Lok Sabha Question No. 3478 (UNSTARRED), answered on 2018-08-08
Subject: Privacy of User Data
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: T. RADHAKRISHNAN, KUNWAR HARIBANSH SINGH, SHRIKANT EKNATH SHINDE, PRITAM GOPINATH MUNDE, SUDHEER GUPTA, DHARMENDRA YADAV, SHIVAJI ADHALRAO PATIL, KUNWAR PUSHPENDRA SINGH CHANDEL, BIDYUT BARAN MAHATO, GAJANAN CHANDRAKANT KIRTIKAR, ANANDRAO  ADSUL, ASHOK SHANKARRAO CHAVAN, Shrirang Appa Barne, VIJAY KUMAR S.R., S. RAJENDRAN

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 3478

TO BE ANSWERED ON: 08.08.2018

## PRIVACY OF USER DATA

## 3478.   SHRI T. RADHAKRISHNAN:

KUNWAR HARIBANSH SINGH:

DR. SHRIKANT EKNATH SHINDE:

DR. PRITAM GOPINATH MUNDE:

SHRI SUDHEER GUPTA:

SHRI DHARMENDRA YADAV:

SHRI ADHALRAO PATIL SHIVAJIRAO:

SHRI KUNWAR PUSHPENDRA SINGH CHANDEL:

SHRI BIDYUT BARAN MAHATO:

SHRI GAJANAN KIRTIKAR:

SHRI ANANDRAO ADSUL:

SHRI ASHOK SHANKARRAO CHAVAN:

SHRI SHRIRANG APPA BARNE:

SHRI S.R. VIJAYAKUMAR:

SHRI S. RAJENDRAN:

Will  the  Minister  of  ELECTRONICS  AND  INFORMATION  TECHNOLOGY  be  pleased  to state:

- (a)  whether  huge  chunk  of  data  is  being  generated  on  smart  phone  and  if  so,  the  details thereof;
- (b) whether the data collated by mobile application over a period of time can be used to profile people which poses a risk to data privacy and if so, the details thereof;
- (c)  whether  the  existing  framework  for  protection  of  personal  data  of  telecom  consumer  is sufficient and if so, the details thereof and if not, the reasons for the same;
- (d) whether Telecom Regulatory Authority of India (TRAI) has made recommendation that all entities that process personal user data should be brought under a data protection framework and if so, the details thereof along with the response of the mobile operators thereto;
- (e)  whether  the  Government  had  set  up  a  committee  under  Justice  B.  M.  Srikrishna  to deliberate on a data protection framework for the country which has submitted its report to the Government and if not, the reasons for delay along with the time by which it is likely to be submitted;
- (f) whether entities controlling and processing user data do not have primary rights over the data and if so, the details thereof and the reaction of the Government thereto; and

(g) whether there is a need to spread awareness about data protection and privacy issues so that the users can take well informed decisions about their personal data and if so, the steps taken by the Government in this regard?

## ANSWER

## MINISTER OF STATE FOR   ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI S.S. AHLUWALIA)

(a):   Yes, Sir.  The data traffic per smart phone in India is currently estimated* to be 5.7 GB per month.

(b):  Mobile applications access user data after seeking explicit consent of the user.  The user always has the option to decide what permission to be given to enable application to access data, and such permission can also be modified /revoked. The report mentioned at (e) below proposes criminal liabilities on entities that violate privacy and profile people.

(c) and (d): As per the Recommendations made by Telecom Regulatory Authority of India, 'Privacy, Security and Ownership of the Data in the Telecom Sector' dated16th July 2018, There  are  a  number  of  applicable  legislation  and  policies  that  contain  provisions  with  a bearing on the right to privacy and data security in the telecom sector in India. These include:

-  IT Act, 2000: Sec 43A, Sec 69, Sec 69B, Sec 72A, Sec 67C, and
-  Sec 79.
-  IT Rules
-  Indian Telegraph Act, 1885: Sec 5 and Sec 26,
-  Indian Telegraph Rule 419A.
-  Unified License condition 37, 38, 39 and 40.
-  Guidelines, circulars, direction, and notifications issued by DoT and TRAI

The said recommendation states under 3.2 (a). Summary of recommendations - 'The existing framework  for  protection  of  the  personal  information/  data  of  telecom  consumers  is  not sufficient.  To  protect  telecom  consumers  against  the  misuse  of  their  personal  data  by  the broad  range  of  data  controllers  and  processors  in  the  digital  ecosystem,  all  entities  in  the digital ecosystem, which control or process their personal data should be brought under a data protection framework'.

*Ericsson mobility report- June 2018.

(e): Yes, Sir. Government proposes to bring out data protection legislation in the country. A Committee of Experts on Data Protection chaired by Justice Shri. B.N Srikrishna (Retd.) had been constituted to look into the aspects pertaining to Data Protection. The Committee has submitted its report along with draft Bill to Government on 27.07.2018.

(f):   Entities controlling and processing user data do not have primary rights over user data but their role is limited as a data fiduciary. This has also been stressed by the committee of Experts on Data Protection.

(g):  Yes, Sir. There is a need to spread awareness about data protection and privacy issues so that the users can take well informed decisions about their personal data. Towards this, the Ministry of Electronics & Information Technology  undertakes multiple awareness activities via CERT-In Awareness Programs & Information Security Education and Awareness (ISEA) Project.

********