Friday, October 23, 2026

New information commission faces a bigger task than clearing complaints : Shamsul Bari and Ruhi Naz

The Daily Star: Bangladesh: Friday, 23 October 2026.
After more than two years of uncertainty, Bangladesh finally has a new Information Commission. We congratulate the newly appointed chief information commissioner the country’s first woman to hold the post and the two other commissioners, and wish them success. Their appointment brings relief to citizens and civil society organisations that have persistently called for the restoration of this vital institution.
For about two years, they have highlighted the consequences of leaving the commission without commissioners. Conscious citizens, while continuing to exercise their rights under the Right to Information (RTI) Act, 2009, lacked an effective avenue for redress when public authorities refused to provide information. With commissioners now in place, the institution can resume hearing complaints and appeals and take action within its statutory mandate. The greater challenge, however, lies elsewhere.
The commissioners’ responsibility is not only to dispose of complaints but also to help replace the country’s entrenched administrative culture of secrecy with one of transparency and accountability. The RTI Act’s fundamental objective empowering citizens to understand how public authorities function, scrutinise their activities, and hold them accountable remains far from being achieved. Bureaucratic resistance, inadequate public awareness, and weak institutional capacity have contributed to this failure. Above all, successive governments have lacked a sustained commitment to openness, while successive Information Commissions have failed to use their statutory powers effectively to challenge official secrecy.
The new commission, therefore, must be more than a forum for settling individual disputes. When information is refused, it should carefully examine the reasons, determine whether the refusal was lawful, and ensure that appropriate remedies or penalties are applied where warranted. Securing eventual disclosure alone may leave the underlying violation or the broader culture of secrecy unaddressed.
The RTI Act provides for penalties for specified violations, including unjustified refusal to provide information and deliberate obstruction. Yet previous commissions appeared reluctant to exercise these powers decisively, risking the impression that non-compliance carries little consequence. The new commissioners should enforce the law firmly, fairly, and consistently, paying particular attention to repeated or deliberate violations. A few well-reasoned decisions imposing warranted sanctions could do more to change official behaviour than numerous awareness seminars.
That said, some information may legitimately be withheld under the law. But exemptions from disclosure for reasons set out in the law are exceptions to the principle of openness, not excuses to be used as convenient. A public authority invoking an exemption must identify the relevant legal provision and explain precisely why it applies. Merely citing the act should not suffice. The commission must independently scrutinise such explanations, especially when public expenditure, essential services, or government decisions are involved. Where only part of a document is exempt from disclosure, it should consider whether the remainder can be released.
As discussed in an earlier article, Sri Lanka’s RTI Commission and courts, in a case concerning former President Gotabaya Rajapaksa’s departure during a political crisis, distinguished sensitive security information from details of public expenditure. While protecting information legitimately exempt from disclosure, they upheld the right to access non-exempt information. The lesson is clear: claims of secrecy must withstand rigorous legal scrutiny.
As a statutory adjudicatory body, the Information Commission should issue reasoned decisions that identify the issues, consider both parties’ arguments, apply the relevant legal provisions, and explain its conclusions. Brief directions may settle individual disputes but do little to establish consistent interpretations of the law. Publishing significant decisions in an accessible, searchable format would also guide officials and applicants, promote consistency, and gradually build a valuable body of RTI jurisprudence. Attention must also be given to establishing an effective follow-up and monitoring mechanism, including accountability measures to ensure that concerned designated officers implement decisions in a timely manner.
We have previously documented how ordinary citizens have sought information about schools, hospitals, social protection, land, public works, local public resources, etc. In northern Bangladesh, applicants have questioned the disposal of government trees, investigated abandoned projects, and demanded better services. Some have faced intimidation from officials unwilling to accept their right to ask questions. The commission should respond promptly to such allegations of unlawful refusal, harassment or retaliation, taking appropriate action within its powers. Women, rural residents, and disadvantaged applicants deserve particular attention. 
The backlog of cases accumulated during the prolonged absence of commissioners also demands a published, time-bound plan for disposing of pending cases. The RTI regime’s success cannot be measured solely by the number of applications received or complaints resolved, however. Public authorities must also proactively disclose important information, including their functions, decisions, budgets, expenditure and services, as required by the law.
It bears repeating how vital it is that the commission monitors compliance, publishes its findings, promotes sound record management, and ensures that information officers receive adequate training. It could also publish comparative assessments of public authorities’ disclosure performance using transparent criteria. Such measures would help make openness a routine administrative practice rather than an exception secured through complaints.
The commission must also practise the transparency it demands by regularly publishing its decisions, penalties, compliance rates, and case statistics. It should also consult journalists, civil society organisations, and grassroots RTI users. Above all, it must act independently of political and bureaucratic pressure. The government, for its part, must provide adequate resources while respecting that independence.
In the final analysis, the commissioners inherit not simply a backlog of cases needing adjudication but also an unfinished democratic mission. Their success in the long term will be measured by whether public officials become more willing to disclose information and citizens more confident in demanding it. They take office amid high expectations, shaped by both the commission’s prolonged inactivity and the changed political environment post-uprising. We hope they will rise to the challenge and ensure that citizens’ right to know is not merely a promise enshrined in law but a reality in everyday life.
Dr Shamsul Bari and Ruhi Naz are, respectively, the chairman and deputy director (RTI) of Research Initiatives, Bangladesh (RIB). They can be reached at rib@citech-bd.com.
Views expressed in this article are the author's own. 

