The reported exposure of vehicle and driving-licence information through apps and websites raises questions about data governance in public digital infrastructure. Discuss the challenges and safeguards required for privacy-preserving e-governance in India. (250 words)

Digital public infrastructure can make services faster, but concentration of identity and mobility data also increases the consequences of misuse. The reported sale of vehicle and licence information highlights the need to combine openness with privacy and accountability.

Nature of the data-governance risk

• VAHAN, SARATHI, e-Challan and PUCC portals hold vehicle-registration, driving-licence, traffic-fine and pollution-certificate information.
• The report said details such as names, addresses, mobile numbers, licence data, challan history, FASTag information and downloadable documents were allegedly accessible through multiple apps and websites, sometimes for as little as ₹5.
• An RTI cited by the Internet Freedom Foundation found that 25,314 credentials had been issued to private entities and 1.708 crore queries were run over 33 months.
• Such data can enable identity theft, targeted phishing, stalking, fraud and the creation of detailed digital dossiers by combining information from different sources.

Governance challenges

Privacy-preserving safeguards

1. Apply data minimisation and purpose limitation: private entities should receive only fields relevant to a legitimate, recorded function, with daily query caps and no unrestricted downloads.
2. Use strong authentication, least-privilege access, tokenisation, encryption at rest and in transit, anomaly detection and independent security audits by CERT-In or designated experts.
3. Maintain immutable access logs and conduct periodic reviews of the 25,314 credentials and high-volume queries; suspend dormant, misused or compromised accounts.
4. Operationalise breach-notification duties and a single citizen-facing channel for incident reporting, account protection and time-bound grievance redress.
5. Parliamentary and public oversight should review data-sharing policies, procurement contracts, vendor liability and compliance with the Digital Personal Data Protection framework.