Home / Opinion / Views /  IRCTC should stick to data monetisation—but listen to critics

The Indian Railways Catering and Tourism Corporation (IRCTC) appears to have developed second thoughts about its plan to monetise the treasure trove of user data that it possesses as the monopoly provider of online ticketing services to the Indian Railways, the world’s fourth largest national railway system by size, which carries more than 8 billion passengers a year.

Less than 24 hours after news broke that the Railway PSU, which is also one of India’s largest e-commerce websites with more than 540 million users per month, and among the 100 most valuable companies listed on Indian stock exchanges, had floated a tender to appoint a consultant for its digital monetisation plan, media reports cited Railway officials as saying that the proposal would be “reviewed" after critics raised data privacy concerns. According to sources quoted by the news agency PTI, IRCTC “does not sell its data and neither has any intention to do so".

This is quite different from the intent outlined in the original tender, which said “IRCTC is a reservoir of huge amount of digital data which opens several opportunities for IRCTC for monetisation," and IRCTC even identified a revenue opportunity of 1,000 crore from monetisation of its digital assets.

It would be a pity if IRCTC indeed drops its data monetisation plans. If data is the new oil, then IRCTC is the Saudi Arabia of data. It sells nearly half a million tickets a day, peaking to over a million during heavy travel times. In FY 22, as travel returned to normal after a long COVID break, it sold a staggering 420 million tickets. That means data on demographics, identity, travel patterns and spends on 420 million users—and that’s just in a single year. And it has been collecting such data since 1999.

You might also like

Why Akshaya Patra decided to change its auditor

Sebi mulls more disclosure norms for QIP funds

For health of IT stocks, watch how BFSI industry performs

ASK’s Sunil Rohokale's journey from real estate to equity

Given such a treasure trove, the 1,000 crore estimate might err on the side of caution. Even though IRCTC is already an extremely profitable enterprise—in Q2 of FY22-23, it reported a profit margin of an astounding 34.7 per cent—it owes it to its shareholders to maximise returns on their investments. Which includes maximising the assets in its possession, which includes data.

That, however, does not mean that it should ignore the concerns which have been raised about its plans. According to the tender document, the data to be studied includes information like “name, age, mobile number, gender, address, e-mail ID, class of journey, number of passengers, payment mode, login or password" and other details.

This is obviously extremely sensitive personal data, which has understandably got privacy advocates worked up. The Internet Freedom Foundation, in a Tweet, said: “A profit maximisation goal will result in greater incentives for data collection, violating principles of data minimisation & purpose limitation. Past experiences from the misuse of Vahan database amplify fears of mass surveillance & security risks." Other privacy advocacy groups have pointed out that the Personal Data Protection Bill 2018 (referred to in the tender) is not legally enforceable as the Bill was never passed by Parliament and, in fact, even its revised version was withdrawn in the Monsoon session of Parliament.

The absence of a data protection law is definitely a concern but need not be a deal breaker. One, the government is expected to introduce a new bill for enacting a data protection law as soon as in the next sitting of Parliament scheduled for the winter session. Second, IRCTC, as a quasi-government entity (the government, through the Railways, still owns 67.4 per cent of the company), can actually set higher standards for data protection and privacy for everybody else, while at the same time maximising potential for monetisation, by setting in place strict standards for how the data will be collected, stored and analysed, and when and under what conditions other entities will be able to access the data sets.

A principle of total anonymisation—in which data is de-personalised effectively enough so hackers cannot restore connections between individuals and their data—has to be followed and a confidential computing framework developed, so that the data can provide useful insights, while at the same time protecting sensitive private data from exposure.

Further, a mechanism has to be set in place for collecting informed consent from IRCTC users before making any part of it available to third parties. For instance, a business traveller taking the Rajdhani from Delhi to Mumbai may wish to receive tailored offers from hotels, travel services, restaurants, etc. But this has to be on an opt-in basis. And since a vast majority of Internet users in India are still early stage users who are not net savvy, the default settings have to be those which protect their data, with various degrees of sharing allowed by opting in.

In fact, the European Union, which has the most stringent data privacy regulations in the world, is currently considering a proposal for “harmonised rules on fair access to and use of data" which is aimed at allowing businesses and entities to monetise data without infringing on the privacy rights guaranteed under EU’s General Data Protection Rules, as well as other extant regulations. That may be a model to study.

IRCTC, as a public sector entity which is used and trusted by millions of Indians, could take the lead in setting the gold standard for data privacy protection while unlocking the true potential of data, which can be a guideline to not only other businesses, but even regulators and lawmakers as India works out its own approach to data protection.

Elsewhere in Mint

In Opinion, Manu Joseph argues why science is disappointing in comparison to its own reputation. Ashish Dhawan tells why Indian philanthropy is now poised to take off. Anirudh Suri writes what America’s Inflation Reduction Act means for India. In Long Story, an economist girlfriend explains why stock prices have rallied again. 

Catch all the Business News, Market News, Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.
More Less

Recommended For You

Trending Stocks

Get alerts on WhatsApp
Set Preferences My ReadsWatchlistFeedbackRedeem a Gift CardLogout