Special Flight Returns (SFR-II) of PM’s foreign visits can be withheld under RTI Act on security grounds: Delhi High Court : By Ritu

SCC Online: New Delhi: Friday, 23 October 2026.
The Court held CIC erred in directing disclosure of SFR-II records, as redaction could not remove the security risks.
Delhi High Court:
In a petition filed under Articles 226/227 of the Constitution of India assailing the Central Information Commission’s (CIC) order dated 8 July 2020 directing disclosure of Prime Minister’s special flight returns (SFRs) records, a Single Judge Bench of Amit Mahajan, J., held that SFRs containing details of the Prime Minister’s foreign air travel can be withheld under Section 8(1)(a) and (g), Right to Information Act, 2005 (RTI Act), where disclosure could jeopardise national security or endanger the life and physical safety of the Prime Minister. Accordingly, the Court set aside the CIC’s direction to disclose the records, holding that “redacting the names of security personnel alone could not eliminate the potential risks to the Prime Minister’s security.
The Court observed that,
“The mere fact that public funds have been expended on the foreign visits of the Hon’ble Prime Minister does not, by itself, justify disclosure of information which may compromise the security arrangements put in place for such visits.”
Brief Facts
In the instant matter, the respondent sought information under the RTI Act, concerning foreign visits undertaken by the Prime Ministers of India in Indian Air Force aircraft from 1 April 2013 onwards. He specifically requested copies of Parts I and Part II of the SFR relating to the visits of former Prime Minister Manmohan Singh and Prime Minister Narendra Modi.
The Indian Air Force furnished certain travel information but refused to disclose the SFRs, citing the sensitive nature of the records and exemptions under the RTI Act. The first appellate authority upheld the denial.
On appeal, the CIC, by its order dated 8 July 2020, directed the Air Force to provide certified copies of the available and relevant SFR-II records. Challenging this direction, the Central Public Information Officer approached the Delhi High Court.
Issue for Consideration
Whether the CIC could direct disclosure of SFRs concerning the Prime Minister’s foreign visits after redacting the identities and particulars of security personnel, when such disclosure could compromise national security and personal safety?
Analysis
The Court stated that though the RTI Act seeks to promote transparency and accountability in the functioning of public authorities, but the right to information is not absolute and must be balanced against other public interests, particularly the confidentiality of sensitive information and national security. It relied on CBSE v. Aditya Bandopadhyay, (2011) 8 SCC 497, wherein it was emphasised that the RTI Act requires a reasonable and balanced approach to reconciling transparency with the protection of competing public interests.
The Court noted the Air Force’s contention that SFR-II records contained interconnected particulars, including passenger names, designations, appointments, identification numbers, flight references, passenger strength and agency details. It accepted the Air Force’s submission that disclosure of these particulars, even after redaction of direct identifiers, could enable the reconstruction of sensitive security arrangements by correlating the information with material already available in the public domain.
The Court noted that “Section 8(1)(a) of the RTI Act specifically exempts information, the disclosure of which would prejudicially affect the sovereignty and integrity of India, the security, strategic, scientific or economic interests of the State, its relations with foreign States, or lead to incitement of an offence. Section 8(1)(g) of the RTI Act specifically exempts information, the disclosure of which would endanger the life or physical safety of any person.”
Relying on Supreme Court of India v. Subhash Chandra Agarwal, (2020) 5 SCC 481, the Court observed that Section 8(1)(a) and (g) provide exemptions concerning national security and information whose disclosure could endanger a person’s life or physical safety. It also referred to Bihar Public Service Commission v. Saiyed Hussain Abbas Rizwi, (2012) 13 SCC 61, on the scope of the protection under Section 8(1)(g).
The Court held that the CIC and the High Court cannot sit in appeal over the subjective satisfaction of the competent security agencies on whether disclosure could jeopardise national security or endanger the Prime Minister. Such an assessment fell primarily within the domain of agencies responsible for the Prime Minister’s security. (V.K. Singh v. Union of India, 2010 SCC OnLine Del 4342)
The Court further held that the expenditure of public funds on foreign visits, by itself, did not establish sufficient larger public interest to justify disclosure of information that could compromise security arrangements.
Decision
The Court held that the CIC had erred in directing disclosure of SFR-II records after redaction of the names and identifying particulars of security personnel. The Air Force was justified in invoking Section 8(1)(a) and (g), RTI Act in view of the potential implications for national security and the Prime Minister’s life and physical safety.
Accordingly, the Court allowed the petition and set aside the CIC’s impugned order dated 8 July 2020.
[Central Public Information Officer, Directorate of Personal Services, Air Headquarters, Indian Air Force v. Commodore Lokesh K. Batra (Retd.), W.P.(C) 10165/2020, decided on 15-10-2026]

RTI reveals Cabinet declined to act on Election Commissioners’ complaints against senior official

Times of India: New Delhi: Friday, 23 October 2026.
The Cabinet Secretariat refused to address the grievances submitted by two Election Commissioners regarding the conduct of a senior official, noting that their letters were written in an "individual capacity" and that in the absence of "any official communication from the Commission as a whole, any action at this stage may be inappropriate", according to documents disclosed under the Right to Information (RTI) Act.

Chief Election Commissioner (CEC) Gyanesh Kumar and Election Commissioners Sukhbir Singh Sandhu and Vivek Joshi

