Lok Sabha Question No. 4613 (UNSTARRED), answered on 2021-03-24
Subject: Use of Data by Third Party Apps Without Consent
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: T.N. Prathapan, Narayana Swamy Abbaiah, Aparupa  Poddar

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED Diary No. 4613

TO BE ANSWERED ON: 24-03-2021

## USE OF DATA BY THIRD PARTY APPS WITHOUT CONSENT

## 4613.     SHRI T.N. PRATHAPAN: SHRI A. NARAYANA SWAMY: SHRIMATI APARUPA PODDAR:

Will the Minister of Electronics and Information Technology be pleased to state:

(a) whether the Government is aware of the fact that certain third party apps permitted by common apps take and use data provided by the users without direct consent;

(b) if so, the details thereof and the reaction of the Government thereto along with the steps taken by the Government in this regard;

(c) whether the Government is aware that e-commerce websites use certain undisclosed, unidentifiable 'cookies' that breaches the data privacy of users and if so, the details thereof and the reaction of the Government thereto ; and

(d) the steps taken by the Government in this regard to ensure the protection of  Right to Privacy under Article 21 of the constitution?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI SANJAY DHOTRE)

(a) to  (d):  Cyber  Space  is  a  complex  environment  of  people,  software,  hardware  and  services  on Internet.  With  a  borderless  cyberspace  coupled  with  the  possibility  of  instant  communication  and anonymity, while collecting user data without taking direct consent on App or Websites using cookies or otherwise, the potential for misuse of cyberspace for illegal activities is immense. Any App/website created  from  anywhere  in  the  world  and  made  available  through  Internet/AppStore  can  be  accessed anywhere.  Many  of  such  Apps/websites  tend  to  collect  personal  data.    With  such  collection  and processing of data there is always a danger regarding possible misuse and privacy risk for users.

The Apps/websites are either body corporate or Intermediaries as defined in the IT Act, 2000. Section 43A  of  the  Information  Technology  Act,  2000,  applies  to  the  Apps/Websites  and  provides  for compensation to be paid to the victim in  case  of  unauthorized  access  of  information  and  leakage  of sensitive  personal  information  respectively.  It  mandates  'body  corporate'  to  implement  'reasonable security  practices'  for  protecting  'sensitive  personal  information'  of  individuals.  The  Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules,  2011  notified  under  this  section  defines  sensitive  personal  information  and  also  mandate  that body corporate must provide policy for privacy and disclosure of information, so that user is well aware of the type of personal data collected, purpose of collection and usage of such information. The rules also specify mode of collection of information, disclosure of information, transfer of information, etc.

The App/website, as an intermediary, are required to follow certain due diligence as specified in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 notified under the IT Act. This includes publishing of user agreements, terms and conditions and privacy policy of their platform.

Informational  privacy  is  a  fundamental  right  and  Government  respects  this.  The  Personal  Data Protection Bill, 2019 is with the Joint Committee of Parliament. ********