Last year, Indians across the nation were encouraged to geo-tag their homes under the Har Ghar Tiranga campaign. This year too, the Ministry of Culture launched the Har Ghar Tiranga Abhiyan 2.0, which was scheduled to run from August 13 to August 15, 2023. Despite stating via a Right to Information (RTI) response that the data collected will be deleted at the end of the campaign, i.e., after August 31, 2023, personal data of participating Indians, such as their names, photographs and geo-tags, is still up on the website. Concerned with the consequent privacy implications, we wrote to the Ministry of Culture urging them to delete the data of Indian citizens.
Why should you care?
On July 22, 2022, the Ministry of Culture launched the Har Ghar Tiranga campaign as part of the Azadi Ka Amrit Mahotsav celebrations, commemorating 75 years of India's independence. The Ministry of Culture launched a flagship website, harghartiranga[dot]com, allowing citizens to share their pictures posing with the tricolour which would be displayed on the website along with the display name entered by the user. Ahead of the Independence Day celebrations this year, the campaign was relaunched as Har Ghar Tirangan Abhiyan 2.0.
Our Right to Information Request
- Please provide an exhaustive list of data that the website stores and collects from its users.
- Please share the time period for which the website stores the data of its users.
- Please provide information with regard to the database/s used to store the data collected through the website.
- Please provide an exhaustive list of entities that would have access to the database storing the data collected through the website.
- Please provide an exhaustive list of entities/individuals who worked on the development of the website.
- Please provide an exhaustive list of safeguards that have been put in place to ensure the protection of the data collected under the scheme.
- Please share the details of any review or oversight committee formed under the scheme to ensure safeguards for public data.
- Please share if the Department/Ministry has released any guidelines, policies, rules or standard operating procedure on the storage of data. If so, please share a copy of the relevant documents.
We received a response from the Central Public Information Officer for the Ministry of Culture on September 25, 2023. Below is a tabulation of the responses we received with each corresponding question:
- Lack of actual protections for minors' data: While the website mentions that it does not “knowingly collect any Personal Identifiable Information from children under the age of 18”, it allows anyone to upload an image of themselves holding a flag along with their name, including minors. This failure to proactively safeguard minors’ data can have an additional negative impact on them. It has been established under Section 9 of the Digital Personal Data Protection Act, 2023 and in the Hon’ble Supreme Court's judgment in Justice K.S Puttaswamy v. Union of India that there has to be added burden while handling and processing children’s data.
We at IFF remain firm believers in institutional processes, and strongly hope that the Ministry of Culture remains cognisant of the fundamental right to privacy of Indian citizens. Last year after our representations, the website removed the restriction of logging in using only either Google single sign-on (SSO) or a combination of their name and phone number functionality, which unnecessarily collected user data. This was a positive step towards data minimisation. This year as well, we urge the Ministry to delete all user data once the campaign has concluded, and to issue a public statement, either through a disclaimer on the website or a press release, stating that all data has been deleted and that it has not been shared with any third party(s) or put to any other use.
This post has been drafted by Saharsh Panjwani, Policy Intern at IFF and reviewed by the Policy Team.