In line with its larger plan to use “data as public good”, the government earned Rs 65 crore by selling in bulk the data of crores of vehicle-owners and driving license-holders, including data on insurance and tax paid.
On 4 July, the Economic Survey of India had made a spirited case for why Indian citizens’ data must be treated as a public good as opposed to a private good.
Just a few days later, on 8 July, Road Transport Minister Nitin Gadkari informed the Rajya Sabha that data of 25 crore vehicle registration records and 15 crore driving license records were sold to a total of 119 organisations – 32 government and 87 private entities.
This process of earning revenue from the sale of vehicle records was initiated in March 2019 under the Road Transport and Highways Ministry’s “Bulk Data Sharing Policy and Procedure”. Interestingly, the language of this policy echoed that of the Economic Survey.
Both the economic survey and this database sale by the Government appears to be a practice that is not just in violation of 9 supreme court judges who spoke in one voice, but a monumental insult of it.
“Public good conception of personal data is fundamentally at variance with the conception of privacy as a fundamental right,” said Prasanna S, a lawyer who assisted the petitioners in the right to privacy/Aadhaar cases in the Supreme Court .
Bulk Data Sale From VAHAN and SARATHI Databases
The policy justifies the sale of vehicle and license data by claiming that it will “benefit the country’s economy” and “support the transport and automobile industry.”
Along similar lines, the Economic Survey noted, “To ensure that the socially optimum amount of data is harvested and used, the government needs to step in.”
One way for the government to step in, according to the Economic Survey, is by “providing the data itself.”
And the government indeed has stepped in and provided the data itself.
The revenue of Rs 65 crore was from providing access to the ministry’s VAHAN and SARATHI databases, which contain digitised records of vehicle registration and driving licenses. VAHAN contains records pertaining to 2.58 crore vehicles.
“This is a brazen violation of informational privacy of vehicle owning citizens. The whole point of a nine-judge bench decision that ran to 500-odd pages (on the Puttswamy - right to privacy case) is that the judgment should help the State mend its ways,”said Prasanna S, a lawyer who assisted the petitioners in the right to privacy/Aadhaar cases in the Supreme Court .
What Kind of Info Are They Sharing?
Twenty-eight different types of info, to be precise, including:
- registration number
- engine number
- model name
- colour
- dealer’s name
- horse power
- financer’s name
- insurance company’s name
- insurance validity
- tax paid validity
Consent & Privacy Harms
The policy, however, appears to have been drafted without due consideration to the data privacy of those who own and/or drive cars and two-wheelers. This data pertaining to vehicles was made accessible without seeking the consent of vehicle-owners and license-holders.
DO THE CITIZENS OWN THIS DATA?
They do not. India is one of the few major democracies in the world without a national privacy and data protection framework. Therefore, there is no law yet to govern how the data of citizens is collected, shared, stored, or processed.
Even the draft Data Protection Bill that is yet to be tabled in Parliament says nothing about data ownership.
According to this draft Bill, while citizens may not be defined as “owners” of their own data, it specifies that their consent is necessary for processing any data.
Without a data protection law, therefore, citizens’ consent has not been sought before the sharing of this data.
To Merge Datasets or Not to Merge?
How exactly can the people’s privacy be harmed?
Even though the 28 data points do not include names, there’s a loophole: the ministry itself allows for owners’ names to be searched with license or registration numbers.
Therefore, once the identity of the vehicle owner is established, this dataset can be merged with other datasets to reveal a plethora of personal information, thereby compromising the vehicle owner’s privacy.
The ministry’s own circular admits that this is possible, as does the Economic Survey.
Highlighted below is what the Transport Ministry’s policy says about the merging of different datasets.
The Transport Ministry’s policy clearly warns that the merging of disparate datasets is harmful to individual privacy and places the onus to refrain from doing so on the organisation purchasing the data. If a purchasing organisation does merge databases in this way, the penalty is that they are debarred from the Transport Ministry’s database for three years.
However, a look at page 82 of the Economic Survey makes it clear that the survey itself is encouraging precisely that – the merging of disparate data sets.
In fact, it says the first characteristic of a “government-driven data revolution” is to get data “married with other data”, i.e the merging of datasets maintained by different government agencies.
Highlighted below is a section from the Economic Survey’s arguments on data as a public good.
Both the economic survey and this database sale by the Government appears to be a practice that is not just in violation of 9 supreme court judges who spoke in one voice, but a monumental insult of it.Prasanna S, lawyer
In sum, the government appears confused: the Transport Ministry acknowledges that this merging is a privacy risk and discourages data buyers from merging datasets, while the Economic Survey outlines the benefit to the government of merging databases and actively encourages it.
The government has now earned Rs 65 crore from the sale of citizens’ personal data, with no real punishment for merging datasets that could create detailed profiles of crores of vehicle-owners and license-holders.
(At The Quint, we are answerable only to our audience. Play an active role in shaping our journalism by becoming a member. Because the truth is worth it.)