After the recent Delhi riots, there were unsubstantiated allegations that people used the VAHAN database of the Ministry of Road Transport & Highways to identify & target vehicles belonging to people of a particular community. But what is this VAHAN database? What kind of information is available in the public domain?
The Ministry of Road Transport and Highways (MoRTH) allows people to check the registration status of vehicles in the Vahan website and application. Upon entering a vehicle’s registration number, one can get ownership details of the vehicle including name of the owner etc. There were allegations on social media that the rioters in Delhi used this provision to target a certain religious community by burning the vehicles belonging to them.
Vahan and Sarathi are applications created by MoRTH in 2011 under the National e-Governance Policy. They are designed, maintained, and supported by the National Informatics Centre. Vahan is a data repository of all vehicles registered in the country while Sarathi consists of computerized data on Driving Licenses in India. MoRTH also has an application called, mParivahan, through which one can get instant access to information, services and utilities. As on 12 March 2020, as per Vahan website, there is a total of 285,768,212 digitized vehicles. That is, data of more than 28.5 crore vehicles is available in Vahan website and application.
Bulk data sharing by government is based on National Data Sharing and Accessibility Policy
The National Data Sharing and Accessibility Policy is India’s policy for sharing data by the government in the open formats. The policy makes it easier to share data and increase its accessibility for social, economic, and developmental reasons. It is clearly mentioned that only non-sensitive data will be available. As per the policy, all departments and ministries must make a list of datasets which are confidential in nature and may pose a threat to national security if they are placed in the public domain. Vahan and Sarathi databases are supposed to be shared in conformity with this policy.
The following information can be obtained in the VAHAN application and website when one inputs the registration number of the vehicle.
- Owner Name
- Registration date
- Registering Authority
- Make Model
- Fuel Type
- Vehicle Age
- Vehicle class
- Insurance Validity
- Fitness Validity
The last but four alphanumeric characters in the Chassis number and Engine number are hidden in the display.
Allegations that rioters in Delhi used government’s application to target cars of one community
The allegation on social media was that the attackers made use of the application, in order to identify vehicles belonging to Muslims and then burnt them down. However, there is no concrete evidence to back this claim. Following this claim, an NGO has written to the government asking it to stop public access of VAHAN data.
State specific websites also provide details on vehicle registration and driving license
In addition to VAHAN, multiple states also have their own websites which provide access to vehicle details. But the details that need to be entered (input) and information that is displayed vary. The transport department’s webpage of most of the states- Jharkhand, Himachal Pradesh, Meghalaya, Rajasthan, Tamil Nadu, Uttarakhand, Uttar Pradesh, West Bengal, and Delhi redirects the user to the MoRTH’s Vahan website.
Only Andhra Pradesh, Chhattisgarh, Kerala, Madhya Pradesh, Odisha, Punjab, Telangana, and Tripura have their own websites to search for vehicle registration details. In the following table, the information required (input) to access the required data in the respective state websites have been listed.
| State | Information required (input) |
|---|---|
| Andhra Pradesh | Registration Number or Chassis Number, TR Number or Engine Number |
| Chhattisgarh | Registration Number, Chassis Number, or Engine Number |
| Kerala | Registration Number, or Chassis Number |
| Madhya Pradesh | Registration Number, Chassis or Engine Number- also one can do character search (i.e., starts with, ends with, anywhere, exact) |
| Odisha | Both Registration and Chassis or Engine Number |
| Punjab | Registration Number and Chassis Number |
| Telangana | Registration Number/TR Number and last five digits of Chassis number, or Chassis, or Engine Number |
| Tripura | Last five digits of both Registration Number and Chassis Number |
Applicant’s basic details are recorded in Karnataka before providing details on vehicle registration
In Karnataka, citizens can get vehicle owner’s information from ‘Karnataka One’ centers in the state. To get an extract of the registration certificate of the vehicle, one must provide the registration number of the vehicle. They will receive the name of owner, RTO code and vehicle chassis number. A nominal amount must be paid by cash to retrieve RC extract. Currently, the charges are Rs. 18. Details of applicant such as name, contact number, and address will be recorded.
Madhya Pradesh’s website even reveals address of vehicle owners
Madhya Pradesh’s website reveals lot more information about the registered owner like
- registration details
- tax related
- permit, fitness, insurance, hypothecation details
- NOC, history, and lease
- permanent and current address of the owner
The websites of Kerala, AP, and Chhattisgarh, like in the case of the VAHAN, provide details of registration, tax related information, vehicle’s model and type, manufacturer, financier, and NOC. Kerala’s website gives more specifications of the vehicle such as body type and capacity. Andhra Pradesh gives only the last five digits of Chassis number and Engine number whereas Kerala government does not give out the Chassis number.