Records made available to RTI campaigner Commodore Lokesh K. Batra (retd) show that Election Commissioners Sukhbir Singh Sandhu and Vivek Joshi sent two independent letters on July 29 to India's top civil servant, Cabinet Secretary T.V. Somanathan, raising serious concerns regarding Senior Deputy Election Commissioner (Sr DEC) Maneesh Garg, an IAS officer posted to the poll body by the Appointments Committee of the Cabinet (ACC) since September 2, 2024.
The Indian Express had reported in September that both Sandhu and Joshi wrote separately to Somanathan after internal orders were issued regarding work allocation. The Commissioners feared this order threatened to centralise powers at the Election Commission headquarters to insert, delete, and alter voter records, rather than leaving those functions with state-level authorities.
In an official response on September 26, the Election Commission (EC) clarified that the contested work reallocation directives drafted by the officer were never enforced, following instructions issued by the two Commissioners.
The poll authority maintained that the representations sent by Sandhu and Joshi to the Cabinet Secretary strictly related to an officer on deputation, rather than matters regarding internal policy or the information technology division.
"Both the ECs have stated that Shri Garg, after assuming the charge as link officer of DEC (Admn), has issued an order regarding work allocation of equivalent and senior officers to him without discussing the revised work allocation with the Commission or the officers concerned. Further, the aforementioned ECs have stated that this has happened despite repeated oral and written instructions to all concerned officers against taking such actions without prior discussion/approval of the Commission," an internal Cabinet note provided under the RTI response said.
The Commissioners had contended that Garg issued a directive altering work responsibilities among senior deputy election commissioners, deputy election commissioners, directors general, and officers of parallel rank without consulting or intimating the Commission or the Commissioners involved.
They maintained that this step was taken in spite of repeated verbal and written directives prohibiting such structural changes without preliminary Commission discussion or clearance. Joshi added that when he asked for the relevant file from the Administration Division, it was not provided to him.
The Commissioners stressed that Garg's actions constituted an outright breach of the Chief Election Commissioner and Other Election Commissioners (Appointment, Conditions of Service and Term of Office) Act, 2023.
A Cabinet note prepared on August 3 concerning the complaint noted: "In this connection, we may request the Chief Election Commissioner for his opinion on the issue. Accordingly, a draft DO is put up for approval, please."
The following day, an additional draft note advised that taking steps based solely on letters from two Election Commissioners—without a formal corporate submission from the Commission in its entirety —could be viewed as "interference in the functioning of the constitutional body".
"The Commission is a Constitutional Body and is insulated from executive interference by design to ensure that it functions independently and in a transparent manner. The working and functioning of the Commission are governed by the rules and guidelines of the Election Commission. The above communications are from the Election Commissioners in their individual capacity and, while they must be taken with due seriousness, they cannot be seen as a formal communication from the Commission as a whole," the note affirmed.
The note added that while Garg was deputed via the ACC, he is presently an officer serving the Election Commission of India; consequently, his professional conduct and duties must be regulated and supervised strictly under the Commission's internal guidelines.
Under Section 18 of the Chief Election Commissioner and Other Election Commissioners (Appointment, Conditions of Service and Term of Office) Act, 2023, the Commission's business must be conducted unanimously wherever possible, with any divergence of opinion resolved by majority vote, the Cabinet note observed.
"Election Commissioners have sent these communications for appropriate action; however, in the absence of any official communication from the Commission as a whole, any action at this stage may be inappropriate. It may also be construed as interference in the functioning of the Constitutional Body. Hence, it would be appropriate to send acknowledgement to both Election Commissioners with a copy to PPS to CEC for information of CEC," the record highlighted.

Thursday, October 22, 2026

720 killed, 2,408 injured in Mumbai disasters over 6.5 years: RTI

Times of India: Mumbai: Thursday, 22 October 2026.
At least 720 people were killed and 2,408 injured in multiple disaster incidents in Mumbai between January 2020 and September 2026, information obtained under the Right to Information (RTI) Act from the BMC’s Disaster Management Department has revealed.
Building collapses, fires and short circuits, and drowning incidents accounted for a significant share of the fatalities, according to the data provided to RTI activist Shakeel Ahmed Shaikh.
Collapses of houses, walls and portions of buildings killed 179 people and injured 864, while fires and short circuits claimed 168 lives and left 1,048 people injured. Meanwhile, 195 people died and 44 were injured in drowning-related incidents or by falling into wells.
The figures also show that 56 people died and 77 were injured after falling into manholes or drains. Electric shocks claimed 40 lives and injured 57 people, while landslides killed 39 and injured 33.
Recently, on Aug 13, at Ashok Nagar in Ghatkopar area, a landslide killed eight and injured seven.
Falling trees and branches resulted in 22 deaths and 306 injuries during the period.
The information was provided by Sunil Jadhav, public information officer and assistant engineer in the department, in response to Shaikh’s RTI application seeking details of emergency accidents, deaths and injuries between 2020 and 2026.
Shaikh said 328 people died after falling into water bodies, drains, rivers, wells, creeks, quarries and manholes. The data show that the figure included 237 men and 91 women.
The data have brought into focus the risks posed by dilapidated buildings, fire hazards and dangerous public spaces, including manholes and drains. Mumbai’s exposure to heavy rainfall and landslides also makes safety measures at vulnerable locations crucial.
Seeking preventive measures, Shaikh has written to the municipal commissioner and the chief fire officer, calling for regular inspections of hazardous locations, safety measures around open manholes and drains, building safety checks and improvements to emergency response systems.
“While emergency services play a critical role in responding to accidents, the figures raise questions about the adequacy of preventive measures to protect residents from avoidable hazards,” said Shaikh.

Andaman Administration openly violating RTI Rules: claims RTI Activist

Andaman Sheekha: Port Blair: Thursday, 22 October 2026.
Social Worker and RTI Activist, Mr Akshay Pant has claimed that various departments, which come under the Andaman & Nicobar Administration are openly violating the Rulings of Central Information Commission, RTI rules and also the orders of the High Court, while replying to questions asked under the RTI Act 2005.
Recently talking to Andaman Sheekha, Social Worker and RTI Activist Mr Akshay Pant said that the Andaman Nicobar Administration is openly making mockery of RTI Act.
He said that various departments that come under Andaman Administration like Social Welfare Board, Vigilance has made a habit of refusing to reply to RTI question.
He said that whatever question an RTI Activist asks, nowadays they just answer that the information is denied under section 81 (J) or 81 (H).
Mr Pant further said that as per the Rulings of Central Information Commission, RTI rules and also the orders of the High Court if information is denied by the department or whatsoever they have to specifically mention the reason that why the information is denied but it is the lack of knowledge of the Public Information Officer or reasons unknown, they never do that and harass RTI Activists. “Not only this, many departments also never reply the questions on time,” Mr Pant said.
“I request the administration to co-operate with the RTI activists as many corruption cases has come into light after the efforts of RTI Activists,” Mr Pant said.
Giving an example Mr Pant added that the manipulation of Rs One Crore Forty Seven Lakhs in the Social Welfare Department came into light only when he asked questions through RTI and now CBI is inquiring into that matter.

