Ola, Private Banks Bought Citizen Driving Licence Data From Govt

SUMMARY

Response to an RTI enquiry revealed the names of the companies that purchased data

25 Cr vehicle registration records and 15 Cr driver licences were sold as part of the data

30 public and private banks also among the buyers

The Indian government has sold data from the citizen Vahan database, vehicle registration data which comprises 25 Cr vehicle registration records, along with Sarathi database of 15 Cr driving licences to over 140 private companies and public institutions.

The data is managed by the ministry of road transport and highways. Transport minister Nitin Gadkari had revealed the sale of this data on July 8. However, the list of buyers has come out in the public now. These buyers range from automobile and cab hailing services to private banks and public banks, including Mercedes, Ola, ICICI Bank, State Bank of India, RTI filed by Medianama revealed.

Out of the 142 companies, 127 are private companies and 15 are government bodies. The breakup includes 30 public and private banks, 19 financial organisation, 20 logistics companies and five major automobile manufacturers.

The automobile sector, who bought these data, include some big names such as Mercedes, Toyota, Volkswagen, Nissan and BMW India Finance and Tata Finance. On the other hand, Axis Bank, Punjab National Bank, YES Bank, State Bank of India (SBI), ICICI Bank and Citibank, among others are some of the banks using the data.

Buying Data Since 2014

The government has been selling the data from 2014, even though the bulk data sharing policy was updated on March 2019. The policy is applicable to 28 different details of data related to vehicle registration certificate and driving licences. Any company, whose 50% shares are owned by Indian citizens, is eligible to purchase the data from the government for INR 3 Cr in the fiscal year 2019-2020.

Under the policy, the bulk data will be revealed in an encrypted format and can be accessed only through a public key of the purchasing organisation. The organisations or companies acquiring this data are required to carry out security audits.

Any misuse of the data will be liable for any permissible action under IT Act and any other applicable law. In addition, these companies will be barred from using this data for a period of three years.

The Cost Of Driver And Vehicle Data

In 2014, the government has earned INR 600 Cr through the sale of the database, which was the year when the sale was officially started.

The RTI response also revealed that the government has made INR 68 Cr by selling access to the database between 2014 and 2019. This year alone, the government managed to make INR 21 Cr.

Privacy Concerns

It is unclear if the government has taken consent from citizens before selling the driver and vehicle data. Last year, Justice BN Srikrishna Committee report on the draft Personal Data Protection Bill 2018 had defined “personal data” and “sensitive data”.

According to the definition, any data of a natural person which allows “direct or indirect identifiability” is personal data. Sensitive personal data includes financial data, biometric data, religious and political leaning, etc.

The data currently shared by the ministry comes under personal data, and it is still not clear what information has been shared with the buyers, and to what extent it has been used.