In blatant disregard for privacy norms, Indian Railways Catering and Tourism Corporation (IRCTC), a PSU that provides ticketing, catering and tourism services for the Indian Railways, has floated a tender to hire a consultant to monetise digital assets such as rail ticketing data, user base and passenger travel-related transactions. The IRCTC hopes to generate revenue of Rs 1,000 crore through this monetisation exercise. Incidentally, the share of IRCTC’s revenue from its internet ticketing unit came down to 35. 4% for the April-June period from 42. 3% in the previous three months. According to the tender, the consultant will be expected to study passenger data, freight and parcel business as well as any vendor-related data from applications of Indian Railways. The customer data to be studied includes, 'Name, Age, Mobile No. , Gender, address, E-Mail ID, No. of Passenger, Class of Journey, Payment Mode, Login/Password,' in addition to behavioural data such as payment and booking mode and frequency of journey’. Link to e-tender document: https://irctc. com:8080/IRCTC/downloadUploadTenderFile?fileName=uploadTender-349-29_08_2022. pdf The consultant will have to segregate monetisable data sets, identify market potential internationally and prepare a roadmap for data monetisation of the digital data. They will have to carry out in-depth analysis to identify and prioritize opportunities and projects in line with strategic objectives of various departments. They are required to pipeline of existing and upcoming projects to identify suitable projects and handhold in monetisation of digital data of Indian Railways. The tender states that the consultant should create a comprehensive framework for analysing various parameters of an investable project and identify large ‘Marquee Projects’ in innovation driven sectors. “The projects need to be marketable and need to have strong demand in the industry,” states the e-tender. They should also study various Acts or laws including IT Act 2000 and its amendments, user data privacylaws including GDPR (General Data Protection Regulation) and current ‘Personal Data Protection Bill 2018 of India, and accordingly propose the business models for monetisation of Digital Assets. It may be recalled that earlier this month, the Union government withdrew the Personal Data Protection Bill that was formulated in 2018 and re-written by the Joint Committee of Parliament in 2021. The consultant is required to “ascertain the legality and extent of monetisation of digital data of Indian Railways before the potential is delved into”. In 2017, Indian Railways had announced that they were set to monetise millions of phone numbers and email IDs of rail passengers as more than 100 terabytes of passenger data is presently in possession of Indian IRCTC. Digital rights group Internet Freedom Foundation tweeted that IRCTC, a government-controlled monopoly, must not prioritise perverse commercial interests over the rights and interests of citizens. And given the recent withdrawal of the Data Protection Bill, 2021, such monetisation becomes even more concerning. .