UPSC faces Central Information Commission scrutiny as IPS officer impleads commission over RTI delays

Edex Live: New Delhi: Thursday, 22 October 2026.
The Central Information Commission will examine alleged procedural lapses by the Union Public Service Commission on November 17 after a Rajasthan police officer formally joined the testing authority to the plea
Rajasthan-cadre IPS officer Pankaj Chaudhary on Wednesday impleaded the Union Public Service Commission (UPSC) as a party in a case related to the delay in providing information under the Right to Information (RTI) Act.
The matter is scheduled for a hearing before the Central Information Commission (CIC) in New Delhi on November 17.
The case concerns the non-provision of information within the time limit prescribed under the RTI Act.
By making the UPSC a party to the case, Chaudhary has brought the commission into the proceedings.
The upcoming hearing is expected to provide further clarity on the matter.
The Central Information Commission will hear the case as part of its role in dealing with complaints and appeals related to the implementation of the RTI Act.
The details of the arguments put forward by the parties and the issues to be examined during the hearing are expected to become clearer as the proceedings move forward.
The case has drawn attention because the RTI Act sets specific timelines for public authorities to provide information to applicants.
Timely disclosure is an important part of ensuring transparency and accountability in government offices.
Meanwhile, a separate RTI-related matter has come up in Rajasthan.
According to reports, the Rajasthan Information Commission (RIC) has issued a notice to IAS officer Archana Singh, Secretary of the Department of Personnel, in connection with another case concerning the RTI process.
A hearing in the Rajasthan matter is also expected to take place soon.
However, further details about the notice, the specific issues involved and the response of the officer concerned have not yet been made available.
Both matters have brought attention to the implementation of the RTI Act and the responsibility of public authorities to respond to information requests within the prescribed period.
The November 17 hearing before the Central Information Commission will be important in determining how the case involving Pankaj Chaudhary and the UPSC proceeds.
Further developments in both cases are expected after the respective Information Commissions take up the matters.
The RTI Act is widely regarded as an important tool that allows citizens to seek information from public authorities and strengthens transparency in public administration.

Rs 20k penalty ordered as info delayed by 2 yrs

Times of India: Chandigarh: Thursday, 22 October 2026.
Punjab State Information Commission has imposed a penalty of Rs 20,000 and ordered Rs 10,000 in compensation over a two-year delay in providing information under the RTI Act and continued absence of the public information officer (PIO) despite a bailable warrant.
The action was taken by a bench of Punjab State Information Commissioner Pooja Gupta on an appeal filed by a Ludhiana resident.
The commission noted that block development and panchayat officer (BDPO), Mullanpur Dakha, Ludhiana district, had authorised another official to appear on his behalf despite facing a bailable warrant. That official also failed to bring any reply or information.
The commission observed that the respondent PIO had not attended a single of the six hearings, reflecting a casual approach towards its orders and a failure to perform duties mandated under the RTI regime. It said strict action was necessary to send a clear message to other employees to perform their duties under the RTI Act.
The commission noted that the appellant had made repeated efforts to obtain the information but was made to run from pillar to post without success, even after the commission issued notices in the second appeal.
The commission held that the case warranted compensation under Section 19(8)(b) of the RTI Act. It also observed that the inadequate handling of RTI requests in the office of the BDPO, Mullanpur Dakha, was attributable to absence of adequate machinery for dealing with RTI work.
It ordered that compensation of Rs 10,000 be paid to the appellant from the funds of the office of the BDPO, Mullanpur Dakha, through a demand draft within one month. Invoking Section 20(1) of the RTI Act, the commission held the PIO who was incumbent when the RTI application was filed on March 26, 2024, as well as the present PIO, guilty of failing to provide information within the prescribed 30-day period under Section 7 and of repeated and wilful defiance of the commission’s orders.
A penalty of Rs 10,000 was imposed on the PIO who was incumbent at the time of filing the RTI application, and another penalty of Rs 10,000 was imposed on the present PIO, who had failed to appear before the commission.
The commission directed that the penalty amounts be deducted from their salaries and deposited in the Punjab govt treasury. The PIOs concerned were also directed to inform the commission of compliance by producing a copy of the challan at the next hearing on Jan 15, 2027.

Wednesday, October 21, 2026

Who reads your vehicle record? NIC gave us numbers. MoRTH gave us a generic webpage: Vikram Raj