Thus, the level of display & amount of information available in the public domain is different in different states. While registration number of the vehicle is easily available from the number plates, which are visible to all, government can restrict access to the data by asking for Chassis number or Engine number which, in most cases, will be available only with the vehicle owner. Even though states like Telangana and Tripura have tried to restrict access, the requisite data of these states is also available in the national level portal.
It is also true that in the case of certain classes of vehicles like commercial vehicles with permits, school buses, ambulances etc., information has to be available in the public domain.
In March 2019, MoRTH announced policy on bulk sharing of Vahan and Sarathi database
On 08 March 2019, in a step towards monetization of data, MoRTH released an advisory that bulk data collected under Vahan and Sarathi pertaining to Vehicle License and Driving License respectively will be shared at specified rates. MoRTH, in the advisory, mentioned that the increasing demand for this data can be met with the help of this policy. Commercial organizations and individuals could avail the data for Rs. 3 crores and educational institutions and researchers could avail the same for Rs. 5 Lakhs in 2019-20. From 2020-21, an annual increase of 5% in the price will be applicable.
Government has earned a revenue of Rs.65 crores by selling data in three months
As of July 2019, as per the answer provided by the Minister of Road Transport in the Rajya Sabha, government had the data of about 25 crore vehicle registrations and approximately 15 crore driving license records, from the sale of which the government had earned a revenue of Rs. 65 crores. Further, 32 government entities and 87 private entities had access to this data.
Possibility of misuse of this data cannot be ruled out
The data available in the public domain is helpful for people who wish to buy second-hand vehicles as they can cross check details and validate its history. It will also be beneficial for insurance companies in the claim process. In the case of school buses, the fitness certificates would be handy for parents to cross check the fitness of the vehicles.
However, there are contrarian arguments about the possible misuse of such a database. In fact, the Ministry itself has acknowledged the possibility of triangulation in the policy. The advisory also lists the action taken against the violator which is a ban from accessing the data for three years.
India does not have a data protection law yet
It is important that government takes the consent of people before exposing their data in the public domain. One should also remember that India does not have a data protection law yet. The Personal Data Protection Bill was introduced in the Lok Sabha in December 2019. The Bill has been sent to the Joint Parliamentary Committee for further deliberations.
In July 2019, FACTLY wrote to MoRTH to understand more about the data sharing policy. However, despite multiple follow ups, MoRTH hasn’t responded to the below questions.
- Was any public consultation held prior to the publication of the notification?
- In the 3rd paragraph, it has been mentioned that the ‘…There have been continuous advances in technology and the range of purposes for which individuals and organizations want access to the DL&RC data. There has been growing demand to share the data for wider benefits..’ What is the range of purposes? What has been the growing demand to share data for?
- Paragraph 8, (vi) states,’… There is possibility of ‘Triangulation’ (matching different data-sets that together could enable individuals to be identified and their privacy compromised). It is the responsibility of the organization that any such activity, which result in identifying individuals using the RC data-set, shall not be undertaken…’ It has been clearly mentioned that merging of this data will result in identification of individuals and puts the privacy of individuals at stake. How is this going to be tackled? Has any measure been taken to prevent it? What is the penalty/ punishment imposed on the organization if such an act takes place? For instance, most state road transport websites provide an option to verify the name and other details of the vehicle owner using the Registration Number & Chassis number. What if the agencies use the released data to find out names and other details of the vehicle owners?
- Is there any option where the individual has an option to choose privacy of their data- whether or not they wish to reveal it or give consent for sharing?
- Is there an authority where a complaint can be lodged if any misuse of such data is found?
- Are the names of the agencies that have paid the requisite amount made public? If yes, please provide the names of all the agencies that have bought this data. If the names are not being made public, provide the reasons there of.
ORF has published a detailed assessment of the policy
A detailed assessment of Bulk Data Sharing Policy was published by the Observer Research Foundation (ORF) in December 2019. ORF made a slew of recommendations regarding this policy.
- First, the government must widen the scope of what data is being termed personal data. Currently, the definition of personal sensitive data is as per the outdated IT Act.
- Another recommendation is to hold consultations with various stakeholders.
- It is also recommended that the government specify agencies and types of companies that can access data. Further, agencies and companies must also mention in their contract how the data will be used, as this will increase their accountability.
- It is also important that the citizens can know who has access to their vehicle registration and driving license data and they should have the option to revoke access to their data.
