ADVERTISEMENT

Airtel Says It Does Not Collect Users’ Data On Sex Lives, Political Opinion

India’s second largest telecom operator addresses concerns around its privacy policy.

A Bharti Airtel Ltd. employee waits for customers at a street stall in Mumbai, India. (Photographer: Dhiraj Singh/Bloomberg)
A Bharti Airtel Ltd. employee waits for customers at a street stall in Mumbai, India. (Photographer: Dhiraj Singh/Bloomberg)

Turns out it was a drafting error. At least that’s what Bharti Airtel Ltd. said in its second response to the furore generated by its privacy policy.

Updated on Oct. 8, the telecom company’s website said it may collect sensitive personal data of users that range from their ethnicity and race to their political opinions, religious beliefs and sex life. Even trade union membership.

The wide scope of data covered under the policy was highlighted by a Reddit user last week following which it garnered attention on other social media including Twitter.

When asked why it was seeking to collect such sensitive personal data Airtel's spokesperson told BloombergQuint on Oct. 17: “The policy mentions expansive definitions which may not be warranted and can be misconstrued. We’ll re-evaluate the Policy and make necessary amends. Customer privacy is paramount to us. We don’t collect customer info beyond what’s permissible by law.”

A day later it, amended its privacy policy to remove clauses on data collection regarding users’ ethnicity and race, political opinions, religious beliefs and sex life. The telecom services company issued a statement on Oct. 18 suggesting the wording of the policy was an error.

“We emphatically confirm that we do not collect any personal information relating to genetic data, religious or political beliefs, health or sexual orientation, etc.,” a statement from Bharti Airtel said. “The generic content of the definitions of what constitutes personal data as laid down by the IT Act are expansive, which had been inadvertently put on to our website. We thank those who brought this error to our attention.”

Opinion
A Brief On Data Privacy, Protection And Surveillance

Companies Could Access Such Private Data If They Wanted To

The ever-increasing value of personal data has spurred a gold rush among companies that are trying to know more about their users' habits. Even if, as Airtel claims, it was a matter of incorrect drafting and the telecom company does not collect such data, the incident has underscored yet again the need for a personal data protection law in the country.

“This shows the urgent need for a robust data privacy law in India to safeguard us from unscrupulous corporations who collect sensitive information about our personal beliefs without telling us why or for how long and without giving us an option to say no,” Pranesh Prakash, founder of the Centre of Internet Society, told BloombergQuint.

Privacy is a fundamental right for Indians. However, legislation on how their data is handled by businesses is yet to be passed. A draft Personal Data Protection Bill is still being deliberated upon by a parliamentary committee.

In the absence of any specific laws, companies have to act within the framework specified by the Sensitive Personal Data or Information rules specified in Section 43A of The Information Technology Act, 2000.

Under the rules, firms are allowed to collect and use data like sexual orientation, physical and mental condition, biometrics, medical records and financial information but with caveats. The company has to obtain consent from the user, disclose what data is being collected, how it will be used and who will use that data. Besides, it also has to give users the option to opt-out from sharing such data.

What that means is under current law the telecom operator can collect data on users’ political beliefs and sexual activity, if it wanted to. Most users wouldn’t have even known as the world over very few internet users read the fine print of privacy policies of the websites they frequent.

“The purpose and usage of the data to be collected by Airtel was clearly mentioned in the policy,” said Anirudh Burman of Carnegie Endowment whose work is around public policy and data privacy. “While it is unclear why information regarding someone’s political opinion has to be collected by a telecom operator, users did have the option to read the policy and opt-out of the services being provided.” BloombergQuint spoke to Burman before Airtel revised its policy to remove the offending clauses.

Its updated privacy policy states that the company may collect the personal information “for providing our products, services and for use of our website”. However, that personal information now includes, but is not limited to, only password and financial information like details of bank account, credit and debit cards. The policy statement says it acquires consent through various means such as writing, online, click-throughs, orally, and even through its terms and conditions that users sign while joining its network service.

Still, concerns around the nature of data being collected by various websites and platforms are not unfounded. A 2019 report by UK-based research firm Comparitech had said that India was among the worst placed countries when it came to privacy protection. The country has a “systemic failure to maintain safeguards” for protecting citizen’s privacy, it said.

Opinion
Five Less-Known Ways You May Be Tricked Into Compromising Your Data Online