IFF: New Delhi: Wednesday, 21 October 2026.
We filed RTI applications with the MoRTH and the NIC asking who has access to VAHAN, SARATHI, e-Challan and PUCC data, and what has been done about its sale through apps and Telegram channels. MoRTH disposed of its application in two days without answering a single question.
Last month we wrote about a complaint we had received on the open market in VAHAN, SARATHI, e-Challan and PUCC records, sent a representation to MoRTH, NIC and CERT-In, and filed two applications under the Right to Information Act, 2005. NIC’s reply of 16 October 2026 contains the first account we have seen of how widely these systems have been queried from outside government. It records 338 credentials for private entities against 62 for government bodies, 25,314 credentials issued to private entities over the period, and 17,079,998 queries through those credentials between January 2024 and September 2026. The same reply mentions, almost in passing, that “the arrangement for sharing information with private entities was discontinued with effect from 01.10.2026 pursuant to the directions of MoRTH.” No reason or date is given for the direction, and we have found no public notice, order or news report of it. NIC also confirms that it received the disclosure made to CERT-In on 1 June 2026 about VAHAN records being sold through Telegram, and says the action taken and the date of any credential revocation “are not specified in the inputs presently available.” MoRTH, which issued the direction and which alone holds the names of the private entities, answered none of our twelve questions. Its reply, reproduced in full below, says that the Ministry deals with the Motor Vehicles Act, that implementing it is for the States, and that a data sharing policy is available on a website. It was written on 24 September 2026, a week before the switch-off took effect, and does not mention it. We filed a first appeal against MoRTH on 6 October 2026 and are filing one against NIC. The Play Store application that started this, which advertises owners’ names, addresses, financier, insurance policy numbers and chassis and engine numbers for ₹29, is still live.
Background
In September 2026 an engineer wrote to us after years of writing to the authorities without a visible result. His point was that if private apps, websites and Telegram channels can return VAHAN, SARATHI, e-Challan and PUCC records on demand, there is a technical path from a government system to those services, and that path can be traced if someone with access to the logs chooses to trace it.
We tested one of the applications he named, and published what we found on 23 September 2026. For ₹29 the “Vehicle Information App” sells 15 search credits, or about ₹1.93 a lookup. From a registration number alone it returned the owner’s full name, father’s name, present and permanent addresses, financier, insurance policy number, chassis and engine numbers, and PUC certificate number. The official Parivahan portal masks or withholds most of those fields and requires an OTP-verified account. On the same day we sent an eight-page representation to the heads of MoRTH, NIC and CERT-In, with copies to MeitY, asking that the matter be registered as a cyber security incident, that logs be preserved, and that a forensic audit trace the queries to their source.
We have been here before
MoRTH sold bulk copies of VAHAN and SARATHI under its Bulk Data Sharing Policy of March 2019. In a Rajya Sabha reply of 8 July 2019 (Unstarred Question No. 1698), the Minister said that 87 private and 32 government entities had been given access and that ₹65 crore had been earned. RTI documents reported that September named 142 purchasers, among them banks, insurers and car makers. In February 2020 we wrote to the Union Government asking that public and private access to these databases be stopped, and the policy was withdrawn in June 2020 on privacy grounds. We welcomed that with a caution that the data already sold would stay sold, which is what happened. In a Lok Sabha reply of 11 February 2021, the Minister put the total revenue at ₹1,11,38,79,757, listed 170 recipients including the Ministry of Home Affairs and law enforcement agencies, and said that no proposal to require deletion of the data was under consideration.
On 18 August 2025 MoRTH circulated its Policy for Data Sharing from the National Transport Repository, which reopened API, portal and bulk channels to private recipients such as banks, insurers, vehicle manufacturers and “transport service providing agencies”, with personal data to be released on an Aadhaar-linked OTP consent. We explained the policy at the time. It is an executive circular with no statutory backing; it names MoRTH as the data fiduciary and the approving authority; it has no public register of recipients and no grievance mechanism; and under clause 4.3 it gives police, law enforcement and national security agencies “complete access to all data parameters, including Personal Data.” Even before that, when MediaNama asked MoRTH under the RTI Act in 2025 which private companies had API access, the Ministry confirmed that government organisations did and ignored the questions about private ones.
Then, on 1 September 2026, the security firm Cyderes published an investigation into a Telegram brokerage selling live VAHAN records at ₹5 a query. The records, it found, were being drawn through API credentials issued to licensed identity-verification intermediaries, not through any breach of a government server. Its request logs ran from September 2025 to April 2026. Cyderes reported its findings to CERT-In and to the affected companies on 1 June 2026, and said that one route was still returning full records when it published.
What we asked, and of whom
Our two RTI applications of 22 September 2026 were split by role. MoRTH (Registration No. MORTH/R/E/26/05057) was asked twelve questions about policy and authorisation, the names of private entities given API, portal or bulk access since 4 June 2020 and the data fields approved for each; the number of applications under the NTR Policy and how many were approved, rejected or pending; a copy of the undertaking private recipients sign and its clause on resale; whether AuthBridge (TruthScreen), Invincible Ocean, SurePass or the developer of the Vehicle Information App had held access; suspensions, debarments and audits; complaints about the sale of this data and the action taken; correspondence with CERT-In, MeitY, NIC and Google; FIRs filed; whether deletion was sought of data sold under the 2019 policy; the order deciding which fields are masked in public lookups; which entities other than MoRTH and NIC may send OTPs or SMS to vehicle owners; and the revenue earned each year since 2020-21. We asked that exempt portions be severed under Section 10 and that anything held elsewhere be transferred under Section 6(3).
