IRCTC floats tender to monetise customer data, may withdraw over privacy concerns

New Delhi: The Railways has floated a tender to hire a consultant to monetise its passenger and freight customer data with the aim to generate revenue up to Rs 1,000 crore, but sources said it may be withdrawn amid concerns over privacy issues.

While many on social media, including advocacy groups have raised concerns over violation of data privacy issues, government sources have clarified that the consultant would advise the Indian Railway Catering and Tourism Corporation (IRCTC) on steps to improve its existing business and plan strategies to monetise future opportunities.

While the Railways has not officially commented on the tender, highly placed sources said it will be withdrawn "considering the fact that the Data Protection Bill has not been finalised".

According to the tender document, the data to be studied will include information captured by the transporter's various public facing applications such as "name, age, mobile number, gender, address, e-mail ID, class of journey, payment mode, login or password" and other details.

The IRCTC has more than 10 crore users, of which 7.5 crore are active users.

The document also stated that the consultant, once finalised, will be provided the details of applications and the data collected thereon for conducting the study for 'Monetization of Digital Data of Indian Railways'.

The consultant shall study the data of passenger, freight and parcel businesses of the Indian Railways such as PRS, NGeT, NTES, UTS, Rail Madad, FOIS, TMS, e-CRM, and PMS, as well as vendor-related data from applications like IREPS, VMS and IPAS.

The document titled 'The Scope of Work for Project A: For study of Monetization of Digital Data of Indian Railways(IR)' said the consultant would also be provided access to the digital data systems which generate behavioural data such as flow of passengers, class of journey, frequency of journey, travel time, booking time, age group and gender, payment mode, number of destinations and booking modes.

The objective of the exercise, it said, is for the IRCTC to leverage its data assets and market position to drive strong growth in revenues. This can be achieved by improving customer experience, expanding the portfolio of products being offered to the customers and/or developing new business lines and partnerships, the document stated.

"IRCTC envisages a revenue generation potential of Rs 1,000 Cr through Monetization of its Digital Assets. IRCTC wishes to engage a consulting firm to help in identification, design, and development and roll-out of data monetization opportunities," it said.

While the Railways is yet to officially respond, sources close to the development said the IRCTC does not "sell its data and neither has any intention to do so". They said the consultant is being hired to advise the IRCTC on steps to improve its existing business and plan out strategies to monetise future businesses. It will also focus on how the IRCTC could adopt new business opportunities.

"IRCTC will also develop new businesses on its own platform and will need assistance from market leaders. IRCTC does not store any financial data of its customers at its end, as at the time of online payment for its various services, control is passed on to the respective payment gateway or bank for the payment," the sources said.

The document also said that the consultant will study various Acts or laws, including the IT Act, 2000 and its amendments, user data privacy laws, including the General Data Protection Regulation and the current 'Personal Data Protection Bill, 2018', and accordingly, propose the business models for monetisation of digital assets.

The consultant would also prepare a roadmap for data monetisation of the digital data collected at various customer-facing and vendor-related applications which include zonal railways, divisions, and other units like CRIS, and PSUs like IRCTC, Railtel, etc.

Tasks listed for the appointed consultant include segregation of monetisable data sets, identification of market potential internationally, and preparation of a roadmap for data monetisation of the digital data.

Internet Freedom Foundation, a Delhi-based non-governmental organisation advocating digital rights and liberties, has raised concerns over the tender and outlined its pitfalls in a series of tweets.

"Hey train travellers, your data will soon be monetised by the govt and that too, in the absence of a data protection legislation! ...A profit maximisation goal will result in greater incentives for data collection, violating principles of data minimisation and purpose limitation. Past experiences from the misuse of Vahan database amplify fears of mass surveillance and security risks," it said.

"IRCTC, a government-controlled monopoly, must not prioritise perverse commercial interests over the rights and interests of citizens. And given the recent withdrawal of the Data Protection Bill, 2021, such monetisation becomes even more concerning," the NGO added.