tl;dr
Last year, Indians across the nation were encouraged to geo-tag their homes under the Har Ghar Tiranga campaign. This year too, the Ministry of Culture launched the Har Ghar Tiranga Abhiyan 2.0, which was scheduled to run from August 13 to August 15, 2023. Despite stating via a Right to Information (RTI) response that the data collected will be deleted at the end of the campaign, i.e., after August 31, 2023, personal data of participating Indians, such as their names, photographs and geo-tags, is still up on the website. Concerned with the consequent privacy implications, we wrote to the Ministry of Culture urging them to delete the data of Indian citizens.
Why should you care?
The harghartiranga[dot]com website maintained by the Ministry of Culture, as per an RTI Response dated 25.09.2023, collects and displays the names and photographs of individuals with the national flag, which includes images of minors. According to a report by UNICEF, “Children are more vulnerable than adults and are less able to understand the long term implications of consenting to their data collection”, and thus, need a higher degree of protection for their data. During the campaign, over 88 million Indians uploaded their photos with the national flag on the Har Ghar Tiranga website. The website's privacy policy suffers from several deficiencies which cannot preserve the interests of these 88 million participants. Moreover, with a data protection law which provides sweeping exemptions to the government and affiliated agencies, it becomes imperative for the Ministry to minimise the collection of citizen data and establish adequate safeguards before launching such a campaign.
Background
On July 22, 2022, the Ministry of Culture launched the Har Ghar Tiranga campaign as part of the Azadi Ka Amrit Mahotsav celebrations, commemorating 75 years of India's independence. The Ministry of Culture launched a flagship website, harghartiranga[dot]com, allowing citizens to share their pictures posing with the tricolour which would be displayed on the website along with the display name entered by the user. Ahead of the Independence Day celebrations this year, the campaign was relaunched as Har Ghar Tirangan Abhiyan 2.0.
When IFF first came across this campaign last year, we were concerned by the proposed collection of personal data and geo-location by the government. Upon going through the website and the privacy policy of the campaign, our concerns grew. We flagged them to the Ministry of Culture through a letter dated August 12, 2022 and a subsequent follow up letter dated September 21, 2022. Following this, Google single sign-on (SSO) requirements were removed from the website. Yet, other privacy concerns remain.
Our Right to Information Request
After the announcement and reports on the relaunch of the Har Ghar Tiranga campaign by the Ministry of Culture as Har Ghar Tiranga Abhiyan 2.0, we filed an RTI Application with the Ministry of Culture dated August 18, 2023 requesting information on the privacy policy for the harghartiranga(dot)com. We asked several questions in our RTI request which are given below:
- Please provide an exhaustive list of changes made to the privacy policy of the website since its launch.
- Please provide an exhaustive list of data that the website stores and collects from its users.
- Please share the time period for which the website stores the data of its users.
- Please provide information with regard to the database/s used to store the data collected through the website.
- Please provide an exhaustive list of entities that would have access to the database storing the data collected through the website.
- Please provide an exhaustive list of entities/individuals who worked on the development of the website.
- Please provide an exhaustive list of safeguards that have been put in place to ensure the protection of the data collected under the scheme.
- Please share the details of any review or oversight committee formed under the scheme to ensure safeguards for public data.
- Please share if the Department/Ministry has released any guidelines, policies, rules or standard operating procedure on the storage of data. If so, please share a copy of the relevant documents.
Response Received
We received a response from the Central Public Information Officer for the Ministry of Culture on September 25, 2023. Below is a tabulation of the responses we received with each corresponding question:
Issues Raised
Based on the RTI Response, we wrote a letter to the Ministry of Culture on October 20, 2023 highlighting our issues with the website’s privacy policy, as enumerated below:
- Data stored beyond the time limit: We filed an RTI application carrying registration number MCULT/R/E/23/00309 dated August 18, 2023 concerning the privacy policy and storage of personal data by the website. Concerning the query about the time period for which the website stores the data of its users, the RTI response from the Ministry of Culture dated September 25, 2023 read that “the data was stored on website till 31st August, 2023.” [sic] However, as of October 20, 2023 the images and names are still visible on the website – which does not align with the RTI response given by the Ministry of Culture stating that the data was only stored till August 31, 2023, as displaying images on the website would not be possible without also storing them on a platform.
- Privacy policy does not apply to data collected from other sources : The privacy policy of the website explicitly mentions that “the User is aware that he/she might encounter "cookies" or other similar devices on certain pages of the Harghartiranga.com that are placed by affiliates of the Ministry. The User expressly agrees and acknowledges that the Ministry or Website does not control the use of such cookies/other devices by such third parties, that the Ministry or Website is in no way responsible for the same and that the User assumes any and all risks in this regard.” The Ministry skirts any responsibility and control over the use of such cookies or other devices by third parties, including affiliates of the Ministry.
- Lack of actual protections for minors' data: While the website mentions that it does not “knowingly collect any Personal Identifiable Information from children under the age of 18”, it allows anyone to upload an image of themselves holding a flag along with their name, including minors. This failure to proactively safeguard minors’ data can have an additional negative impact on them. It has been established under Section 9 of the Digital Personal Data Protection Act, 2023 and in the Hon’ble Supreme Court's judgment in Justice K.S Puttaswamy v. Union of India that there has to be added burden while handling and processing children’s data.
- Shifting responsibility onto users: The privacy policy vaguely provides that it will “protect [the data collected] within commercially acceptable means”. However, it fails to define the standard of the “commercially viable means” and the processes put in place to safeguard users’ data. Further, it places the onus on the visitors of the website to protect themselves by expecting them to “set their browsers to refuse cookies before using Har Ghar Tiranga websites”. The website also “advises” visitors to “consult the respective Privacy Policies of these third-party ad servers” to understand how they might use visitors’ data, without stating any steps taken to not allow these ad servers to serve ads on the website in the first place.
Conclusion
We at IFF remain firm believers in institutional processes, and strongly hope that the Ministry of Culture remains cognisant of the fundamental right to privacy of Indian citizens. Last year after our representations, the website removed the restriction of logging in using only either Google single sign-on (SSO) or a combination of their name and phone number functionality, which unnecessarily collected user data. This was a positive step towards data minimisation. This year as well, we urge the Ministry to delete all user data once the campaign has concluded, and to issue a public statement, either through a disclaimer on the website or a press release, stating that all data has been deleted and that it has not been shared with any third party(s) or put to any other use.
This post has been drafted by Saharsh Panjwani, Policy Intern at IFF and reviewed by the Policy Team.