NIC (Registration No. NICHQ/R/E/26/00591), which builds and runs these systems, was asked sixteen technical questions, how many credentials had been issued to government and private entities, their validity and access conditions, monthly query volumes, how credentials are monitored, how long API, SMS and database logs are kept and whether any had been ordered preserved, the SMS sender IDs and OTP accounts, whether any third-party application had been found triggering Parivahan OTPs, the cybersecurity incidents received, whether the CERT-In disclosure had reached NIC and what followed, security audits, unauthorised access by staff or vendors, and which fields are masked in public lookups but released through private APIs.
Analysis
The sequence
Sequence of events, 1 September to 16 October 2026
We asked the Ministry on 22 September who has access to this data, on what terms, and what has been done about reports that it is being sold. Nine days later, sharing with private entities ended. We learned of that on 16 October, from NIC, in answer to a question about the number of credentials in circulation. MoRTH has not told us that it took the decision, when it took it, on what material, or why. Its own reply of 24 September says nothing about it. We are not in a position to say that the Ministry acted because of our representation or our RTI, and we do not say so. What we can say is that a Ministry which was about to switch off a national data sharing arrangement answered a citizen asking about that arrangement by pointing him to a webpage describing it. If the direction was already in train on 24 September, the reply should have said so. If it came afterwards, the public is entitled to know what prompted it. That question is now before the First Appellate Authority.
What NIC told us
NIC’s reply, signed by its CPIO on 16 October 2026, runs to thirteen numbered parts. The figures it discloses are these.
Seventeen million queries over 33 months is roughly 17,000 lookups of individual records every day. NIC does not explain the gap between 338 credentials “recorded” and 25,314 “issued”. The likeliest reading is that 338 is a snapshot of the register when the CPIO ran his query, after the switch-off, and 25,314 is the cumulative number created over the period, with credentials renewed annually and issued per user or per integration; it is also possible that 338 counts approved entities rather than credentials. On either reading about 25,000 credentials were issued and are no longer on the register, and NIC gives no figure for how many of those were revoked, how many expired, and when. On the terms on which private entities held access, it says only that these “were governed by the MoRTH Data Sharing Policy in force during the relevant period.” It does not name a single holder.
Query volumes fell by more than half between July and September 2025, and NIC does not say why.
NIC reply to RTI NICHQ/R/E/26/00591 dated 16.10.2026, query 5 table, January 2024 to September 2026
Between January 2024 and July 2025 the volume stayed between roughly 590,000 and 940,000 queries a month, averaging 695,366. It then dropped to 452,616 in August 2025, 278,164 in September and 239,659 in October, and from September 2025 to September 2026 it averaged 262,725 a month. The last month in the series, September 2026, is the lowest at 192,703. NIC offers no explanation. Two things coincide with the fall. MoRTH circulated the NTR Policy in August 2025, the month the decline begins, and NIC’s own list of cybersecurity reports records five received in July 2025, more than in any other month of the series.
The CERT-In disclosure reached NIC. What followed is not on record, and the logs that would show it are expiring.
We asked whether NIC had received the disclosure made to CERT-In on 1 June 2026 and what action followed. Its answer in full, “The CERT-In disclosure referred to in the application was received. The action-related information and the date of credential revocation are not specified in the inputs presently available.” So the body that runs the system was told that its records were being sold through Telegram, and four and a half months later its CPIO could find nothing in the file about what was done or when any credential was cut off.
The retention periods NIC disclosed make this urgent. API logs are kept for one year, SMS logs for six months, and database logs “on an ongoing basis.” The operation Cyderes described ran from September 2025, with request logs to April 2026. On those periods the SMS logs for the whole of that window have already been deleted, and the API logs lapse month by month until April 2027. Our question on logs had two halves, the retention period and whether any instruction had been issued to preserve logs in connection with a complaint or investigation. NIC answered the first and said nothing about the second.
Twenty-eight security reports, a half-finished migration, and an audit gap.
NIC lists 28 dates on which reported cybersecurity issues were received between January 2024 and September 2026, eight in 2024, ten in 2025 and ten in 2026, the most recent on 16 September 2026, six days before we filed. What was done about them is, in NIC’s words, “general in nature and is not mapped separately to each receipt date.” The general note says that vulnerabilities in the NextGen mParivahan application were addressed, that an issue in its Android version was resolved, and that vulnerabilities reported in older versions of the e-Challan application “were being addressed through migration to the NextGen e-Challan application. Migration had been completed in 22 States, with the process underway in the remaining States.” On the Ministry’s own technical partner’s account, then, a version of the national traffic enforcement application with known vulnerabilities was still running in some States when the reply was written.
On audits, NIC says the last three of VAHAN were conducted on 28 April 2023, 17 December 2024 and 17 December 2025, and the last three of SARATHI on 7 January, 7 July and 6 August 2026, by two CERT-In empanelled agencies. VAHAN, the system whose records Cyderes found on sale, has not been audited since December 2025, six months before the CERT-In disclosure; SARATHI has been audited twice since. NIC adds that no case of unauthorised access by staff, contractors or vendors has been reported in its records.
No third-party app has been found triggering Parivahan OTPs.
The SMS sender IDs are SRTHDL and VAAHAN. Under the VAHAN header “multiple SMS and OTP accounts are in use”, whose names NIC has redacted “subject to the applicable provisions of the RTI Act, 2005”, without identifying which provision. The transaction counts it does give run into the hundreds of millions of messages a year. On the complainant’s question whether third-party apps are triggering government OTPs, NIC’s answer is no, “No such applications or entities have been identified as being able to trigger SMS/OTP through the specified sender IDs outside the identified arrangements. No unauthorised third-party application has been reported as having been identified in relation to the triggering of such SMS/OTP.” If that is right, the apps are not riding on the Parivahan OTP gateway, which leaves two routes for the data, credentials issued to licensed recipients and then resold or proxied, as Cyderes found, or copies bought under the 2019 policy and never deleted.
How MoRTH disposed of the same questions in two days
