Question : Selling of Personal Information by Social Networking Sites

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

(a) whether the Government is aware of the incidents of selling of customers’ personal details by social networking sites;
(b) if so, the details thereof and the reaction of the Government thereto;
(c) whether the Government has made any rule to check the sharing of personal details of customers without their consent;
(d) if so, the details thereof;
(e) whether the Government has taken any action to deal with this matter; and
(f) if so, the details thereof?

(a) and (b): The Government is aware of some media reports about instances of unauthorized use of personal data and data breaches of personal information of users through social networking sites. Post 2016, after the Hon’ble Supreme Court has ruled that Information Privacy is a fundamental right, it is the responsibility of the social media platforms to protect the privacy of their users. In cases like Cambridge Analytica, the Government has handed over the matter to CBI for investigating the matter.

(c) to (f): At present Section 43A and section 72A of the Information Technology (IT) Act, 2000 provide for privacy and security of data in digital form. Section 43A of the Act provides for compensation to be paid to the affected users in case of unauthorized access of information and leakage of sensitive personal information respectively. It mandates ‘body corporate’ to implement ‘reasonable security practices’ for protecting ‘sensitive personal information’ of individuals. Section 72A of the Act provides for punishment in the form of imprisonment upto 3 years and fine for disclosure of information in breach of the lawful contract.

Also, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021notified under the IT Act, 2000 require that the intermediary shall publish the rules and regulations, privacy policy and user agreement for access or usage of its computer resource by any person.

The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha on December 11, 2019 by the Ministry of Electronics and Information Technology. The Bill seeks to provide for the protection of personal data of individuals. The Bill is currently being deliberated by the Joint Parliamentary Committee.
******