Supporting Agency Privacy Policy
Draft data privacy policy for supporting agencies
Scope
This document is a sample data privacy and protection policy for support agencies[1] to pick up and replicate on their user-facing web pages. Entities using this document may make modifications as relevant to the context in which they are using this document.
This document is a draft for reference and does not have any legal effect in and of itself.
eGovernments Foundation does not guarantee that this document will correctly represent all relevant laws or legal obligations, as these can vary across jurisdiction and time.
eGovernments Foundation does not guarantee that the use of this draft, with or without modifications, will cover any or all legal obligations of a specific entity in a specific jurisdiction.
Any entity or individual that uses this draft, with or without modifications, does so at their own discretion, and at their own risk.
By using the draft policy provided, you acknowledge and agree that:
The draft policy is provided for informational purposes only and does not constitute legal advice.
The draft policy is a general template and may not be suitable for your specific needs or circumstances. It is your responsibility to review and modify the draft policy to meet your requirements.
We make no representations or warranties, express or implied, regarding the accuracy, completeness, or reliability of the draft policy. We do not guarantee that the draft policy is up-to-date or compliant with current laws or regulations.
You assume all risks and liabilities associated with the use of the draft policy. We shall not be held liable for any direct, indirect, incidental, consequential, or special damages or losses arising from the use or reliance on the draft policy.
We recommend consulting with a qualified legal professional to obtain advice tailored to your specific circumstances before implementing any policy based on the draft provided.
By using the draft policy, you agree to release and discharge us from any claims, demands, liabilities, actions, or causes of action arising out of or in connection with the use of the draft policy."
It is crucial to seek legal advice to ensure that this policy meets your specific requirements and is enforceable in your jurisdiction.
Draft Data Privacy Policy For Support Agencies
<SUPPORT AGENCY NAME> as a SUPPORT AGENCY (SA)[2] (“we” or “us” or “our”) for <PROGRAM NAME> respects the privacy of the users (“user” or “you” also referred to as ‘your’). Hence, we maintain the highest standards for secure activities, user information/data privacy and security.
<PROGRAM NAME> is implemented through a collaboration between the <ADMINISTERING AUTHORITY NAME>, and/or <IMPLEMENTATION AGENCY NAME>> and eGovernments Foundation. It is powered by DIGIT, which is an open-source software platform developed by eGovernments Foundation.
This privacy policy describes and determines how we deal with your personal and usage information in accordance with the applicable laws of India.
<PROGRAM NAME> refers to the services being provided through <PROGRAM NAME> website, mobile App, <OTHER CHANNELS AS RELEVANT>.
Through <PROGRAM NAME>, you can access and avail services offered by <STATE OR ULB NAME> Government departments, Central Government department, Local bodies & their agencies and corporate/private bodies (utility services) (Service Providers).
You can use <PROGRAM NAME> website/application/services in different ways such as service discovery, availing services, registering grievances, and so on.
1. OBJECTIVE OF THE POLICY
The purpose of this policy is to maintain the privacy of and protect the personal information of users, employees, contractors, vendors, interns, associates, and partners of <PROGRAM NAME>. The <PROGRAM NAME> ensures compliance with laws and regulations applicable (partner to insert a list of laws they have to comply with ) to <PROGRAM NAME>.
2. ADHERENCE TO DATA PRIVACY PRINCIPLES
We adhere to the principles of accountability, transparency, purposeful and proportional collection, usage, storage and disclosure of personal data (“PD”)[3].
3. WHAT DATA DO WE COLLECT AND ACCESS?
We only access, store, process, use, or share any information/data (“data”) to assist the program owner/implementation agency. None of the above takes place without a written authorization agreement with the program owner/administering authority.
Data includes PII such as your first name, last name, parent’s / guardian’s name, address, email address, telephone number, age, gender, and identification documents. We may collect your educational, demographic, location, device and other similar information. The nature of the data would change as per the needs of the service providers/ULB/State or Central Government. We do not define the scope of the datasets, the Service Providers do.
We do not collect any data directly from you. We only access, process, use, store, and share datasets given to us by the Administering authority/Program owner/Service providers/Implementing Agencies.
We access data that is required to provide for the functional working, upkeep, troubleshooting and/or any functional support required by the program owner or administering authority .
We process data as a byproduct of the work we undertake for the program owner or administering authority.
We may store and share data that is required to execute the responsibilities given to us. Such storage will be temporary till the period of our work ends. Such sharing shall be restricted to internal teams, for third-party sharing of data, we would have authorizations in place by administering authorities or the program owners.
We also access, store, process, and share information pertaining to employees of our own as well as local government or other government agencies. Specific information can include name, age, gender, details of spouse or dependents, address, administrative details such as employee ID or other reference number, as well as information on bank accounts (used for processing salaries or pensions).
