Answered by a Lawfarm Research Member, Arushi Malik:
Your question regarding whether your employee can hack into your personal email account or not will depend on the policy your company follows. Generally, it has been seen that employers monitor the mails or texts or calls on the systems provided to you by your employer, be it a computer or phone which has been provided to you by your company. So firstly one important question would be whether the system you are using has been provided to you by your company or not. If the answer is yes, then they can monitor the activities on your system.
The next question which will follow is the extent to which they can monitor the activities on your system i.e. can they look into the personal email account or not, can they use it against your not?
The answer to the second question as mentioned earlier will depend on your company policy and any implied consent which has been given by you, which the employees most of the time are not even aware of.
Now Hacking as per our Indian law is defined as “whoever with the intent to cause or knowing that he is likely to cause wrongful loss or damage to the public or any person destroys or deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means, commits hacking.”
The punishment for the offence of hacking is imprisonment up to 3 years or fine which may extend up to 2 lakh rupees, or with both.
As per this section your company’s action would not exactly amount to “hacking” in the legal sense but still accessing someone’s personal account is definitely a violation of privacy.
The only section dealing with privacy issues is Sec 66E of the Information Technology Act, 2008 which states that publishing or transmitting private area of a person without his or her consent is punishable with an imprisonment of 3 years or fine up to 2 lakh rupees or both. But this section is not applicable in your case.
In India there haven’t been many cases wherein the employer has hacked into the personal account of the employee. One case relating to hacking of personal account by an employer was wherein an Air India employee had filed a complaint with the Central Vigilance Commission (CVC) against one of its directors for hacking into his private email account. The Air India employee had received a notice from his company asking him as to why an action should not be initiated against him by the company. The company had produced certain document/transcripts which had been obtained through the chats/blogs which were a part of a discussion on the private forum of the cabin crew members. The Air India employee found it weird as to how can they access those chats which were a part of the private forum and it could not have been accessed without invitation. So, the employee lodged a complaint with the CVC. The complaint was filed under sec 66(C) and sec 66(D) of the Information Technology Act. The reason for the complaint was that any chat/blog/conversation outside the office premises in a private/closed forum cannot be construed as a violation of company rules by any stretch of imagination. It was also stated in the complaint that the private/closed forum is not accessible to general public at large and does not fall in the public domain and is outside the purview of the rules of the company.
Therefore, I would suggest you to file a complaint with the Cyber Crime Cell in your city. For filing a complaint with the cyber crime cell you will have to provide your name, email address and telephone number along with an application letter addressing the head of cyber crime investigation cell. You will also have to provide certain documents like server logs, the email account which was accessed by the company without your permission, list of suspects if you have any in mind supporting your complaint. You will also have to provide relevant information like what is compromised, when the system was compromised, why might have been the system compromised, etc.
Since we do not know any other details I would also suggest that you should clearly state that you were helping your friend using your personal email account and that too after the office hours. You should also prove that any information you shared was not going to affect your company with which you are currently employed as all these points will strengthen your case.
Sec 66(1) of the Information Technology Act, 2008
Sec 66(2) of the Information Technology Act, 2008
Naveeta Singh, “Boss hacked into my email a/c: AI worker”, DNA, 27 August, 2009, available at http://www.dnaindia.com/mumbai/report-boss-hacked-into-my-email-ac-ai-worker-1285460
(last visited on 8 April, 2016)