India considers non-personal data sharing regulation

India is considering taking steps to allow citizens and organisations to harness companies’ anonymised, non-personal data, after a committee recommended that such a move would boost domestic SMEs’ competitiveness and enhance government.
The Committee of Experts on Non-Personal Data Governance Framework was formed last September by the country’s IT Ministry and comprises experts from government, industry and academia. In a report published last month, the committee recommended that a regulation be introduced that would enable members of the public, start-ups, researchers, the government and other entities to request companies’ data for national security, economic, and public interest purposes.
Under the proposal, Indian governments would also be required to share certain data.
A proposed regulator – the Non-Personal Data Authority – would be the final arbiter of whether an individual or organisation can take proprietary “non-personal data” from any company in India.
The committee said allowing data monopolies whereby a small number of big companies have access to data sets accumulated in a largely unregulated environment unfairly disadvantages smaller businesses, citizens and the government.
The data-sharing regulation would create a level playing field, shift data’s “economic benefits for citizens and communities in India” maximising “overall welfare”, and improve government policy-making and service delivery, it said.
‘Non-personal data’
The report outlines three types of non-personal data that the committee deems appropriate for sharing: “public non-personal data”, owned by governments; “private non-personal data”, owned by non-government players and derived from privately-owned assets or processes; and “community non-personal data”, comprising data about a set of people who have the same geographic location, religion, job, or other common social interest. The latter could include the metadata collected by ride-hailing apps and telecoms and electricity companies.
The report argues that legal and ownership rights over community data should be given to a trustee, most often a community body or government agency. This trustee would collaborate with the Non-Personal Data Authority to seek and enforce data sharing. “This should, however, be undertaken in a strict rules-based manner, with adequate checks against abuse of power by government or other representative agencies,” the report states.
While factual data would be given for free under the proposal, ‘value added’ data such as estimates of regional demand for the next year, for any company, could mandatorily be available at a “fair, reasonable and non-discriminatory” price.
Spur innovation?
The committee said it “strongly believes” that metadata sharing by companies will “spur innovation at an unprecedented scale” in India, and “promote and encourage” the development of domestic industry and start-ups that can scale their data-based businesses.
The committee’s chair and Infosys co-founder Kris Gopalakrishnan has also argued in recent interviews that multinational companies will themselves gain “tremendously” from sharing non-personal data.
“Every business will benefit from data sharing. If it is a small business, they get access to this data. If it is a large business, they get access to more data, including government data,” he told Livemint. “All of us are working towards making data shareable, available for businesses to provide better services, and that it is helpful for every company, every business.”
However, some tech company employees are sceptical about the proposal. “The concept of trustees assumes that different types of bodies have the technical capacity to understand how data can be used. How do we know that data trustees don’t have vested interests? There are no checks and balances. There is also this assumption that giving a lot of data to a start-up will turn it into a unicorn,” an unnamed industry representative from a major global technology company told The Indian Express.
Privacy advocates have also voiced concerns. The journalist and digital rights activist Nikhil Pahwa wrote in The Economic Times that the country was “probably at the inception of the largest exercise of state appropriation of private property in the history of independent India”.
He argues that the committee’s approach “will do more harm than good”; that the nationalisation of data and mandatory distribution to competitors will “destroy value for businesses and investors”; and that if more anonymous data were to be made freely available, “the risks of re-identification, surveillance and group privacy harms increase”.
A broader version of the non-personal data sharing proposal has been included in the IT Ministry’s Personal Data Protection Bill, which is currently sitting with Parliament, according to The Indian Express.