We also access, store, process, and share transactional data, which describes the progress of any ongoing task (e.g. any service requested by a resident) through the systems of the local government or other government agency. This can include information about the specific role to whom a given task is assigned (or with whom it is pending), the amount of time elapsed on processing / completing a given request (or task / sub-part thereof), and whether this task has been completed within the benchmark or designated amount of time. It can also include details about the channel through which a particular request was received, such as the ULB counter, service centre, website, helpline, mobile app, chatbot, etc.
We derive, store, process, and share aggregated data. These aggregates are derived from the transactional data. This includes data such as aggregate or cumulative revenue collection, aggregate or cumulative number of service requests, percentage of requests resolved within the benchmark time period, etc. The above data may be further analysed and presented in terms of the type of collection, request, or complaint, the channel through which it was received, etc.
We may collect, store, process, and share telemetry data, which studies how much time is spent on a given screen or field in a workflow/user interface (UI). Such data is normally processed and shared in aggregate, and will not be used to identify specific individuals. In the event that specific individuals are sought to be identified, such as for user research, their consent will be sought for the further processing or sharing of their data.
4. HOW DO WE ACCESS THIS DATA?
We are either handed over such data by the Service providers or are given authorized permissions to access, process or use such data. We may also collect data from Union, State, and Local governments, including their agents/employees as well as receive data that is available openly for public use.
We do not collect any PD directly from you. We are given authorized access logins by the Program Owners or the Service providers.
We stop accessing, processing, using and storing any PD from the time our role or functions cease i.e. either end of the agreed period or till the final handover.
5. HOW DO WE STORE THIS DATA?
We do not directly store any data in our systems. We are given limited-time access to the storage of the service providers. Such access is required for our functional purposes. Once our purpose is served, our access to such storage ceases to exist.
Data Security Measures
With respect to the data that we access, we adopt the following safeguards:
Define roles for our employees, and only grant access to such data as is needed for them to perform their roles
Maintain logs of access to the program’s systems by these roles, and enable the program owner / administrative agency or other authorised agencies to audit these access logs periodically
We do not store data from the platform implementation/program in our own systems; the employees who have access to this data work on the devices and/or systems of the program owner
We do not share data from the platform implementation/program with any third party, except as specified in our contract with the program owner / administrative authority.
6. WHY AND HOW DO WE ACCESS, PROCESS, AND/OR SHARE THIS DATA?
We use this data to enable the service providers with the requirements they appoint us for, such as setting up hardware, customising, extending, configuring and installing the software, assisting in implementation, training etc. Specifically:
We access data (either anonymised/metadata) for:
Studying the feasibility of the requirements asked for by the Service providers
Creating an implementation plan for the administering authority ( the plan would have no PD, but to design the implementation plan, a study of PD would be undertaken)
Measuring the performance and adoption metrics
Training and awareness-building activities
We may access and process data for conducting research or analysing user preferences and demographics if asked to by the service providers ( statistical data and not any individual data)
We access PII for:
Testing for to be deployed or integrated hardware and software at identified urban local bodies or jurisdictions - as instructed to us by the service providers.
Master data cleaning and validation before deployment and integration
For resolving any disputes, troubleshooting any problems, and solving for critical bugs that may arise with respect to the use of the platform.
Sharing data in order to comply with the law or any legal process, including when required in judicial, arbitral, or administrative proceedings.
We will not process, disclose, or share your data except as described in this policy or as otherwise authorized by the Service Providers..
7. HOW DO WE PROTECT PERSONAL DATA (PD)?
By default, we do not display, or store any PD. Only persons with the appropriate authorisation can access PII. We log each such request, thus creating a non-repudiable and auditable trail of each such access to PD[4]. We do not share any PD unless asked to do as under a contractual understanding with the Service provider.
8. CAN THIS POLICY BE CHANGED?
Yes, this policy is subject to change at any time and without notice. This page will be updated with any such modified policy, and such changes will not be deemed to take effect until and unless they are shown on this page. You are reading the current version of the policy.
9. YOUR CONSENT TO DATA COLLECTION, PROCESSING, DISCLOSURE, AND/OR SHARING.
By using this service, you confirm that you have read, understood, and accepted this Policy, and that we may access, process, disclose, and/or share your data as described in this Policy.
10. GRIEVANCES
In case of any grievances, you may send your complaints for redressal over the Grievance Portal available at <LINK TO GRIEVANCE PORTAL / MECHANISM>.
A ‘Supporting agency’ is one that provides support in any functional aspect required by the program owner with respect to that platform implementation (e.g. assistance in maintenance of the platform, technical or operational problem-solving, bug/error resolution). ↑
An IA is an agency that deploys and configures a platform for the program owner ↑
Once the PDP Bill is introduced, a formal/detailed Privacy Policy can be drafted and linked here. ↑
As above, this can be detailed in the Full Privacy Policy. ↑