Lok Sabha Question No. 4805 (UNSTARRED), answered on 2023-03-29
Subject: Theft Cases of Personal Data
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Kotagiri Sridhar

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 4805

TO BE ANSWERED ON: 29.03.2023

## THEFT CASES OF PERSONAL DATA

## 4805.   SHRI SRIDHAR KOTAGIRI:

Will the Minister of Electronics and Information Technology be pleased to state:

(a)  whether  the  Government  is  aware  of  the  various  cases  of  personal  data  theft  that  have happened during the last two years;

(b)  if  so,  the  details  thereof  along  with  the  steps  taken  by  the  Government  to  protect  the personal  data  of  the  citizens  and  punish  the  perpetrators  indulging  in  data  theft  until  such statute is enacted and implemented; and

(c)  the  estimated  timeline  by  which  the  Government  proposes  to  introduce  the  law  on personal data protection?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

(a):  Government is committed to ensure that Internet in India is Open, Safe and Trusted and Accountable  for  its  users.  With  emergence  of  new  technology  and  rise  in  the  usage  of Internet,  the  growing  risk  to  digital  data  in  the  cyberspace  is  a  global  phenomenon,  and Government is fully cognizant of the same.

As per  the  information  reported  to  and  tracked  by  Indian  Computer  Emergency  Response Team (CERT-In) a total of 31 and 40 data breach incidents, involving personal data  were observed during the years 2021 and 2022 respectively.

(b):  Government  has  taken  following  measures  to  enhance  the  cyber  security  posture,  for protection of digital data:

- (i) The  Indian  Computer  Emergency  Response  Team  (CERT-In)  coordinates  incident response  measures  with  affected  organisations,  service  providers,  respective  sector regulators  and  law  enforcement  agencies,  and  notifies  the  affected  organisations regarding cyber incidents, along with remedial actions to be taken.
- (ii) CERT-In issues alerts and advisories on an ongoing basis regarding the latest cyberthreats/vulnerabilities and countermeasures to protect computers and networks.
- (iii) CERT-In regularly conducts training programmes for network and system administrators  and  chief  information  security  officers  of  government  and  critical sector organisations, regarding securing the information technology infrastructure and mitigating cyber-attacks. A total of 42 training programmes were conducted, covering 11,486 participants, during the years 2021 and 2022.
- (iv) Government websites and applications are audited with respect to cybersecurity and compliance with the Government of India Guidelines for Websites, prior to hosting.
- (v) CERT-In  has  empanelled  150  security  auditing  organisations  to  support  and  audit implementation of Information Security Best Practices.
- (vi) CERT-In  operates  an  automated  cyber  threat  exchange  platform  for  proactively collecting, analysing and sharing tailored alerts with organisations for proactive threat mitigation actions by them.
- (vii) CERT-In  operates  the  Cyber  Swachhta  Kendra  (Botnet  Cleaning  and  Malware Analysis Centre) to detect malicious programs and free tools to remove the same, and to provide cybersecurity tips and best practices for citizens and organisations.
- (viii) Cybersecurity mock drills are being conducted to enable assessment of cybersecurity posture and preparedness of organisations in the government and critical sectors. 74 such drills have so far been conducted by CERT-In, in which 990 organisations from various States and sectors participated.
- (ix) Security  tips  are  published  for  users  to  secure  desktops  and  mobile  phones  and  to prevent phishing attacks.
- (x) CERT-In organised various events and activities for citizens during Safer Internet Day on 7 February 2023 and Cyber Security Awareness Month in October 2022 by posting security tips using posters and videos on social media platforms and websites. CERTIn, in association with  the  Centre  of  Development  of  Advanced  Computing, conducted an online awareness campaign for citizens, covering topics such as general online safety, social media risks and safety, mobile related frauds and safety, secure digital payment practices, etc. through videos and quizzes on MyGov platform.

(c):  The Ministry of Electronics and Information Technology has prepared a draft Bill, titled 'The  Digital  Personal  Data  Protection  Bill,  2023'  covering  digital  personal  data.  Extensive consultation on the draft Bill has been undertaken to generate necessary feedback to formulate the provisions of the related legislative proposal.

*******