The Ministry of Civil Aviation issued a public notice on Monday, 13 January, requiring drone operators to register their unmanned aerial vehicles (UAV) by 31 January.
The voluntary registration requires the submission of sensitive personal data including Aadhaar/passport, bank statements, PAN details. However, this process, meant to be carried out online by the DGCA appears to redirect users to a page owned by a private IT company and not by the Civil Aviation Ministry.
What does this mean? Sensitive information pertaining to drone operators and owners is being collected not by the government but by a private entity whose identity or information has not been disclosed. The Director General of the DGCA has confirmed that it is a private entity which runs the page.
The collection of Aadhaar data without an underlying legal framework appears to be in contravention of the Supreme Court order of September 2018 which bars such access by private companies without a specific law.
Importantly, the public notice mentions only the DGCA’s link and not the privately run page that is actually carrying out the enlistment of drones.
The Ministry’s public notice states that drone operators need to “submit the required information to the government” and directs users to log on to the ‘Digital Sky’ URL “digitalsky.dgca.gov.in” within the DGCA website to obtain “details of the submission process”.
‘Digital Sky’ is an online IT platform developed for handling UIN, UAOP applications, permission to fly RPAs in India
However, this link redirects users to an external registration page -ndr.digitalskydgca.in/ndr - which neither bears the gov.in domain extension nor is a part of the Ministry’s website.
Despite being a privately run page, the domain name of the page contains the letters ‘dgca’ as well as the State Emblem of India.
Neither the ministry, nor the page itself informs the users that the information, which includes sensitive personal information Aadhaar/passport, educational qualification and bank statement among other details, is being handed over to an unspecified private entity. This raises questions of access to Aadhaar data by a private firm.
Who Is Collecting The Data?
The Quint ran a check and found the page to be run by a private IT Company called ‘Happiest Minds Technologies’. The company, headquartered in Bengaluru, has offices in the US, UK, Canada, Australia and UAE. The company’s website “offers domain-centric solutions applying skills, IPs and functional expertise in IT services, product enginnering, infrastructure management and security.
gov.in domain names are reserved for government entities and can only be used by a government ministry or department - in this case the Directorate General of Civil Aviation (DGCA) which comes under the Ministry of Civil Aviation.
However, the page that it redirects to does not have the gov.in domain extension. The domain name of the registration page is ndr.digitalskydgca.in/ndr.
The information required to be submitted includes:
- The front and back of Aadhaar card or passport;
- PAN number;
- Educational qualification;
- Copy of any utility bill (Electricity, water, gas, fixed line telephone or mobile phone) or a bank statement not older than 3 months; and
- Three high quality pictures of your drone: front-view, top-view; and a close-up view of the manufacturer’s serial number.
The page does not contain a privacy policy which lays out the terms of data usage.
The Quint spoke with Arun Kumar, Director General of DGCA, who confirmed that the page is indeed managed by the private company.
“It is managed by a private agency and handled by Airport Authority of India. We are not directly involved in it.”Arun Kumar, Director General, DGCA
Kumar, however, said he would not be able to comment on it further. Calls to the Ministry of Civil Aviation and request for comments were declined.
Who Keeps The Sensitive Data?
How the sensitive data of drone owners and operators are is being collected, stored, shared, processed is unknown. The Ministry has not disclosed the terms of its engagement with Happiest Minds and declines request for comments.
The Civil Aviation MInistry had launched the ‘Digital Sky Platform’ in December 2018, to implement the 'no permission, no take-off’ (NPNT) – system of software-based self-enforcement to minimize deviations from the DGCA’s Civil Aviation Requirements (CAR) .
“The regulator allowing a private entity to own operations of regulatory activity including data collection infrastructure makes one wonder if regulation is being privatized and how that could impact policy landscape,” said Srikanth Lakshmanan, a technologist and financial tech researcher.
“It is strange why only passport or Aadhaar was requested in the form while not including other ID documents. There seems to be no rationale and the only common thing between the two is both being biometric ID while others are not,” he added.
How Are Drones in India Regulated?
Drones or Remotely Piloted Aircraft Systems (RPAS) or Unammed Aerial Vehicles (UAV) in India are regulated by the Civil Aviation Requirements (CAR) issued by the DGCA in August 2018 and operationalised on 1 December 2018.
The regulation specifies 5 categories of drones classified by weight:
- Nano: Less than or equal to 250 grams;
- Micro: From 250 grams to 2 kg;
- Small: From 2 kg to 25 kg;
- Medium: From 25 kg to 150 kg;
- Large: Greater than 150 kg.
All drones and their operators, except for those in the nano category are required to be registered. The CAR provides the process for drones to obtain a Unique Identity Number (UIN) and operators an Unmanned Aircraft Operator Permit (UAOP).
On successful completion of the voluntary disclosure process, the owner will be provided with a Drone Acknowledgement Number (DAN) and an Owner Acknowledgement Number (OAN).
“This was done under provisions of the the Aircraft Act, 1934 and Aircraft Rules, 1937. Under this legal framework the the Director General of Civil Aviation (DGCA) has been vested with exclusive powers to regulate the use and operation of drones,” Internet Freedom Foundation said in a post on 28 December.
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)