Husband's bank records leaked in court: who pays the price?

She handed over his bank statements in court. The judge said the bank owes him money — not her.

It happened inside a maintenance case — the kind of bitter, grinding family dispute where every document becomes a weapon. A wife, fighting for financial support from her husband, walked into court with his personal bank records. She placed them before the judge. The statements showed his income, his spending, his financial life laid bare. The courtroom fell silent as the pages were turned. The husband didn't fight her. He fought the bank.

When the bank records hit the table

The case, Nirmalkumar Bagherwal v. Minal Bagherwal, began as a routine maintenance claim. The wife asked the court to order her husband to pay her monthly support. To prove his ability to pay, she needed evidence of his income. She produced his bank statements — digital records that showed exactly how much money moved through his accounts. The wife slid a manila envelope across the table. Inside, a stack of bank statements, each page stamped with the bank's logo.

Nirmalkumar Bagherwal did not deny the statements were accurate. Instead, he argued that the very act of obtaining and producing them violated his right to privacy. The bank, he said, had allowed his personal financial data to leak into a courtroom without his consent.

So he filed a separate application — not in the maintenance court, but before the Adjudicating Authority under the Information Technology Act, 2000 (the law that governs digital data and penalties for its misuse). He asked for compensation. Not from his wife. From the bank.

The question nobody had answered

Here was the puzzle: A wife uses her husband's bank statements in a legitimate court proceeding. The statements are relevant to the case. She did not hack his account or steal his password. She simply obtained records that the bank held. Who is responsible when private financial data ends up in open court?

Nirmalkumar Bagherwal argued that the bank had failed in its duty to protect his data. The bank, presumably, argued that it had done nothing wrong — the wife had obtained the records through some channel, and the bank was not responsible for how customers used information.

The Adjudicating Authority had to decide: under the IT Act, 2000, does a bank owe a customer compensation when its records are used without the customer's permission?

Why the bank was the real target

The authority looked at the relevant legislation — the IT Act, 2000 — and at master circulars from the Reserve Bank of India (RBI) that govern how banks handle customer data. These circulars are not optional suggestions. They are binding directions that tell banks exactly what they must do to protect the confidentiality of customer information. The file felt thin, but its implications were heavy.

The authority concluded that there was an "inversion of the right of privacy of the complainant." In plain language: the bank was supposed to guard the data. Instead, the data got out. The bank had failed in its duty.

But here is the crucial distinction the authority made. Minal Bagherwal had used the records in a court case — a legitimate legal proceeding. She was not the custodian of the data. She was a litigant who had obtained information that the bank was supposed to protect. The authority did not punish her for using evidence that was relevant to her case. It punished the institution that let the data escape.

The mixed compensation order

The Adjudicating Authority issued a mixed compensation order. Nirmalkumar Bagherwal was directed to pay a symbolic compensation — a small amount, essentially a token. The bank was directed to pay a much higher compensation — the real money. The stack of pages stamped with the bank's logo sat heavy on the table as the order was read aloud. The room fell into a thick silence; no one spoke, no papers rustled. Nirmalkumar Bagherwal's expression remained unreadable, his eyes fixed on the table.

This was the heart of the ruling: the institutional source of the data, not the person who used it in court, bears the primary liability. The bank held the records. The bank had the duty to protect them. The bank failed. The bank pays.

The wife, who merely produced evidence in her own maintenance case, was not the one who violated privacy. She was a litigant using available information. The bank was the gatekeeper that let the information out.

What this means for every bank customer

This verdict establishes a clear rule for any institution that holds personal digital data — banks, hospitals, telecom companies, insurance firms. If your private information ends up in a courtroom without your consent, the institution that held it can be held liable for substantial damages under the IT Act, 2000, for violating the right to privacy.

The ruling does not stop a spouse from using financial records in a maintenance case. That is a separate legal battle. What it does is put the cost of data leakage on the institution that was supposed to keep it safe. The authority's reasoning — that there was an "inversion of the right of privacy of the complainant" — now stands as a precedent.

The Adjudicating Authority's order also clarifies the subsequent legal consequence for an impleaded institutional source. Even if the evidence might be used in the primary dispute (matrimonial or maintenance), the institution responsible for holding and potentially divulging that information is held liable for substantial damages under the IT Act, 2000, for violating the right to privacy. The bank, as the institutional source from which the data originated, bore the heavier compensation. Nirmalkumar Bagherwal, who produced the records in the maintenance litigation, paid only a symbolic amount.

The case also highlights the parallel track of litigation. The compensation application under the IT Act, 2000, ran alongside the maintenance case. Minal Bagherwal, litigating for maintenance against her husband, produced certain personal digital records of Nirmalkumar Bagherwal on record. This led to the claim that it resulted in an inversion of the husband's right to privacy. Nirmalkumar Bagherwal claimed that the unauthorized access and production of his personal digital records violated his right to privacy. The adjudicating authority, after referring to the relevant legislation and master circulars from institutions like the RBI, concluded that there was indeed an "inversion of the right of privacy of the complainant."

The precise amounts of compensation — symbolic versus substantial — were not specified in the source narrative, but the distinction itself is the key legal takeaway. The bank paid the higher amount. Nirmalkumar Bagherwal paid a token. Minal Bagherwal was not ordered to pay anything.

This mixed compensation order sends a clear signal to every institution that holds customer data: your duty to protect that data does not end because a litigant finds a way to obtain it. If the data leaks, you pay. The gatekeeper, not the passerby, bears the cost.

THE PLAY: If your personal digital data is produced in court without your consent, file a compensation claim against the institution that held the data — not the person who used it.

The bank paid. The wife walked. Nirmalkumar Bagherwal got his privacy acknowledged — and the institution that failed him wrote the cheque.