Virtual Private Networks and the Right to Privacy

Recently, the Indian Computer Emergency Response Team (CERT-In) issued directions under Section 70B of the Information Technology Act, 2000. One of the contentious directions is that virtual private network (VPN) service providers would be required to register and maintain information about their customers for a period of five years or more. The information includes validated names of customers hiring VPN services, internet protocol (IP) addresses allotted to or being used, the email addresses, IP addresses and time stamp while registration, validated addresses and contact numbers, the period and purpose of hiring services, etc. These directions affect internet users’ privacy and anonymity.

VPN is a technology that helps internet users mask their IP addresses to establish secure and encrypted connections. An IP address is a unique address identifying devices connecting to the internet and assigned to the devices by the internet service provider (ISP). VPN is generally used by people to protect their privacy on public WiFi networks, to browse the web anonymously, and to communicate more securely. It helps one hide their internet search activity from their ISP.