Our application to MoRTH was received on 22 September 2026 and marked “REQUEST DISPOSED OF” on 24 September 2026. This is the Ministry’s reply in its entirety:
The undersigned is dealing with Motor Vehicles Act, 1988 (MV Act) and Central Motor Vehicles Rules, 1989 (CMVRs). Both MV Act and CMVRs are available on this Ministry official website: www.morth.nic.in. Implementation of provisions of MV Act and CMVRs come under the purview of concerned State/UTs. With reference to RTI application it is stated that this Ministry has formulated a data sharing policy and placed it in public domain link https://services.parivahan.gov.in/ntr/ . Any citizen/ entity may apply for data subject to fulfillment of the conditions prescribed therein.
None of the twelve points is addressed. No exemption under Section 8 or 9 of the RTI Act is claimed, and no reasons, appeal period or particulars of the First Appellate Authority are given, though Section 7(8) requires all three whenever a request is refused. Taken on its own terms, the reply makes three moves, and none of them answers the application.
  1. It points to the law. We did not ask for the law. The Motor Vehicles Act and the Rules are published, and nothing in them tells a citizen which private entities hold API access to the national vehicle register or what the Ministry did when told that its data was being sold. We asked for the records of how the Ministry has shared data under that law.
  2. It says implementation is for the States. The National Transport Repository is maintained by MoRTH. Under the Ministry’s own NTR Policy, MoRTH is the data fiduciary and the approving authority for private access. The records we asked for are generated by the Ministry’s own approval procedures and sit in the Ministry’s own files.
  3. It points to the NTR webpage. The page answers the question “what are the rules?” We asked who was let in under them. It carries the policy and blank application forms, not recipient names, application counts, signed undertakings, audit reports, suspensions, complaints, correspondence, FIRs, the masking order, the list of entities permitted to send OTPs, or revenue figures.
The Ministry has disclosed every one of these categories before. The Rajya Sabha reply of July 2019 gave entity counts, RTI documents in 2019 named 142 recipients, and the Lok Sabha reply of February 2021 gave revenue to the rupee and listed 170 recipients. What was disclosable to Parliament in 2021 cannot have become unanswerable in 2026 without a reason being stated. And the reply was written a week before the switch-off it does not mention, which is the question we have put to the First Appellate Authority.
The app is still on the Play Store
The application at the centre of the complaint, listed as “Vehicle Information App” (package rto.owner.address.parivahan.car.malik.address.finder), remains live and installable on the Google Play Store as we publish this. We checked again on 17 October 2026.
Its listing still advertises the owner’s full name, present and permanent address, financier, insurance policy number and expiry, chassis and engine numbers, and PUC validity and number. It still carries the disclaimer that the developer has no association with any State RTO and that everything it shows is “publicly available on the Parivahan/mparivahan website.” It has gained roughly 600 reviews since we first examined it. We make no claim about where this application gets its data; that is what we asked MoRTH, and MoRTH did not answer. Nothing visible to a citizen has changed since 1 October.
Numbers without names
NIC told us how much. MoRTH was asked who, and said nothing. A citizen reading the two replies together learns that 25,314 credentials were issued and 17 million queries were run, and cannot find out the name of anyone who held a credential. The names are what matter. Without them the public cannot check the 338 against the companies Cyderes identified, or against the apps and Telegram channels selling this data, and nothing can be audited.
The division of labour between the two bodies produced this result. NIC answered what could be read off a database and deferred the three questions that needed a policy answer, on credential validity, access conditions and data fields, to “the MoRTH Data Sharing Policy in force during the relevant period.” MoRTH, which owns that policy, pointed back at the policy document. The citizen is sent in a circle, and this is the second time in two years that the Ministry has met a question about private recipients with silence.
A switch-off without a reason
That private sharing was discontinued on 1 October 2026 is a welcome step. Whether the Ministry acted on the Cyderes report, on our representation, or on a review of its own, it acted in the right direction.
What it did not do is tell anyone. We have found no public announcement of the discontinuation, no order on the Ministry’s website, no Gazette entry and no news report, and we would be glad to be corrected. An arrangement that can be switched off without a stated reason can be switched back on the same way, by the same unpublished route, and nobody outside would know that either. Neither reply tells us why it was discontinued; whether the private entities whose credentials were withdrawn have been required to delete what they already hold, which is the question the Ministry answered in the negative in 2021; whether the discontinuation is permanent or a pause before a revised policy; or whether any of the 17 million lookups reached people who should never have had them. No vehicle owner in India has been told that their record was queried, by whom, or how often, and the NTR Policy gives them no way to find out.
The calendar makes this worse. The complainant asked for log preservation in his first letter to the authorities, more than a year ago. NIC has now told us that SMS logs last six months and API logs one year, so the SMS records for the period in the Cyderes report have already gone and the API records go month by month until April 2027. The file, meanwhile, moves at the speed of the RTI Act, an application, a two-day disposal, a first appeal, thirty days for a decision, then a second appeal to the Central Information Commission, where matters routinely wait years. By the time anyone is directed to produce the logs, there may be nothing left to produce. NIC was asked whether any preservation instruction had been issued, and did not answer.
The door that stayed open: police access and Delhi’s camera networks
The discontinuation NIC describes is of sharing “with private entities.” The 62 government credentials are not affected, and clause 4.3 of the NTR Policy continues to give police, law enforcement and national security agencies complete access to every field, including personal data. That access needs none of the OTP consent private recipients had to obtain, is subject to no proportionality or judicial check, and leaves no record the vehicle owner can see.
In Delhi, four systems already run on that access or are being built on it:
  1. Delhi Police’s Safe City project, 10,000 AI-enabled cameras funded with about ₹800 crore from the Nirbhaya Fund, is being integrated with “at least 32 data sets”, which the reporting names as including NCRB data, criminal dossiers, the VAHAN portal and ZIPNET.
