E-Paper
Govt asks VPN services, platforms to block sites leaking personal data of Indians
The electronics and information technology ministry flagged sites such as proxyearth.org and leakdata.org for exposing names, mobile numbers, addresses, etc
The electronics and information technology ministry has directed virtual private network (VPN) service providers and other intermediaries to immediately block access to websites leaking personal information of Indians.
A ministry official first posted the directive on Thursday on LinkedIn, flagging sites such as proxyearth.org and leakdata.org for allegedly exposing names, mobile numbers, addresses, and other details without consent. A top ministry official confirmed the authenticity of the directive.
The flagged sites allowed users to enter any Indian mobile number to access information, including full name, address, alternate numbers, and email IDs.
The ministry warned that such platforms pose a significant risk to Indian users as they permit public access to personal information of users without their authorisation. It added that these sites may still be reachable through VPN services, making action by their providers essential.
In 2022, the Indian Computer Emergency Response Team issued directions requiring VPNs, cloud service providers, and VPS operators to collect and store verified customer information for five years, even after a service is discontinued.
Major VPN companies, including Proton VPN, ExpressVPN, NordVPN, and Surfshark, subsequently removed their physical servers from India to avoid the data-retention mandate.
The fresh electronics and information technology ministry directive reminds intermediaries of their obligations under the Information Technology Act, 2000 and the Information Technology Rules, 2021, including the requirement to take “immediate and effective action” to ensure that unlawful or privacy-violating content is not hosted or shared on their platforms. Failure to comply could cost companies their safe-harbour protections under Section 79 of the Act, and lead to action under it and the Bharatiya Nyaya Sanhita.
The ministry cited the serious nature of the situation and reiterated that VPN services and intermediaries must make reasonable efforts not to permit access to such websites. The directive reiterated that intermediaries must provide information or assistance to law-enforcement and cybersecurity agencies within the stipulated time frames.
Self-drive car hire platform Zoomcar this year reported a data breach affecting about 8.4 million users. A breach of the ADDA app exposed data of over 1.8 million users. The Indian Council of Agricultural Research suffered a cyberattack that disrupted recruitment and research systems.
A 2021 Air India breach affected 4.5 million passengers. The 2021 Domino India leak exposed customer order histories and contact details.
