In the past week, there has been a lot of talk about Indian startups sharing data with the government and other authorities.

It all started with a video posted by Cobrapost. In the video, Paytm senior vice president Ajay Shekhar Sharma allegedly says that the company got a direct call from the PMO to share user data. He can be heard saying that the authorities asked for data of some of the users because they believed some of them could be involved in the stone pelting case in J&K last year. Paytm responded with the tweet below:

There is absolutely NO TRUTH in the sensational headlines of a video doing rounds on social media. Our users' data is 100% secure and has never been shared with anyone except law enforcement agencies on request. Thank you for your continued support. — Paytm (@Paytm) May 25, 2018

Later in a blog post, the company said that it has not received any request from the authorities to share user data. It added that it hasn't shared any data either.

Laws for legal requests for sharing the data

Section 69 and 69B of the Indian IT act allows the authorities to request user data from companies. The act is titled "Power to issue directions for interception or monitoring or decryption of any information through any computer resource". The contents suggest that the government can ask to decrypt user data if there is an issue of national security. While section 69B allows the monitoring and surveillance of traffic for Cybersecurity.

"We've seen that Government agencies sometimes use other provisions like Section 5(2) of the Indian Telegraph Act and Section 91 of the Criminal Procedure Code to request user data from tech companies, but only the IT Act provisions are intended to authorise such requests. Any demand for data made outside of the IT Act framework is made possible only by the broadness of language used by other legislation, which leaves room for a lot of subjective interpretation," said SFLC (Software Freedom Law Center) which is a legal service organisation working on privacy and digital rights.

Telegraphy act, section 5(2) indicates the government has the power to intercept the messages when an order is issued. Section 91 of the criminal says that if needed the company needs to produce any documents for the purpose of investigation.

Secrecy and silence of Indian startups

Most of the Indian startups have never revealed if they have shared the data with the authorities. There are no transparency reports issued by them as well. Killer Features has reached out to Flipkart, Paytm, Zomato, Oyo Rooms, Swiggy, BookMyShow and Micromax with a question related to data sharing and transparency report. We have received no response till now.

On the contrary, the company would be required under the IT Act and Rules to maintain "extreme secrecy" and "strict confidentiality" with regard to the data requests they handle. While this requirement applies only to requests made under Sections 69 or 69B of the IT Act, we've not seen any company making such public disclosures with respect to data requests made through alternate channels, likely because the requesting agencies insist on complete discretion anyway," SFLC said.

Government data requests to Google, Facebook and Apple

The above mentioned multinational companies release transparency reports regularly and in the report, you can find data for India as well. First, let's take a look at Facebook. India is the second country after the United States where the company has received the most requests from authorities. The data could be found on Facebook's transparency website. This is the data for the period of July to December of 2017. During the same period, 17,262 account details were requested by the authorities.

When you dive into the data of India, the chart shows that the number of requests has constantly increased.

During the July-Dec 2017 period, the government requested data from Google 1,074 times for 3,172 items. Notably, 50.3% of the requests were for YouTube items. During the same period, authorities requested details of 38 Apple devices from the company.

At the moment, apart from multinational companies, hardly any Indian company issues a transparency report. India needs an environment which can encourage the companies to issue a report without being feared by the authorities.