Lok Sabha Question No. 1698 (UNSTARRED), answered on 2015-12-09
Subject: National Encryption Policy
Ministry: COMMUNICATIONS AND INFORMATION TECHNOLOGY
Asked by: SUKENDER REDDY GUTHA, FAGGAN SINGH KULASTE, UDIT RAJ, K. ASHOK KUMAR, FAIZAL P.P. MOHAMMED, GEETHA KOTHAPALLI, NAGENDRA KUMAR PRADHAN

## GOVERNMENT OF INDIA MINISTRY OF COMMUNICATIONS AND INFORMATION TECHNOLOGY (DEPARTMENT OF ELECTRONICS & INFORMATION TECHNOLOGY)

## LOK SABHA UNSTARRED QUESTION NO. 1698

TO BE ANSWERED ON: 09.12.2015

## NATIONAL ENCRYPTION POLICY

## 1698 SHRI GUTHA SUKENDER REDDY:   SHRI FAGGAN SINGH KULASTE: DR. UDIT RAJ:  SHRI K. ASHOK KUMAR:  MOHAMMED FAIZAL: SHRIMATI  KHOTHAPALL GREETHA:  SHRI NAGENDRA KUMAR PRADHAN:

Will the Minister of Communications & Information Technology be pleased to state: -

- (a) whether the Government is contemplating to implement encryption policy in the country and if so, the details thereof along with the salient features of the policy;
- (b) whether there is opposition from various quarters on account of breach of   right to privacy and if so, the details thereof;
- (c) the mechanism put in place by the Government under the said policy to protect the private data from being misused by the hackers; and
- (d) the steps taken by the Government to ensure privacy of citizens across the country?

## ANSWER

## MINISTER FOR COMMUNICATIONS AND INFORMATION TECHNOLOGY (SHRI RAVI SHANKAR PRASAD)

(a): The Information Technology  Act 2000 provides for secure use of the Electronic Media and Promotion of E-Governance and E-Commerce, with prescribed modes or methods for encryption.  The encryption has been  recognized  by  the  Government  as  means  to  securing  data  /transactions  and  the      provision  in  the Information Technology Act 2000 enables the use of  encryption for such purposes. There is no proposal with the Government to implement an encryption policy breaching the right to privacy of public.

(b):  A  High  Level  Expert  Committee's  draft  recommendations  on  Encryption  Policy  were  put  up  on  the website of Department of Electronics and IT (DeitY) for public comments.  Government noted the public sentiments viz-a-viz the draft recommendations.  Government clarified that the draft recommendations are not the final view of the Government on the matter.  Further, Government took note of the ambiguity in some portions of the draft that may have led to misgivings.  Hence, the draft recommendations of the policy were  withdrawn.    Government  has  initiated  steps  to  revise  the  Encryption  policy  recommendations  with wide consultation with stakeholders.

(c): The encryption has been recognized by the Government as a tool for protection of   sensitive or private information from misuse by hackers, protecting and authenticating online transactions and ensuring integrity of  nationally  critical  information  systems  and  networks  /transactions    and  provision  in  the  Information Technology  Act 2000 enables the use of encryption for such purposes.

(d):    Section  43,  Section  43A  and  Section  72A  of  the  Information  Technology  Act,  2000  provides comprehensive legal framework for privacy and Security of data in digital form.  Sections 43 and 43A of the Act provides for compensation to be paid to the victim in case of unauthorized access of information and leakage of sensitive personal information respectively.  Section 43A also mandates that body corporate, who collect  personal  data  or  information  must  provide  privacy  policy  for  handling  of  or  dealing  in  personal information including sensitive personal data or information on their websites.  They are also required to implement  reasonable  security  practices  and  procedures  to  protect  the  information.  Indian  Computer Emergency Response Team (CERT-In) has also empanelled auditors to facilitate body corporate to audit their information technology infrastructure and implementation of security best practices.

********