Floating IRCTC offers to appoint consultants to monetize digital data, Risk Digital Freedom Group

The Indian Railways Travel and Services Corporation (IRCTC) has conducted a tender seeking to monetize the digital data of Indian Railways and IRCTC. The latter is looking to appoint a consultant on ‘digital data monetization’. The bid, which seeks to use data from passenger, freight and parcel trains, was discovered on Friday by the Internet digital freedom organization Internet Freedom Foundation (IFF). It is worth noting that India currently does not have a data protection law to regulate the use of personal information by citizens.

According to E-Bidding document (archived version) uploaded on IRCTC website, titled ‘Consulting to Monetize Digital Data’, the public sector is looking to appoint a consulting firm for the project, to generate up to Rs. 1,000 crore revenue. The deadline for tenders is August 29 and IRCTC has set a serious deposit (EMD) at Rs. 2 thousand, according to the document.

IRCTC states that it is “a huge storehouse of digital data that opens up a number of monetization opportunities for IRCTC” and that they look forward to “leveraging data assets and market positions to drive growth.” strong revenue growth”. The consulting firm will study IRCTC data including data from passengers, cargo, parcels, catering, tourism and other rail operations.

The data IRCTC listed in the bid (page 11) includes customer data collected from Indian Railways, including “basic data” such as name, age, mobile number, their gender, address, email address as well as journey type, payment method, and login information – including their username and password.

According to IRCTC’s bidding documents, the consultant will have to aggregate the data obtained, separate the data, and “determine the international market potential” for specific data sets. They must also establish processes and protocols for long-term monetization of Indian Railways digital data and “retain” the monetization process.

To suggest business models for data monetization, the bid states that the consulting firm should study information technology-related law, including the IT Act 2000 and its amendments, as well as data privacy laws such as the General Data Protection Regulation (GDPR) and the “Appropriate Personal Data Protection Bill 2018 of India”. However, as the IFF points out, the Personal Data Protection Bill has withdraw by the government on August 3.

The digital freedom organization highlighted the risks of monetizing customer data, claiming that the goal of maximizing profits could lead to increased data collection, which would violate principles of data minimization and purpose limitation. Meanwhile, monetization will take place in the absence of personal data protection laws. “Past experiences from abuse [the] Vahan database amplifies fear of security risks and mass surveillance, “IFF” stated in a tweet.

Gadgets 360 has reached out to Indian Railways for comment and will update this article when it receives a response.

On August 3, the government withdrew the Personal Data Protection Bill, 2021, announcing that it was working on a new comprehensive law. The bill proposes regulation of data transfers across borders, and empowers the government to seek data from companies. At that time, Union Minister of Electronics & Information Technology Ashwini Vaishnaw speak that the government hopes to get the new law passed by the Parliamentary Budget session.