MeitY warns VPN firms, platforms over sites leaking Indians’ personal data

MeitY warns VPN firms

The Ministry of Electronics and Information Technology (MeitY) on December 11 issued an advisory to VPN (Virtual Private Network) service providers and online intermediaries, warning them against permitting access to websites that publish personal data of Indian citizens without consent.

The move comes after the ministry took note of platforms such as proxyearth.org and leakdata.org, which allegedly allowed users to look up sensitive details of citizens including names, addresses, phone numbers and email IDs -- simply by entering an Indian mobile number.

Citing "serious" risks to user safety and privacy, MeitY has said that such websites are operating in violation of Indian law. The advisory notes that these sites can also be accessed through virtual private networks and stresses that intermediaries must ensure their services are not used to reach platforms succh as proxyearth or leakdata.

The ministry reminded intermediaries of their due-diligence obligations under the Information Technology Act, 2000 and the IT Rules, 2021. These rules prohibit hosting or transmitting information that belongs to another person without rights, invades someone’s privacy, or threatens public order, national security or the sovereignty and integrity of India.

"As part of such due diligence obligations, it is the responsibility of concerned intermediaries and VPN service providers to take immediate and effective action under the IT Rules, 2021 by ensuring that no user is allowed to host, display, publish, transmit, store, update or share any information that belongs to another person and to which the user does not have any right or is invasive of another's privacy, or affects public order, security of the state or sovereignty and integrity of India, or violates any law for the time being in force including provisions under the IT Act," the advisory read.

"Considering the serious nature of the situation, the Ministry of Electronics and Information Technology ("MeitY") hereby reiterates, with heightened emphasis, that all VPN service providers and other intermediaries must make reasonable efforts to not permit the access of any such websites including "proxyearth.org", leakdata.org" and such other websites operating in violation of law," it added.

This is not the first time that VPN service providers have been in the crosshairs of the IT Ministry. In 2023, when the Indian Computer Emergency Response Team issued its cybersecurity directions mandating additional compliance requirements for intermediaries, various VPN service providers such as Surfshark, NordVPN and others opposed the move.

The opposition put the VPN service providers in direct opposition to the IT ministry. The latter had warned that not complying to its directions may result in suspension of its services.