Will govt monetise traveller data in absence of Data Protection Law?

The state-owned Indian Railway Catering and Tourism Corporation (IRCTC) has floated a tender to hire a consultant for the process of digital data monetisation for Indian Railways.

The stated objective of IRCTC is to generate revenue to the tune of Rs 1,000 crore and the consultant will be onboarded to study the data of passenger, freight & parcel business as well as any vendor-related data from applications of Indian Railways. The task essentially is to monetise ticketing data, which the organization has in abundance.

In addition to that, the customer data that will be studied or crunched will include the name, age, mobile number, gender, address, e-mail address, number of passengers, class of journey, payment mode, login ID and password, in addition to behavioural data such as payment & booking mode, frequency of journey et al.

This move however hasn’t gone down well with internet and data protection crusaders who have claimed that in the absence of a data protection law, such a move would violate the privacy of people by putting their personal data at risk.

The Centre close to a fortnight back had withdrawn the Data Protection Bill, which was introduced in 2019 after debating and backing for years, with an aim of re-introducing it in the next Budget Session of the Parliament. The Centre said that it is hopeful that the new draft will fit "into the comprehensive legal framework with reference to the suggestions made by the Joint Committee of Parliament (JCP)."

"Personal Data Protection Bill has been withdrawn because the JCP recommended 81 amendments in a bill of 99 sections. Above that, it made 12 major recommendations. Therefore, the bill has been withdrawn and a new bill will be presented for public consultation," said Union minister Ashwini Vaishnaw.

One of the proposals of the Bill was to regulate "non-personal data", a term for data viewed as a critical resource by companies that analyse it to build their businesses. In response, the JCP suggested that such "non-personal data" should be included in the purview of the Privacy Bill. To put it simply, a certain section of the now-defunct Bill had proposed the usage of personal data without the explicit consent of citizens.

Also Read: IRCTC net profit jumps 196% in June quarter; revenue zooms 251%