The IRCTC official rejected the claims while speaking to ANI and said that consultants were being hired to improve existing businesses, not sell data, and advise on new business lines which can be adopted by IRCTC and Indian Railways in near future.
The Indian Railways Catering & Tourism Corporation Limited (IRCTC) has dismissed media reports claiming it is planning to monetise passenger and freight customer data. Several reports suggested the objective behind the same was to generate revenue up to ₹1,000 crore. The reports did rounds on social media platforms and received backlash from those advocating digital rights.
A senior official at the IRCTC confirmed to news agency ANI that the media reports were totally fictitious and that the company does not sell its data and there is no intention to do such things.
The official also said that IRCTC does not store any financial data of its customers on its system server, as at the time of online payment for its various services, control is passed on to the respective Payment Gateway or bank for the payment.
Reports had further claimed that a consultant of international repute was expected to study the data of passenger, freight and parcel business as well as any vendor-related data from applications of Indian Railways. The IRCTC official rejected the claims while speaking to ANI and said that consultants were being hired to improve existing businesses and advise on new business lines which can be adopted by IRCTC and Indian Railways in near future.
The IRCTC has not made any official comment on the same as of yet.
What the IRCTC tender claimed
According to the tender document allegedly sourced by news agency PTI, the IRCTC had chalked up a plan to study and use customer data including “name, age, mobile number, gender, address, e-mail ID, class of journey, payment mode, login or password,” in addition to behavioural data such as payment and booking mode, frequency of journey, etc.
Highly placed officials had later told PTI that the alleged tender was likely to be withdrawn “considering the fact that the Data Protection Bill has not been finalised”.
The document titled ‘The Scope of Work for Project A: For study of Monetization of Digital Data of Indian Railways(IR)’ reportedly stated that the consultant, once finalised, will be provided the details of applications and the data collected thereon for conducting the study for ‘Monetization of Digital Data of Indian Railways’.
“IRCTC envisages a revenue generation potential of ₹1,000 Cr through Monetization of its Digital Assets. IRCTC wishes to engage a consulting firm to help in identification, design, and development and roll-out of data monetization opportunities,” it stated, according to PTI.
The document also said that the consultant will study various Acts or laws, including the IT Act, 2000 and its amendments, user data privacy laws, including the General Data Protection Regulation and the current ‘Personal Data Protection Bill, 2018’, and accordingly, propose the business models for monetisation of digital assets. He would prepare a roadmap for data monetisation of the digital data collected at various customer-facing and vendor-related applications which include zonal railways, divisions, and other units like CRIS, and PSUs like IRCTC, Railtel, etc.
Several activists and NGOs had raised concerns over the tender and outlined its pitfalls on Twitter. “A profit maximisation goal will result in greater incentives for data collection, violating principles of data minimisation & purpose limitation. Past experiences from the misuse of Vahan database amplify fears of mass surveillance & security risks,” wrote Delhi-based Internet Freedom Foundation.
