Data breach: Government sends second notices to CA, Facebook

The Union government on Wednesday served a second set of notices to Cambridge Analytica and Facebook over the recent data breach after finding discrepancies between the earlier responses given by the two companies, sources said.

The companies have been asked to reply to the additional queries by May 10. Flagging the "cryptic and evasive" reply given by Cambridge Analytica to the first notice, the government has sought responses for five more posers from the company, the sources added.

They said there were discrepancies in the responses received earlier this month from the British data analytics firm and American social networking giant.

"...It is self-evident that apart from being very cryptic, the unstated intention was to conceal more than reveal," said the latest notice to Cambridge Analytica.

The notice said that given the Facebook submission and following the public apology by the US giant, the onus now lies with Cambridge Analytica.

While Facebook had admitted that nearly 5.62 lakh people in India were "potentially affected" by the data breach incident, Cambridge Analytica had claimed that it does not have any Facebook data on Indian citizens.

In its fresh notice to Cambridge Analytica now, the government has asked that what kind of data was collected in India and the research instruments used to capture such data. It also asked whether the company has harvested any data through third party app and whether or not mining of such data was done with user consent.

A senior IT Ministry official aware of the development said that the government wants to send out a strong signal to international bodies operating in IT and data platform that any manipulation of data of Indians, in violation of law and privacy norms, will be viewed "seriously".

"Any abuse of sanctity and fairness of electoral process through digital platform will also be treated seriously," said the official, who did not wish to be named.

The government has also asked Cambridge Analytica whether data collected by the company "under the garb of research" have been used for any election-related work.

It has also sought information on entities operating under the umbrella of Cambridge Analytica and details of directors.

Quizzing the British company on the non-disclosure pacts signed by the company with its associates and clients for Indian assignments, the government has asked it to share the templates that were used in signing such agreements.

The notice to Facebook takes note of the candid admission by the US company of unauthorised use of its user data by Cambridge Analytica, and asks it to list out security architecture proposed to be created "so that data concerning Indians are not pilfered or manipulated again for extraneous purposes including to influence the elections".

The government also asked Facebook about steps it plans to take to clamp down on any unauthorised use of data or manipulation, and fixed a deadline of May 10 for responses for both the companies. 

It has also sought from Facebook details of its privacy policy, extent of data collected by the company, consent mechanism, authorisation mechanism that allows apps to collect user data, and reasons for failure to check the past breach.

The government asked Facebook about corrective actions that are being introduced in future to ensure that privacy of Indian data as also maintaining integrity of electoral process.

"Questions also include as to whether Facebook has initiated any civil or criminal action against entities that have violated the Facebook platform policy and whether changes in Facebook policies were insufficient to deter misuse of its platforms," the official said, noting that Facebook in its previous reply has already owned up on the extent of data breach, while Cambridge Analytica's replies had been "unsatisfactory".

Facebook has been facing intense scrutiny from its users as well as governments across the globe after a data leak scandal hit about 87 million users.

British data analytics and political consulting firm Cambridge Analytica has been accused of harvesting personal information of millions of Facebook users illegally to help political campaigns and influence polls in several countries.

Meanwhile, Cambridge Analytica has said that all its activities around the world, including in India, will be investigated and reported on.

Facebook, which is facing probes in multiple markets over potential breach of user confidentiality, had earlier this month said it is introducing a third-party fact-checking programme in India to combat the spread of "false news" on its platform, starting with a pilot in Karnataka, which goes to polls next month.