Who pays for trust? Unpacking DoT's MNV framework

India's MNV framework aims to fight fraud but may burden businesses and expose users to privacy risks in a rapidly digitising economy.

- BY PUNEETH NAGARAJ & SHAILEJA VERMA

What began as a tool to bolster telecom cybersecurity may ultimately saddle businesses with compliance costs and expose users to privacy risks. The Department of Telecommunications proposed Mobile Number Verification (MNV) platform hints at a regulatory model where the private sector bears the brunt, while the financial and informational rewards accrue elsewhere.

Recently proposed amendments to the Telecommunications (Telecom Cyber Security) Rules, 2024 seek to regulate “telecom identification user entities” (TIUEs)—essentially any business that uses mobile numbers or other telecom identifiers to provide services or identify users.

Under the envisaged MNV framework, a TIUE may, either voluntarily or upon government direction, place a request to validate whether a mobile number provided by a user matches telecom service providers' (TSPs) databases. The goal: verify mobile number ownership.

However, given the sweeping definition of a TIUE, the government could mandate even non-telecom entities to participate in the MNV platform. This raises concerns over regulatory overreach and significant privacy and financial implications for the broader digital ecosystem.

PRIVACY PROTECTION AND ITS BLIND SPOTS

The proposed cybersecurity amendments acknowledge the principle of 'purpose limitation' by stipulating that the MNV platform should only be used to validate users linked to a telecom identifier, and only for services tied to that identifier. However, they remain silent on the equally critical principle of 'data minimisation'. It is not yet clear whether the validation process will yield a simple binary response or also disclose additional personal information, such as the user's name or address.