After public uproar, IRCTC scraps passenger data monetisation tender

After it was summoned by a parliamentary panel over its controversial passenger data monetisation plan on Friday, the Indian Railways Catering and Tourism Corporation (IRCTC) has withdrawn its tender for hiring a consultant to advise on strategies for the Rs 1,000 crore plan.

The tender has been withdrawn “due to the withdrawal of the Personal Data Protection Bill by the Government of India,” according to an exchange filing by the company. Officials in the know had previously also said that criticism from the public and policy experts had triggered the review process for the monetisation plan.

The parliamentary standing committee on communications and information technology had summoned IRCTC officials on Friday evening to address concerns of possible data privacy violations through its move. Sources close to the development said that the company informed the panel that it has reviewed its stance and withdrawn the tender. The information was shared by officials briefly after the meeting.

The railway ministry is now likely to wait for the new data protection bill before it takes any further decision on the monetisation plan. Since the tender was made before parliamentary proceedings on the bill came to an end, not only is the tender being withdrawn, the whole data-sharing policy is being relooked at, a senior official in the know of the matter said.

Meanwhile, there is no immediate clarity on whether IRCTC will float another tender immediately after a new data protection bill is drafted or wait until it is passed by Parliament and made into a law, the official added. The personal data protection bill was withdrawn after a joint parliamentary suggested 81 amendments to the draft.

Last week, the ticket-booking arm of Indian Railways, which has access to over 80 million users’ private data and travelling data for over 430 million tickets last fiscal year, had sought the services of a consultant to conduct business with government and private companies by leveraging its customer and vendor application data, expecting a revenue opportunity of Rs 1000 crore.

The consultant would have been required to conduct a thorough analysis of IRCTC’s own data and of global data privacy legislations such as the European General Data Protection Regulations and the now-shelved Personal Data Protection Bill.

The tender document by IRCTC outlined the scope of work for the consultant for this monetisation, some of which had caused a public stir, such as inclusion of sensitive data like name, age, mobile number, gender, address, e-mail ID, number of passengers, class of journey, payment mode, login and password, etc.

Business Standard had previously reported that these data sets may get shelved after the official review, with a new exercise including broadly clustered metadata without access to any individual data without anonymisation.

Digital rights advocates and policy experts had flagged concerns with the move. Prateek Waghre of the Internet Freedom Foundation had said, "Even if the Railways plans to do this in a privacy preserving way, concerns would still be there, as we don’t have a necessary legal framework for the protection of user data.”

Another concern was the unclear privacy policies of the company and the lack of informed consent for the user as IRCTC holds a monopoly in ticket booking and there is no opt-out mechanism for the end-user.