Lok Sabha Question No. 153 (STARRED), answered on 2019-02-13
Subject: Selling of Private Information
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: RAKESH SINGH

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA STARRED QUESTION NO.*153

TO BE ANSWERED ON: 13.02.2019

## SELLING OF PRIVATE INFORMATION

## *153 SHRI RAKESH SINGH:

Will the Minister of Electronics & Information Technology be pleased to state:-

- (a) whether selling of private information of users by  social networking sites has come to notice of the Government;
- (b) if so, the details thereof;
- (c) whether the Government has made any rule to prevent the misuse of sharing of private information of users without their consent;
- (d) if so, the details thereof; and
- (e) whether the Government has taken any action to deal with the said issue and if so, the details thereof?

## ANSWER

MINISTER FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAVI SHANKAR PRASAD)

- (a) to (e): A Statement is laid on the Table of the House.

## STATEMENT REFERRED TO IN REPLY TO LOK SABHA  STARRED QUESTION NO.*153 FOR 13.02.2019  REGARDING SELLING OF PRIVATE INFORMATION

………

(a) and (b): No such instance/ report has come to the notice of Government. There had been media  reports  about  leakage  of  personal  data.  The  government  took  notice  of  reports  about leakage of data by Facebook and Cambridge Analytica, and in response to notices sent to them, these companies have claimed that there had been no misuse. However, since the reply given by Cambridge  Analytica  was  not  adequately  convincing,  CBI  has  been  asked  to  investigate  this matter with regard to possible misuse by Cambridge Analytica.

(c) and (d):  Section 43A and section 72A of the Information Technology Act, 2000 provides for privacy and security of data in digital form. Section 43A provides for compensation to be paid to the  victim  in  case  of  unauthorized  access  of  information  and  leakage  of  sensitive  personal information  respectively.  It  mandates  'body  corporates'  to  implement  'reasonable  security practices' for protecting 'sensitive personal information' of individuals. Section 72A of the Act provides for punishment for disclosure of information in breach of the lawful contract. Further, Information Technology (Intermediary Guidelines) Rules 2011 notified under Section 79 of the IT Act, 2000 require that the Intermediaries shall observe due diligence while discharging their duties and shall publish the rules and regulations, privacy policy and user agreement for access or usage of its computer resource by any person.

(e):    To further strengthen personal data protection of user, Government had set up a Committee of  Experts  under  the  Chairmanship  of  Justice  (Retd.)  Shri  B  N  Srikrishna  to  prepare  a  data protection  framework  and  work  out  the  Data  Protection  Bill.  The  Srikrishna  Committee deliberated on various issues and brought out a White Paper on Data Protection that laid down the principles. Thereafter, the Committee submitted its report along with draft Bill to MeitY. The report and the draft Bill were placed in the public domain and comments were sought, feedback has been received. Steps are afoot to bring about data protection legislation.