![](\"https:\/\/media.wired.com\/photos\/6271744df2e5a2b3f2ddf349\/master\/pass\/India-Privacy-Tata-App-Security-GettyImages-981948872.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Varsha Bansal| Date: Wed, 04 May 2022 11:00:00 +0000<\/strong><\/p>\n Varsha Bansal<\/a><\/span><\/span><\/p>\n To revist this article, visit My Profile, then View saved stories<\/a>.<\/p>\n To revist this article, visit My Profile, then View saved stories<\/a>.<\/p>\n On April 7,<\/span> Ranendra Ojha, a marketing professional in the eastern Indian city of Kolkata was looking forward to installing and using the new super app, Tata Neu. Super apps are umbrella mobile applications under which companies offer a bunch of services. But as soon as Ojha installed and signed up for Tata Neu on his phone number, he was appalled to see that this newly launched app already had three of his old addresses along with his full name\u2014details he never shared with the app.<\/p>\n As he dug further, Ojha realized that the app seemed to have pulled data from the grocery app Big Basket, which Ojha uses frequently. Like Big Basket, Tata Neu is owned by the almost 155-year-old Tata Group. One of India\u2019s largest conglomerates and a household name, the Tata Group sells everything from salt to software and recently forayed into the world of consumer tech through a slew of acquisitions<\/a>.<\/p>\n \u201cFrankly, I was quite shocked that Tata had picked up my personal details from one of the apps they owned and used it for this new app,\u201d Ojha says. \u201cIn effect they have shared my personal details with the whole Tata Group companies without my permission.\u201d<\/p>\n Another user based in the southern Indian city of Bangalore was equally shocked when he saw multiple addresses (including the address of his old home, where he doesn\u2019t live anymore) and his date of birth already preloaded on Tata Neu when he signed up for it using his phone number and a one-time password. What he found more perplexing was that his wife\u2019s Tata Neu also had her old office address, which he says they never used for any purpose. \u201cPersonally I am a very big fan of Tata Group, and there is trust when it comes to the Tata brand,\u201d says Naren, who requested to be quoted under a pseudonym, fearing backlash from the company. \u201cBut that trust is lost when they do these sorts of sneaky things under the name of user experience.\u201d<\/p>\n Tata Neu was launched in the first week of April and has had at least 2.2 million downloads<\/a>. The app houses all of the company\u2019s brands ranging across industries such as ecommerce, financial services, airline tickets, grocery, medicines, and hotels. But the inclusion of preloaded personal data in a new app means that the Tata Group has managed to save customer data across its online and offline companies and create their profiles. According to privacy advocates, this is problematic because it happened without users giving explicit consent and in the absence of a comprehensive data-protection law in India.<\/p>\n The Tatas, with a market cap of over $300 billion<\/a> at current exchange rates, have had a strong offline presence across a wide range of sectors. But, until relatively recently, consumer tech remained an untapped market. So a few years ago, in a bid to compete with tech biggies like Amazon and Walmart-owned Flipkart, Tata started building its digital profile by acquiring startups like Alibaba-backed online grocery firm Big Basket and medicine delivery startup 1mg, along with an investment in health-and-fitness startup Cult.Fit.<\/p>\n Some customers of these startups acquired by Tata received an email with updated terms and conditions. Others, including the author of this piece, received no email and are unaware of any other form of notice. And while previous privacy policies of these apps vaguely said that they may share customer data with partner companies or other third parties in the event of an acquisition, experts say it\u2019s the lack of explicit consumer consent coupled with the fact that this is data collected from acquired companies which, according to long-time privacy advocate Nikhil Pahwa, makes it \u201can ethical failure on the part of the Tata Group.\u201d<\/p>\n \u201cAll super apps already do this [data sharing] but the difference for Tata Neu is the fact that they have acquired companies and then connected all of this data together,\u201d says Pahwa, founder of digital media portal Medianama<\/a>. \u201cThere is a different threshold of accountability for them, because customers who were using an app or service before acquisition naturally didn\u2019t expect that the data would be linked to data from multiple different apps when an acquisition takes place.\u201d<\/p>\n In response to queries sent by WIRED, a Tata spokesperson defended the company\u2019s business practices and asserted that it is committed to user privacy and security.<\/p>\n \u201cRespecting and safeguarding our customers' privacy is vital to our business at Tata Digital. We take great care to maintain the confidentiality of their information,\u201d the spokesperson said. \u201cTata Digital complies with, and will continue to comply with, applicable data regulations, both in letter and spirit.\u201d<\/p>\n Last year, WhatsApp\u2014for which India is the largest<\/a> market\u2014updated<\/a> its privacy policy to require users to accept sharing their data with its parent company, Facebook (now known as Meta). This led to an outrage among its users, many of whom abandoned<\/a> WhatsApp (if only temporarily) and moved en masse to other messaging apps like Signal and Telegram.<\/p>\n The Competition Commission of India, India\u2019s antitrust agency, soon initiated regulatory action<\/a> against WhatsApp for the unilateral changes to its privacy policy on the grounds of abuse of dominance. But antitrust and privacy lawyers say it may be difficult to make the argument of unfair policy terms as a form of abuse of dominance in the case of a new entrant like Neu, because it has a relatively small market share so far. \u201cHowever, if any of the Tata affiliates hold a clear dominance in the markets that they operate in, then any sort of coercive data sharing with Neu could potentially raise competition law issues for that entity,\u201d says Smriti Parsheera, a tech policy researcher with the think tank National Institute of Public Finance and Policy.<\/p>\n Tata\u2019s data sharing stands against the void of a lack of a comprehensive data protection law in India. The closest thing the country has is now a finalized<\/a> Data Protection Bill, 2021. But the legislation hasn't been passed and relies on \u201cinformed\u201d consent as one of the main grounds of data processing\u2014meaning companies could still bury alerts about how their data could be used under a mountain of legalese while giving people no opt-out beyond not using the service.<\/p>\n \u201cMerely having the new law would not completely solve the problem,\u201d says Parsheera. \u201cBut it will create a framework of accountability where the new regulator can take actions, and consumers can seek redress.\u201d The new regulator would also be expected to frame regulations around the tools that can be used to make privacy policies more understandable to users.<\/p>\n Ojha, for one, is not waiting for the Indian government to bring a legal framework for data protection. He decided to delete the app the same day it first resided on his phone\u2019s home screen. \u201cI found it very cumbersome and absolutely zero value addition to me,\u201d he says. \u201cAlso, I was uncomfortable that they were using my personal information without my explicit permission.\u201d<\/p>\n