The Ministry of Road Transport & Highways (MoRTH) sold the country’s entire vehicle registration database to a private Indian company, without any concern for data privacy and security; this company in turn which shared this sensitive information with a German company, says The Wire in a series of reports.
According to one report
, "The deal flew completely under the public radar. The government let the deal linger on for a long stretch despite officials in the ministry flagging concerns over lack of ‘price discovery’ – a bureaucratic phrase to warn that data had been sold cheaply. Put simply, price discovery is a process that involves affixing the price of a security, asset, or commodity. In this case, it is the vehicular data. They concluded that the contract was stacked 'heavily in favour of the customer'."
Quoting from information obtained under the Right to Information (RTI) Act, the report says, the September 2014 deal, in which vehicle registration data was sold to an auto tech solutions company called Fast Lane Automotive Pvt Ltd (FLA), faced several objections from government officials. "Yet, it took the ministry nearly two years to put an end to the controversial deal. Till date, FLA continues to have commercial access to the data that was sold under this rescinded contract with the government," says the report.
A second report from The Wire
is more shocking and became known only when the German company refused to delete data that it had received from Fast Lane Automotive after the deal between the two went downhill.
Documents obtained by Srinivas Kodali, an independent researcher on data governance, and The Reporters’ Collective through RTI queries show nearly two years after the MoRTH-Fast Lane Automotive contract was signed, officials realised: “There [are] security issues and data leakage possibility”.
The realisation came after Fast Lane Automotive informed the ministry it was engaging with a German firm – Management Services Helwig Schmitt GMBH (ManServ) – and sample data had been transferred to it along with important documentation of the contract.
Mr Kodali says, "The issue here is government assumes it owns the data it collects from us in a fiduciary capacity. It wants to sell or share it with anyone it wants. But will not share the benefits with states or ask permission from citizens. Also, data trusts are not good."
"The Indian firm, in a letter to the ministry reviewed by The Wire, informed government officials of this agreement only when the German company refused to delete data it received from the former after the deal between the two went downhill. Months after this revelation, the ministry snapped off data supply over security concerns, show official records," the report adds.
"Before MoRTH announced a bulk data policy in 2018, they already knew the risks of privacy but did nothing. An Indian firm already shared the data with a foreign firm and it was considered a sensitive information to be shared," Mr Kodali says.
Nirmal Singh Saranna, chief executive (CEO) of Fast Lane Automotive, however, had denied any wrongdoing on part of the company to The Wire.
According to the report, while the MoRTH scrapped its bulk data sharing policy and the 2014 deal with Fast Lane Automotive over security concerns, another policy that allows access to the same data but along with personal details continues to be active without any protection against transfer of data or signing any sub-contracting agreement. The Wire says it reached out to the ministry with a specific query about safeguards in the deal with regards to transfer of data but did not receive any response.
Last year, the Internet Freedom Foundation, an Indian digital liberties watchdog, wrote to the government detailing why it should withdraw the policy. In June 2020, ministry officials decided to scrap the policy. They even ruled out the possibility of sharing reports based on data stored in the NR of transport with private entities.
“MoRTH has claimed that the policy has been scrapped but the private firms still have access to the data. They have not been asked to delete the datasets shared and the government has not refunded the money earned,” Mr Kodali told the Wire.
Mumbai-based Advocate Pravin Wategaonkar, an activist, who has filed several cases against the tolls on highways, feels this data sharing without price discovery is a case fit case to prosecute all those involved.
He says, "If indeed proprietary data available with a government department has been given out without following prevalent price-discovery processes, it amounts to a dishonest act and omission on part of concerned public servants- causing wrongful loss to public exchequer and corresponding gain to private entity. This is a fit case to prosecute those public servants under criminal and anti-corruption laws.”
Pune-based Vivek Velankar, an RTI activist, who is also president of Sajag Nagarik Manch, express surprise over the government itself selling citizens’ data to private parties. “On one hand government departments are turning down every RTI applications demanding similar data citing personal information, third party information and fiduciary information. Even banks are refusing to publish names of big loan defaulters whose loans are written off by them, citing the same reasons. And here the government merrily sold citizens' data without their consent. This is day light robbery on privacy of citizens," he says.
Another Pune-based activist Sanjay Shirodkar, who has been working on the toll issue and together with Adv Wategaonkar and Mr Velankar, have filed cases in Bombay High Court, feels those responsible for this data sharing should be prosecuted. “Even those who have used the vehicular data, should be made to pay a heavy penalty by the union government,” he says.