People should have rights over their data; firms mere custodians, says Trai

In significant recommendations concerning privacy, Trai said today that firms collecting user data don't have a right over it, and emphasised that consumers' consent is a must for obtaining it who should also be given the 'Right to be Forgotten'.

Terming the existing data protection framework as inadequate, the Telecom Regulatory Authority of India (Trai) in a set of recommendations to DoT said that companies should not use meta-data to identify users and should disclose any data breaches.

Stating that each user owns his/her personal data and information submitted to any entity, it said entities controlling and processing user data are "mere custodians" and all of them should be brought under a data protection framework.

The government, it said, must notify policy framework to regulate devices, operating systems, browsers and applications.

Batting for telecom consumers, Trai said in its recommendation to the Department of Telecom that users be granted the right to choice, consent and to be forgotten to safeguard privacy.

It has suggested that all entities in the digital ecosystem be brought under a data protection framework to guard against the misuse of personal data of telecom consumers.

The recommendations assume significance as issues around data protection have come into the spotlight, and privacy concerns have amplified in the wake of the recent Facebook data leak fiasco.

Recommending a series of measures on "privacy, security and ownership of data in telecom sector", Trai held that consumers are owners of their data and that entities controlling, processing their information are "mere custodians and do not have primary rights over this data".

It added: "The Right to Choice, Notice, Consent, Data Portability, and Right to be Forgotten should be conferred upon the telecommunication consumers."
Trai, in its 77 page recommendations, said: "The Government should put in place a mechanism for redressal of telecommunication consumers' grievances relating to data ownership, protection, and privacy."