New Delhi: In a shocking lapse, the Ministry of Defence has admitted that it was unsure whether or not a private vendor has fled with the personal data of about 50 lakh ex-servicemen and noted that it “cannot comment whether a copy of the same has been retained by the company or not”.

After maintaining a stony silence for over three months, the ministry finally responded to the issue raised by the Right to Information activist Commodore (retd) Lokesh K. Batra on March 22 and admitted that the data pertained to the Ex-Servicemen Contributory Health Scheme (ECHS).

Biometric data was contained in smart card

Responding to the questions raised by Batra about the maintenance of data on ex-servicemen at ECHS, its joint director (information technology) said that in the “system of Smart Card which was in vogue till May 2015, the biometric data (left & right thumb impression only) of the individual was stored in the Smart Card”.

The ECHS further stated that “the Smart Card was in the custody of the individual” and that “no biometric data was stored in the system”.

ECHS does not know if company retained copy of data

It was the remaining part of the reply, however, which ought to send alarm bells ringing as the data pertained to ex-servicemen of all ranks. The ECHS official admitted: “The other personal data as per the contract stipulation was handed over to the ECHS on termination of contract. ECHS cannot comment whether a copy of the same has been retained by the company or not.”

So, as Batra said, no one knows if a copy of the data has been made or was being misused. The matter, incidentally, moved at a sharp pace within the ministry only in the past week after the under secretary in the Department of Ex-Servicemen Welfare urged the commanding officer (CO), ECHS on March 16 to take “necessary action” within three days on the issues raised by Commodore Batra.

In the letter, the official, Jitender Kumar, had noted in the subject line that the matter pertained to “ECHS Smart Card/CSD Canteen Card made through ‘private vendor’ and issues related to personal information and data safety with ‘private vendor’.”

Further pursuing the matter, another under secretary in the Ministry of Defence, A.K. Karn, wrote a letter to the managing director of ECHS on March 21, after the three-day period had lapsed, pointing out that the CO of ECHS was earlier requested to take necessary action in the matter within three days on the issues raised by Batra and to apprise the ministry accordingly.

He further requested that the report or status on the matter related to biometric and personal information of ECHS Smart Card held with the private vendor be furnished to the ministry by the same evening and that the matter “be accorded top priority”.

Incidentally, even after this order of the defence ministry, Batra, who had been waiting for a response on his query for the last three months, was not too hopeful of an early reply. He had commented on social media that “cover-up will start now”.

‘Private vendors should be properly monitored’

The noted RTI activist said that the defence ministry should at least follow the same procedure as the Unique Identity Authority of India of taking affidavits from the private vendors. “If the vendor were to say that data has been destroyed …. how and who will ensure the truth?”

Stating that “50 lakh ESMs data is not a small number”, Batra had questioned if the private vendor had run away with the personal data of the nearly five million ex-servicemen