Indian firms collect, share individuals’ data with third parties in dubious ways: report

The report titled “Unlocking the potential of India’s data economy: practices, privacy and governance", brought out by Omidyar Network India, an investment firm, and Monitor Deloitte, a consultancy, said such behaviour profiling could lead to unfair discrimination or marginalisation of people as these profiles are incomplete or inaccurate. Many people will find such use of personal data unsettling, the report said. Such personal profiling may lead to businesses adopting a differentiated pricing strategy for individuals, the report said, citing examples of credit card and insurance companies.

The report makes a sharp critique of the current practices followed by several companies and recommends principles to be followed for protection of data privacy.

“Several private enterprises currently share the personal data of individuals with other entities, and often use the services of companies with data broking business models… However, individual users seldom have any awareness about various entities that gain access to their personal data," said the report. The findings of the report is alarming considering the increase in use of internet data consumption and people’s reliance on technology companies. The report said that in 2017, India experienced the second-highest number of data breaches across the world accounting for 37% of the overall data breaches.

“Several private enterprises covered in our research currently do not have a standard or accessible process for the periodic deletion of data, and do not provide individuals with the “right to be forgotten," said the report.

The report said the growth in personal data collection is projected to continue, driven by strong consumer, enterprise and government initiatives.

As Indian consumers do not yet fully recognize the need for privacy, and the Personal Data Protection Bill is awaited, enterprises primarily adopt a ‘tick the box’ approach to compliance in data privacy and protection, it said.

The report suggested that ownership of personal data should rest with individuals, who should get a fair value for the data shared with an enterprise. It also suggested that informed consent for use of data was required.