioner argued that SEBI's actions are prohibited under Section 5(2) of the Indian Telegraph Act, which restricts unauthorized interception of messages. The court clarified that this provision pertains to intercepting or prohibiting the transmission of messages and does not apply to the collection of static information like CDRs. Therefore, SEBI's request for CDRs does not violate the Telegraph Act.4. Safeguards to Prevent Misuse of Power:To address concerns about potential misuse of power, the court outlined several safeguards SEBI must observe when calling for CDRs:- CDRs can only be requested for individuals under investigation or inquiry by SEBI.- Only officers duly authorized by SEBI can request such information.- The authorized officer must record their opinion, indicating the necessity of obtaining CDRs for the investigation.- The confidentiality and privacy of individuals must be respected, ensuring that such requests comply with the law.The court mandated that SEBI adhere strictly to these safeguards to protect individuals' privacy rights.Conclusion:The court concluded that SEBI is empowered under the SEBI Act, as amended by the ordinances, to call for CDRs from TSPs, provided it complies with the outlined safeguards. The judgment reinforces SEBI's broad authority to regulate the securities market while ensuring that individuals' privacy rights are not infringed upon. The public interest litigation was disposed of in these terms.