A BALANCING ACT

CERT-In's directions to data centres, VPN service providers and intermediaries for information about customers infringe on privacy. The lack of a Data Protection Authority tilts the power in favour of CERT-In

- Ashit Kumar Srivastava and Rishabh Shukla

RECENTLY, Computer Emergency Response Team-India (CERT-In) came up with new directions for data centres, virtual private network (VPN) service providers, cloud service providers and intermediaries to create log and provide information about customers. This includes their email address, IP address, phone numbers and the purpose for hiring VPN services. This information has to be held for five years after their cancellation or withdrawal of membership or subscription.

All the entities also need to report any cyber security incident to CERT-In within six hours of it coming to their knowledge or being informed of it. Crypto exchange and wallet service providers are required to maintain KYC details of their users. Additionally, information about financial transactions about the user needs to be stored for five years. It should have elements that can lead to restructuring of the transaction and the relevant party to the transactions can be traced, as well as their IP address located.

These directions come in wake of CERT-In finding glaring gaps in the cyber security mechanism. The fact that VPN service providers have been asked to share information about their customers comes as a revelation, knowing that the USP of these services lies in their anonymity. However, if the anonymity features come under threat, then it can lead to a trust deficit.