Lok Sabha Question No. 2713 (UNSTARRED), answered on 2019-12-04
Subject: Selling of Private Information of Social Media Users
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Anil Firojiya

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 2713

TO BE ANSWERED ON: 04.12.2019

## SELLING OF PRIVATE INFORMATION OF SOCIAL MEDIA USERS

## 2713. SHRI ANIL FIROJIYA

Will the Minister of Electronics & Information Technology be pleased to state:-

- (a) whether instances of selling of private information of users through social networking sites have come to the notice of the Government;
- (b) if  so,  the  details  thereof  and  the  reaction  of  the  Government  thereto  along  with  the action taken by the Government in this regard; and
- (c) whether  the  Government  has  made  any  rule  to  prevent  the  misuse  of  shared  private information of users without their consent and if so, the details thereof?

## ANSWER

## MINISTER FOR  ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAVI SHANKAR PRASAD)

(a) and (b) : There are media reports about instances of unauthorized  use of personal data and data breaches of private information of users through social networking sites. Based on the media reports regarding data breach by Cambridge Analytica, Government had approached Cambridge Analytica as well as  Facebook separately  on 23.03.2018 seeking clarifications. Cambridge Analytica responded on 03.04.2018 that they do not have any Facebook data of Indian  citizens.  On  05.04.2018,  Facebook  informed the Government that data of estimated 562,455 Indian's may have been accessed by Cambridge Analytica through installations of the App developed by GSR and installed by Indians. As there were perceived inconsistencies, Government again approached both companies separately and asked Cambridge Analytica for additional details emphasizing that any data concerning Indians is required to be given due sanctity.

(c):   Section 43A and section 72A of the Information Technology (IT) Act, 2000 provides for  privacy  and  security  of  data  in  digital  form.  Section  43A  of  the  Act  provides  for compensation to be paid to the affected users in case of unauthorized access of information and leakage of sensitive personal information respectively. It mandates 'body corporate' to implement 'reasonable security practices' for protecting 'sensitive personal information' of individuals.  Section  72A  of  the  Act  provides  for  punishment  in  the  form  of  imprisonment upto 3 years and fine for disclosure of information in breach of the lawful contract.

Also, Information Technology (Intermediaries Guidelines) Rules, 2011 notified under section 79  of  the  IT  Act,  2000  require  that  the  intermediary  shall  observe  due  diligence  while discharging their duties and shall publish the rules and regulations, privacy policy and user agreement for access or usage of its computer resource by any person.

To  further strengthen personal data protection of user, Ministry of Electronics and Information Technology (MeitY) on 31 st July 2017 constituted a Committee of Experts under the Chairmanship of Justice B N Srikrishna, former Judge, Supreme Court of India, to look into all  aspects  relating  to  personal  data  protection.  The  committee  gave its  report on 27th July,  2018.  The  Committee  also  submitted  a  draft  Personal  Data  Protection  Bill.  Wide consultations were held on the draft bill and open feedback was invited on the contents of the Bill. These are currently being processed and it is proposed to table the Bill in Parliament.

********