Lok Sabha Question No. 1758 (UNSTARRED), answered on 2017-07-26
Subject: Data Protection
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: JYOTIRADITYA MADHAVRAO SCINDIA, NINONG ERING

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS & INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 1758

TO BE ANSWERED ON: 26.07.2017

## DATA PROTECTION

## 1758.   SHRI JYOTIRADITYA M. SCINDIA: SHRI NINONG ERING:

Will  the  Minister  of  ELECTRONICS  AND  INFORMATION  TECHNOLOGY  be  pleased  to state:

- (a)    whether there exist adequate measures for protection of sensitive data, especially for vulnerable groups such as children and minority groups and if so, details thereof;
- (b)    the number of cases of data breach and leakage arising out of availability of Aadhaar data;
- (c)    whether the Union Government is mulling a new data protection law to protect personal data of citizens and if so, the details in this regard;
- (d)    whether the incidents of leakage of personal data of citizens particularly from Aadhaar have increased in the past few months resulting in cyber crimes;
- (e)     if so, the details thereof and whether the Government has decided to set up a cross functional committee to check cyber crimes due to leakage of personal data; and
- (f)      if so, the details in this regard?

## ANSWER

## MINISTER OF STATE FOR  ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI P.P. CHAUDHARY)

(a): Unique Identification Authority of India (UIDAI) is fully alive to the need to maintain highest level of data security and is deploying the necessary technology and infrastructure. The architecture of Aadhaar ecosystem has been designed to ensure privacy, non-duplication, data  integrity  and  other  related  management  aspects  of  security  in  Aadhaar  database. Security is an integral part of the system from the initial design to the final stage. Security of Aadhaar data is monitored at  all the times i.e.  at  rest,  in  transit  and  in  storage.  Privacy  of personal data is fully ensured, without sacrificing the utility of the project. UIDAI has been declared ISO 27001:2013 certified by STQC with respect to Information Security which has added  another  layer  of  information  security  assurance.  In  pursuance  of  sub-section  (1)  of Section 70 of the IT Act 2000, UIDAI data has also been declared as protected system by National Critical Information Infrastructure Protection Centre.

Additionally, various policies and procedures have been defined clearly which are reviewed and updated continually thereby appropriately controlling and monitoring any movement of people, material and data in and out of UIDAI premises, particularly the data centres. Further, strengthening of security of data is an ongoing process, and all possible steps are being taken in this regard. Chapter VI (Protection of Information) of The Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act, 2016 ('The Aadhaar Act') and the

Aadhaar (Data Security) Regulations, 2016 framed there under have been specifically drafted keeping in account the various security requirements in respect of data collected by UIDAI.

Aadhaar data has not been categorised on the basis of age-group, religion, caste, community, class,  ethnicity,  income,  health  etc.  of  applicants.  UIDAI  data  protection  infrastructure protects all the data collected by UIDAI and is not specific to groups.

In addition to above, the Information Technology (IT) Act, 2000 provides legal framework for data protection. Section 43A of the Information Technology (IT) Act, 2000 establishes a legal framework for data privacy protection in India. The section provides for compensation to be paid to the victim in case of unauthorized access of information and leakage of sensitive personal  information  respectively.  It  mandates  'body  corporates'  to  implement  'reasonable security practices' for protecting 'sensitive personal information' of individuals.

(b):   There are no incidents reported of breach of Aadhaar data.

(c):  Ministry of Electronics & Information Technology is working on a framework for Data Protection Law to protect personal data.

(d) and (e):   There has been no leakage of Aadhaar data from UIDAI. Government has not set up any   cross functional committee to check cyber crimes.

(f):   Does not arise.

*******