Blog

A parliamentary panel has ordered representatives of the Indian Indian Railway Catering and Tourism Corporation (IRCTC) to brief the members of the committee on data security and privacy of citizens.

According to a notice posted on the website of Lok Sabha, the Standing Committee On Communications and Technology will be briefed by IRCTC on August 26. 

The meeting comes amidst concerns over IRCTC’s move to monetise its data assets. 

Earlier this month, the catering and ticketing arm of the Indian Railways floated a tender to generate INR 1,000 Cr from the data available with the public sector undertaking (PSU). 

While some media reports said that IRCTC would drop the plan, others said that the company would move ahead with the plan, but provide customers the option to opt out of the monetisation plan. 

Consultancy firms including EY and KPMG have reportedly expressed their interest in the data monetisation plan.

In the Expression of Interest (EoI) issued last week, IRCTC underlined plans to hire a consultant to monetise the treasure trove of data available with it, including name, age, gender, address, number of passengers, class of journey and payment mode. 

The proposal has come under fire and raised concerns about privacy and safety of data in the absence of data protection laws in the country. 

In a clarification, IRCTC later stated that the said consultant would be hired to monetise data within the ambit of the lT Act 2000 and its amendments, European Union’s GDPR (General Data Protection Regulation) and current ‘Personal Data Protection Bill 2018 of India.’ The tender was brought in a bid to augment IRCTC’s revenue.

The members of the panel are expected to grill IRCTC on the matter and document its stance. Headed by Member of Parliament (MP) Shashi Tharoor, the panel comprises 21 members from Lok Sabha and 4 from Rajya Sabha. 

Prior to the IRCTC briefing, the committee is also slated to hear the opinion of experts and stakeholders on issues related to digital platforms, technology, and the gig economy.

It must be noted that earlier this month, the government withdrew the Personal Data Protection Bill, 2021. While the government has said it would introduce a new Bill for data protection in the next session of the Parliament, the withdrawal of the Bill has further increased the wait for a robust law for protection of data in the country.