IRCTC, the Indian Railways Catering & Tourism Corporation Limited, has denied media reports that it has been selling customer data. The corporation is hiring a consultant, and both the company and the government intend to commercialize passenger data, according to certain media reports, including those from social media advocacy organizations.
According to a top IRCTC official, the company does not sell its data and has no plans to do so. Any reports in the media to the contrary are wholly untrue. The spokesperson continued by saying that professionals are being used to improve current businesses. The specialist will also make suggestions for fresh business endeavors that IRCTC and Indian Railways could choose to explore shortly
.The official also emphasized that, as a business, the organization continually searches for opportunities in new industry areas. To carry out these activities in a more professional manner and to safeguard the financial interests of its investors, the IRCTC has published a tender to employ an experienced international consultant.
The IRCTC’s stated objective for this measure, according to sources, is to generate up to 1,000 crore in income. In addition to information on the passenger, freight, and parcel industries, the consultant will be expected to look up any vendor-related data from Indian Railways applications.
It also noted that by the tender, customer data that must be examined and used include, among other things, “Name, Age, Mobile No., Gender, Address, E-Mail ID, No. of Passengers, Class of Journey, Payment Mode, Login/Password,” in addition to behavioral data like payment and booking habits, frequency of travel, etc.
On its platform, IRCTC has developed a wide range of businesses, including rail ticketing, hotel booking, air ticketing, bus booking, catering service, etc. Similar to this, the IRCTC will create a new business on its platform with assistance from or guidance from leading professionals in the field, and it will be determined by the higher-ups in the organization.
In addition to the official’s assertion, IRCTC does not save any financial data on its customers on its system server since, when a customer makes an online payment for one of its numerous services, control is given to the proper Payment Gateway or bank to handle the payment.
The purpose of this is to better support and direct Indian Railways and IRCTC in creating monetization plans using data analysis. The consultant will advise the company on the monetization of activities, new businesses in line with the travel and related needs of its customers, and the monetization value of existing Digital Resources while adhering to various Acts and Laws such as the IT Act 2000 and its amendments, User data privacy laws such as GDPR (General Data Protection Regulation).
Of the IRCTC’s more than 10 crore subscribers, more than 7 crores are active consumers. The company, a PSU under the Ministry of Railways, has been at the forefront of providing excellent services to Indian Railways passengers.
According to the IRCTC tender document, the data of the appointed consultant will study the users, including name, age, mobile number, gender, address, email id, the number. Apart from that, passenger class, payment method, login data/password will also be reflected.
What will the work of the consultant be: According to the offer, the consultant will also have access to the digital data system. It was also specified in the offer that the consultant will study various acts or laws related to data and IT. It will be suggested by the advisor how user data can be monetized. For this, the appointed consultant will prepare a roadmap. This move will help IRCTC improve its margins.
Data Concerns: This news has created apprehension among millions of IRCTC users as India still does not have a data protection law. Recently, the central government withdrew the controversial Personal Data Protection Bill 2019. It aimed to find out how businesses and governments can use citizens’ digital data.
What the experts say: Internet Freedom Foundation, a Delhi-based non-governmental organization that champions digital rights and freedoms, expressed concern over the tender and cited its pitfalls in a series of tweets. He said the IRCTC should not prioritize malformed commercial interests over the rights and interests of citizens. Considering the recent withdrawal of the Data Protection Bill, 2021, such a move becomes all the more worrying.
The tender suggests referring to the:
- IT Act, 2000 & its amendments
- User data privacy laws including the General Data Protection Regulation
- The current Personal Data Protection Bill 2018 of India!
Tasks listed for the appointed consultant include:
- Segregation of monetisable data sets
- Identification of market potential internationally
- Preparation of a road-map for data monetisation of the digital data
The Indian Railways has more than 100 terabytes of passenger data, according to reports.