  2. On 30 September 2026, the day before private sharing ended, the Cabinet Committee on Economic Affairs approved Delhi Police’s Intelligent Traffic Management System at ₹1,789.52 crore, with 1,029 automated enforcement locations, 42 traffic corridors and “AI-based analytics” to identify “stolen, hot-listed and blacklisted vehicles”. Reporting on the project says it will be integrated with VAHAN and e-Sarathi and will push alerts through CCTNS, the police crime database.
  3. The ANPR cameras being installed at Delhi’s border points to stop end-of-life vehicles check every plate against VAHAN.
  4. NIC’s e-Challan application, used by traffic police forces including Delhi’s and the one whose older versions NIC says are still being migrated, is described by NIC as “integrated with VAHAN, SARATHI, and Intelligent Traffic Management Systems”, a camera reads a plate, “the vehicle’s registration details are then fetched from VAHAN”, and the notice goes to the mobile number or address on the owner’s record.
Each of these performs the conversion the ₹29 app sells, from a number plate to a name and an address, and then attaches that identity to a camera feed and to the dossier and facial recognition systems we have documented at Jantar Mantar. None of this is new in kind. The 2021 Lok Sabha list of bulk recipients already included the Ministry of Home Affairs and law enforcement agencies, and the 2019 Rajya Sabha reply recorded that VAHAN and SARATHI were linked to NCRB’s stolen-vehicle data. We do not suggest that the timing of the ITMS approval and the switch-off are connected. The point is narrower. Private access to these records has been closed without explanation, under a circular that could reopen it tomorrow, while the State’s own use of the same records is growing, on the same database, with the same six-month SMS logs and one-year API logs, and with the same absence of any way for the person whose record is pulled to find out.
Action
On 6 October 2026 we filed a first appeal against MoRTH under Section 19(1) of the RTI Act (Registration No. MORTH/A/E/26/00656), which was forwarded to the First Appellate Authority on 7 October. The appeal argues that the CPIO’s reply is a refusal without any ground the Act recognises, no information was supplied, no exemption was cited as Section 7(1) requires, and none of the particulars required by Section 7(8) were given. It argues that the officer’s statement that he deals only with the MV Act and the CMVRs is not a ground for refusal, because Section 5(4) requires a CPIO to seek the assistance of the division that holds the record and Section 5(5) makes that officer a deemed PIO; that the points held by NIC, CERT-In or MeitY should have been transferred under Section 6(3), as we expressly asked; and that any third-party objection required notice under Section 11, the public interest test under Section 8(2) and severance under Section 10, none of which was done. We have asked the First Appellate Authority to set aside the reply, direct complete point-wise information on all twelve points within fifteen days, and direct at least a yes or no on each of the four named entities.
We are now filing a first appeal against NIC’s reply. It is a far better reply than MoRTH’s, but it leaves four things unaddressed that we will press, what “recorded” and “issued” mean, how many of the 25,314 credentials were active on 30 September 2026, and how many of the rest were revoked or expired and when; the deferral of the questions on credential validity, access conditions and data fields to “the MoRTH Data Sharing Policy”; the redaction of the SMS and OTP account names without any exemption being identified; and the unanswered half of our question on log preservation. The first relief we seek is a direction to preserve the logs that remain before they lapse. We are also filing a fresh application with MoRTH for a copy of the direction by which private sharing was discontinued, its date and file number, the material on which it was issued, and the communication by which NIC was informed.
Beyond the appeals, the following should not need an RTI at all:
  1. Publication of the direction discontinuing private sharing, with its date and reasons, and a statement of whether it is permanent or an interval before a revised policy.
  2. A public register of every entity with access to NTR data, government and private, with the purpose and data fields approved for each, published and kept current.
  3.  Deletion on affidavit by every entity that holds transport data obtained under the 2019 policy or since, which the Ministry declined to seek in 2021.
  4. Log retention matched to the investigation timetable rather than six months, with preservation triggered automatically by a reported incident.
  5. Notification to the vehicle owners whose records were accessed. The Digital Personal Data Protection Act, 2023 will require this of MoRTH as a data fiduciary when its substantive provisions take effect in May 2027; the Ministry need not wait until then.
  6. Completion of the e-Challan migration in the States where, on NIC’s own account, a known-vulnerable version is still running.
  7. A statutory basis, with proportionality and record-keeping requirements, for police and law enforcement access to the NTR, in place of clause 4.3 of a circular.
Transparency work like this is slow and depends on our members. If you think a citizen should be able to find out who is reading their vehicle record, become an IFF member. If you have found your own vehicle or licence details on a third-party app, bot or website, write to us at policy@internetfreedom.in.
Important documents
  1. IFF’s RTI application to MoRTH dated 22.09.2026, Registration No. MORTH/R/E/26/05057 (Link)
  2. MoRTH CPIO’s reply dated 24.09.2026 [Link]
  3. IFF’s RTI application to NIC dated 22.09.2026, Registration No. NICHQ/R/E/26/00591 (Link)
  4.  IFF’s representation to MoRTH, NIC and CERT-In dated 23.09.2026 (Link)
  5.  IFF, Less Than ₹2 for Your Name and Home Address: How VAHAN and SARATHI Data Is Being Sold Online, 23.09.2026 (Link)
  6. MoRTH, Policy for Data Sharing from the National Transport Repository, 18.08.2025 (Link); NTR data sharing portal (Link)
  7. IFF, Data Highways, Rights Roadblocks: An explainer on the National Transport Repository, 01.09.2025 (Link)
  8. IFF, We have written to Government asking them to stop public access to the Vahan database #SaveOurPrivacy, 26.02.2020 (Link); IFF, Bulk data sharing policy scrapped is an incremental victory that requires follow up action #SaveOurPrivacy, 30.06.2020 (Link)
  9. Rajya Sabha Unstarred Question No. 1698, answered 08.07.2019 (Link); Lok Sabha reply of 11.02.2021 as reported by Business Today (Link) and Business Insider (Link)
  10. Cyderes Howler Cell, 6 Cents USD per Lookup: Inside an Indian Data Brokerage Running on Unauthorized KYC Access, 01.09.2026 (Link)
  11. PIB, Cabinet approval of the Intelligent Traffic Management System for Delhi, 30.09.2026 (Link)
  12. IFF, IFF Writes to the Commissioner of Police and files RTIs on live facial recognition at Jantar Mantar (Link)