(a) whether the Government has conducted any study to assess the compliance of various service providers, like telecom, internet, etc. to the Information Technology Rules, 2011 with regard to maintaining security of consumer data; and
(b) if so, the findings of the study and steps taken to ensure compliance by the service providers and if not, the reasons therefor?
(a) and (b): The Government has not conducted any study to assess the compliance of various service providers, like telecom, internet, etc. to the Information Technology Rules, 2011 with regard to maintaining security of consumer data.
However, to protect the interest of the stakeholders/ customers and privacy of the individuals, the Government has mandated following terms & conditions as part of the Unified Licenses (Similar provisions in other Licenses) granted to Telecom Services Providers (TSPs):
“37.2 Subject to terms and conditions of the license, the Licensee shall take all necessary steps to safeguard the privacy and confidentiality of any information about a third party and its business to whom it provides the Service and from whom it has acquired such information by virtue of the Service provided and shall use its best endeavours to secure that:
a) No person acting on behalf of the Licensee or the Licensee divulges or uses any such information except as may be necessary in the course of providing such Service to the Third Party; and
b) No such person seeks such information other than is necessary for the purpose of providing Service to the Third Party.
Provided the above para shall not apply where:
a) The information relates to a specific party and that party has consented in writing to such information being divulged or used, and such information is divulged or used in accordance with the terms of that consent; or
b) The information is already open to the public and otherwise known.
37.3 The Licensee shall take necessary steps to ensure that the Licensee and any person(s) acting on its behalf observe confidentiality of customer information.
39.4 The LICENSEE shall ensure protection of privacy of communication and ensure that unauthorized interception of messages does not take place.
39.23(xix) In order to maintain the privacy of voice and data, monitoring shall be in accordance with rules in this regard under Indian Telegraph Act, 1885”.
*******