Recently, the economic survey was released, after that, on 8 July in Rajya Sabha, the question is raised that how data can be used to generate revenue. In reply to a few questions, Minister of Road Transport and Highway Nitin Gadkari has revealed that the government is selling a vehicle registration and driving license data of Indians and earning money from it.

Nitin Gadkari said in response to the question by Congress MP Hussain Dalwai, "The Ministry has made policy for bulk data related to registration of trains by bulk data sharing policy and processor". If any organization wishes to get this data, then it is worth 3 crore rupees for the financial year 2019-20".
In his written reply in the Rajya Sabha, he said that the government has earned Rs 65 crore by selling the data.

On behalf of the government, so far 87 private companies and 32 government companies have been sold vehicle data. Under the Bucket Data Sharing Policy, private companies and educational institutions are allowed access to data. In this, Rs. 3 crores for one year from the educational institution, Rs. 5 crores from government institutions are taken.

Earn by selling vehicles and charioteer databases. Under this plan, companies who purchase a vehicle are allowed to access vehicles and SARATHI database which was used by RTO throughout the country so far. Vehicle and charioteer were introduced for the first time in 2011, on which there is a large amount of vehicle data at present. Vehicle software contains data for vehicle registration, tax, fitness, invoices, and permits while driving in the Sarathi database There are licenses, fees for details. It has also been reported that through National Informatics Center (NIC), there is a record of registration of about 25 million vehicles and 15 million driving license details on these two platforms.

How Does It work? 

As per the new rules,  ‘Bulk Data Sharing Policy & Procedure‘ the educational institutes can buy the bulk Vahan and Sarathi data for information and research purpose only, at a price of INR 5 Lakhs. 

The Organization requesting for data should be registered in India with at least 50% ownership by an Indian resident or an Indian company can have access to such data. And all bulk data accessed by the organization shall be processed/ stored in servers/ Data Center residing in India. The data at any point shall not be transferred/ processed/ stored in a server outside India.

For the purchase of data. the policy states, " The commercial organizations and individuals seeking bulk data will have to pay an amount of Rs. 3.00 Crore for the Financial Year  2019-20". While Educational institutions can use this data only for research purposes for internal use only and would be provided the bulk data one time on payment of an amount of Rs. 5.00 lakh only for the Financial Year 2019-20. However, in the Bulk Data Sharing policy & Procedure, there shall be an annual increase of 5% from the Financial Year 2020-21 onward

Data Points shared

Here are the proposed fields of Registration Certificate (RC) for Sharing of Bulk Data from VAHAN database:

1. Registration Number 2. Engine Number 3. Chassis Number 4. Class of Vehicle 5. Purchase Date 6. Registration Date 7. Registering Authority 8. Manufacturer Name 9. Model Name 10. Body Type 11. Fuel Type 12. Wheelbase 13. Number of Cylinders 14. Colour 15. Dealer 16. Seating Capacity 17. Standing Capacity 18. Gross Vehicular Weight/ Laden Weight 19. Unladen Weight 20. Cubic Capacity 21. Horse Power 22. Financer’s Name (Hypothecation) 23. Insurance Company Name 24. Insurance Validity 25. Fitness Validity 26. Permit Type 27. Permit Validity 28. Tax Paid Validity

It is important to highlight here that the government is not sharing personal or sensitive data like mobile number or email.

Privacy Concern

Justice BN Srikrishna Committee report on the draft Personal Data Protection Bill 2018 was finally submitted to the minister of law and justice, Ravi Shankar Prasad, July 27 last year.

In line with the “importance” of data, the Bill introduces new definitions of “personal data” and “sensitive personal data”. Personal data refers to any data of a natural person which allows direct or indirect identifiability. Sensitive personal data includes financial data, biometric data, positive additions such as religious and political beliefs, caste, intersex/transgender status, and official government identifiers like PAN, etc. But data protection bill is still at the draft stage and in the absence of it, it is unclear how efficient and stringent the IT Act would be to prevent and punish misuse of the data. What is also alarming is that not enough awareness or information was passed onto the user when this service came into being which also means there hasn’t been much consultation with consumers.

There is a possibility of ‘Triangulation’ (matching different data-sets that together could enable individuals to be identified and their privacy compromised). That’s because the Vahan app, also run by the ministry, maps registration details against names. And names, in some rare cases, can help track other details, including addresses, e-mails, and phone numbers.

Note: There is no way to find mobile numbers or email addresses if you have someone's name unless someone has publically shared this information on social media or web. 

It is the responsibility of the organization that any such activity, which results in identifying individuals using the RC data-set, shall not be undertaken. The Transport Ministry’s policy clearly warns that the merging of disparate datasets is harmful to individual privacy and places the onus to refrain from doing so on the organization purchasing the data but it lists no active measures that the government will take to make sure this does not happen.

In terms of data protection, the policy states that data in bulk will be released in an encrypted format. “The data will be encrypted with the public key of the nodal person of the purchasing organization who will manage the data securely,” the policy states adding that data will be provided on an as-is-where-is basis

Talking to Hindustan Times, Arghya Sengupta, research director, Vidhi Centre for Legal Policy, said that if it is a data set in bulk which does not contain any personal information then there will not be any significant privacy concerns.