India: Directors In The Digital Age: Managing Personal Information Of Directors

Introduction

Due to the requirements of applicable laws, a company maintains various registers, returns, forms, documents and papers in its records. Some of these returns and forms are required to be submitted to the relevant authorities and are publicly available for inspection. This practice seems fine as it promotes transparency in dealing with the company. However, there is a concern for the directors of the company. Some of these publicly available forms comprises of the personal details of directors such as email id, phone number, date of birth, PAN card, Aadhar card, etc. These personal details can easily be accessed by any person. In this article, we will discuss on one of such forms i.e., form DIR-2

Form DIR-2: consent to act as director

As per the provisions of Companies Act, 2013 ('Act'), an individual to be appointed as a director in a company is required to provide his/her consent to act as director in form DIR-2 to the concerned company. The company in turn is required to file form DIR-2 with the Ministry of Corporate Affairs (''MCA') in e-form DIR-12 within 30 (thirty) days of the appointment of the individual as director.

Form DIR-2, inter-alia, contains personal details of the directors such as phone no, email Id, address, date of birth, permanent account number. Moreover, proof of identity and proof of address such as PAN card, passport, Aadhaar card, driving license, utility bill, bank statement are also required to be attached to form DIR-2.

Upon appointment of the director, once the company submits e-form DIR 12 to the MCA, the e-form DIR-12 becomes a public document and can be inspected by any person by paying a nominal fee.

Since, the personal details of directors including documents are publicly available on the MCA portal and can be accessed by any person, needless to say, that these documents and details can be easily misused.

Digital Personal Data Protection Act, 2023 ('Data Protection Act')

Although, not yet notified as law, the Data Protection Act provides that, the personal data means "any data about an individual who is identifiable by or in relation to such data". Therefore, the information and documents provided in form DIR-2 are personal data of such director under the Data Protection Act.

However, the Data Protection Act would not apply to-

As per the Act, the proposed director is under an obligation to provide form DIR-2 to the company and such company is under an obligation to file such form DIR-2 (in e-form DIR-12) to the MCA. On the other hand, MCA is required to make such e-form DIR-12 publicly available for inspection in terms of the provisions of the Act.

Concern of members catered by the MCA

Register of members maintained under the Act, has personal details of members such as email id, permanent account number, residential/office address. Such information, was allowed to be accessed by any person by paying a reasonable fee to the company.

However, in April, 2022, MCA amended the relevant rules to provide that, the personal details of the member i.e., email id, permanent account number, unique identification number, residential/office address, shall not be made available for inspection or for taking extracts or copies. It appears that the intent behind this move was to secure the personal data of members so that it cannot be misused by any person.

Conclusion

As the data privacy of the directors of the company, like its members, is also an important affair to be dealt with. Therefore, MCA should take necessary and appropriate steps by amending the requirement of form DIR 2 or the format of form DIR 2 in the interest of the directors in so far as their personal data is concerned.

Disclaimer: This publication is not intended to be a comprehensive review of all developments in the law and practice, or to cover all aspects of those referred to herein. This publication has been prepared for information purposes only and should not be construed as a legal advice. Although reasonable care has been taken to ensure that the information in this publication is true and accurate, such information is provided 'as is', without any warranty, express or implied, as to the accuracy or completeness of any such information.