IDMC LTD. Vs. ERNST & YOUNG LLP

JUDGEMENT

(1.) The present Consumer Complaint has been filed under Sec. 21(a)(i)of the Consumer Protection Act, 1986 (for short "the Act') against the Opposite Party seeking to direct the OPs:-

(2.) Brief facts of the case, as per the complainant, is that the Complainant and OP-1 to 3 have entered into an agreement and a Statement of Work ("the SoW') wherein the office bearers and representatives of OP-1 agreed to provide support for implementing the recommendations for sustainable growth to the Complainant under the project name 'Aarohan' ("the Project'). The scope of work covered under the said SoW, as duly agreed between the Complainant and OPs, comprised four modules, namely: (i) Support for strategy implementation; (ii) Support for operations improvement and cost reduction; (iii) Support for implementation of HR recommendations; and (iv) Compliance Management. The said SoW contained details relating to the services agreed to be provided by the OPs to the Complainant and was duly supplemented by General Terms and Conditions ("the T&C'), which were also agreed between the parties. These, inter-alia, enumerated the terms and conditions regarding mutual relationship and responsibilities of the contracting parties and terms related to confidentiality and data protection. It was agreed with reference to Sec. 25 of the T&C that neither of the parties may disclose to third parties the contents of this Agreement or information, except tax advice, provided by or on behalf of the other that ought reasonably to be treated as confidential and/or proprietary. It was further undertaken under Sec. 29 of the T&C, that OPs shall process personal data forming part of the information shared by the complainant as per the applicable law and professional regulations. The Complainant acted on the representation of OPs that they strive to keep in place the most effective data security practices and safeguard confidentiality with utmost seriousness. The Global Code of Conduct followed by OPs declares as follows: "We respect and protect confidential information obtained from, or relating to, our clients or third parties, as well as personal information about our people, in accordance with local law and professional standards.' Despite making stout claims regarding the services offered by the OPs, backed by robust practices to safeguard confidential client information, OP-1 and its office bearers/representatives acted in an utter negligent and callous manner while handling complainant's critical data/information, exposing its interests to severe and perpetual risk. During the course of engagement of OPs with the Complainant, a designated employee/ representative of OPs Mr. Shashank Rastogi, Senior Manager, IIC Performance Improvement, in an Email dtd. 27/2/2015, which was shockingly sent from his personal Email ID (shashankr@gmail.com), communicated a chain of Emails which contained crucial and highly confidential discussion related to the project. Further, on 14/10/2015, Mr. Shashank Rastogi vide Email informed the Complainant that several information/data was uploaded to a third-party cloud storage platform Google Drive (hereinafter "the Cloud') and shared a link to access the same. On the same date, Mr. Shashank Rastogi in his mail conveyed that the pen drive (containing the project work products and more importantly IDMC data and information) was being sent to the Complainant by post. Upon discovery of the breaches, the complainant on 15/10/2015 vide Email requested the OPs to take immediate action in the matter. Subsequently, on 19/10/2015, the Complainant again addressed the OPs regarding the incidents of breach of confidentiality vide an Email. In response, OPs instructed their employees to remove the data from the cloud. Despite these, the Complainant reiterated its concern regarding the breach of confidentiality at the hands of the OP on 28/10/2015 and 2/2/2015. Finally on 11/1/2016, the complainant served a legal notice on the OPs seeking the refund of the entire consideration paid by the Complainant in lieu of the deficiency in services rendered by the OPs, which constituted severe breaches of the confidentiality obligations undertaken by the OPs.

(3.) Upon notice, the complaint was forcefully resisted by the OPs by filing their written version contending that the complainant in the complaint claimed to be a consumer for certain alleged deficiency in service by OP. The claim of the complainant is contrary to the facts and documents on record as also the averments made in their own complaint. The complainant does not qualify as a consumer as the services were availed were purely for commercial purposes. The only aim of the task was with an aim and objective to develop their growth strategy, had engaged the services of OP-1 and an engagement agreement/ letter in that regard was signed on 10/9/2013. The scope of work in the said agreement was to develop a growth strategy for the complainant in line with their growth aspirations. As per engagement letter dtd. 10/9/2013, the OP agreed to pursue a structured approach comprising of three phases. The first phase was for internal assessment and industry analysis to gain an understanding of its future strategic direction. The OP agreed to map complainant's current operations and capabilities. Similarly, for industry analysis, the OP agreed to render their services for detailed assessment of current and potential market for the complainant. The OP also agreed to identify and research the potential opportunities and key future trends along with a competitive profile in such opportunities. The report with regards to the said agreement was submitted on 11/11/2013. In Phase-II of the engagement agreement dtd. 10/9/2013, the OP agreed to render their services for analysis to be executed in two steps, namely opportunity analysis and business model mapping. For opportunity analysis, the OP agreed that they would identify available opportunities in the market and prioritize them through a structured prioritization framework in discussion with the complainant. Similarly, for business model mapping, the OP agreed to render their professional services to map the business model of some of the large companies/competitors present in the focus product and customer segment. As part of the work done during Phase II, the OP identified and analyzed multiple sectors. In the discussions, the sectors for complainant's future growth focus were jointly prioritized. Sector-wise revenue and growth targets were also defined in phase II, and focus products/services and target clients were identified. OP submitted the report to the complainant on 16th & 17/12/2013. For Phase-III, i.e., for strategy formulation, the OP agreed to render professional services to develop a detailed plan to achieve business growth and commercial success. The OP developed the Strategy Blueprint covering (i) year-wise four-year revenue targets (ii) target market segments (iii) focus products and services (iv) potential requirement of JV partners (v) creating higher visibility and awareness for complainant in focus sectors; (vi) potential collaborators; (vii) need for realignment of sales force and distribution channel; and (viii) capital expenditure required. The OP completed the task vide letter dtd. 10/9/2013 and submitted the final report on 17/2/2014 and was paid for as per the agreement. Being satisfied with quality, the complainant enter into another agreement executed on 28/8/2014 for implementation of recommendations for sustainable growth of the complainant in line with growth strategy developed in the first engagement dtd. 10/9/2013. It is this subsequent agreement which is the matter of this complaint. The complainant deliberately did not disclose the factum of having executed an agreement at an earlier point of time and availing services in terms of engagement letter dtd. 10/9/2013. The scope of work in engagement letter dtd. 28/8/2014 comprised of four distinct Modules namely, (i) support for strategy implementation, (ii) support for operation improvement and cost reduction, (iii) support for implementation of HR recommendations, and (iv) compliance management. Upon request of their MD, all the deliverables for Modules I, II, and III were meticulously collated and presented to the complainant on a shared folder on their server and subsequently via an encrypted and password protected pen-drive DVD, which were duly received by the complainant on 19/10/2015, as evidenced by both the tracking report and the letter dtd. 19/11/2015. The OP contended that it is manifestly evident that they rendered services in accordance with terms of engagement and succeeded as per earlier engagement letter dtd. 10/9/2013. The narration of facts unequivocally demonstrate that their services was commercial use.