Lok Sabha Question No. 1908 (UNSTARRED), answered on 2019-07-03
Subject: Leaks and Breaches of User Data
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Santokh Singh Chaudhary

## GOVERNMENT OF INDIA

## MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UN-STARRED QUESTION NO.  1908

TO BE ANSWERED ON: 03.07.2019

## LEAKS AND BREACHES OF USER DATA

## 1908.    SHRI SANTOKH SINGH CHAUDHARY:

Will the Minister of  ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether the Government is aware of the reported leaks and breaches of user data in various companies;
- (b) if so, the details  thereof and reaction of the Government thereto;;
- (c) whether the Government proposes to punish companies for breach of user data and if so, the details thereof and if not, reasons therefor;
- (d) whether the Government is considering any legislative proposal to enhance the security and privacy of users on the Internet and if so, the details thereof; and
- (e) whether the Government has asked the companies to take steps for  protection of the user data and if so, the details thereof and if not, the reasons therefor?

## ANSWER

## MINISTER FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAVI SHANKAR PRASAD)

(a) and (b): Yes, Sir.  Few instances of data breaches and leaks of user data by various companies were reported in the media. Government took notice of reports about leakage of data by Facebook and Cambridge Analytica, and in responses to notices sent to them, Facebook conveyed that there had been unauthorised data leakage by Cambridge Analyitica. However, since the reply given by Cambridge Analyitica was not adequately convincing, CBI has been asked to investigate this matter with  regard  to  possible  misuse  by  Cambridge  Analytica.  In  addition,  one  incident  of  breach  of personal data of Indian users from a social media company was reported to the Indian Computer Emergency  Response  Team  (CERT-In).  As  per  information  available  external  actors  exploited vulnerability in the form of software bugs impacting a feature provided for users on a social media platform.  This  allowed  unauthorised  access  to  users'  account  and  information.    The  Indian Computer Emergency Response Team (CERT-In) issued advisories to users regarding best practices to be followed for protection of account information while using Social Media.

(c) to (e) : Yes,  Sir. Government is considering bringing data protection legislation in the country to strengthen  the  protection  of  personal  data.  A  comprehensive  legislation  on  data  privacy  is  under formulation.  The  Government  constituted  a  committee  of  expert  on  data  protection,  chaired  by Justice  (Retd)  B.N.  Srikrishna,  Supreme  Court  of  India  to  study  various  issues  relating  to  data protection  and  come  out  with  Data  Protection  Bill.  The  said  committee  has  brought  out  a  draft Personal Data Protection Bill (PDPB) on which consultations have been conducted and the bill is intended to be placed in parliament soon. The Bill seeks to bring in place a culture of privacy by design and promoting concepts such as consent framework, purpose limitation, storage limitation, and data  minimization  among  various  other  privacy-oriented  concepts.  It  also  proposes  Penalties and compensation for violation of the provisions.

******