India is forging its own path for data rights and privacy. Originally published on Medium.com on 9 May 2018.
Data breaches have dominated global headlines over the past year. The Cambridge Analytica scandal, the political ramifications of micro-targeting for fake news, and hacks into some of the largest data repositories including Equifax and the United States Office of Personnel and Management illustrate the dangers of massive concentrations of personal data in the absence of standards that safeguard the integrity of the data. How governments respond to the crisis will dictate the way data is used, protected, and abused for decades to come. India’s emerging “data democracy” is an attempt to balance personal privacy with ensuring data is available for those who innovate.
Differing approaches to data protection
The US takes a largely hands-off approach to data generated from digital platform businesses. Its regulatory structure lends itself to a strong reliance on antitrust regulation to promote competition, prevent monopolistic behavior, and ensure that no one company (or network of companies) is able to wield outsized political or economic influence.
This market-centric orientation allows platform businesses to innovate with new uses of data but also establishes few requirements guiding how these businesses engage with consumers and their data. Only recently have lawmakers signaled that antitrust may not be a sufficient response to the data crises and the country’s notable absence of clear rights and protections of individuals’ data. But it seems clear that any sweeping change is in the distant future at best.
In contrast, China is unsurprisingly state-centric in its approach to managing data flows and data companies. The country has erected a firewall to keep data produced by users inside China within the country’s geographic and legal boundaries. Through a set of laws and technologies collectively known as the National Public Security Work Informational Project, the state actively censors content on the internet deemed inappropriate, slows foreign traffic, and ensures all digital data produced in China is fully under the jurisdiction of the Chinese state. The government of China is known to access data generated by users on commercial platforms for its own ends, such as assigning its citizens a social credit score based on a number of online and offline behaviors. Based on the score, the state determines citizens’ trustworthiness and access to critical public and private services such as education, healthcare, transportation, and housing — an Orwellian fantasy of potentially epic proportions.
Meanwhile, Europe has made notable progress in trying to shift more power to the individual in the data economy through harmonizing data protection regulations across the European Union. The General Data Protection Regulation (GDPR) that goes into effect in May 2018 will be a grand experiment in shifting accountability of responsible data management to companies and replacing the status quo, which puts the burden on consumers to be aware of their rights as data generators. While this data privacy standard is notable in scope and embraces important concepts of consumer choice and protections, it is entirely a legislative response to a technological phenomenon. In other words, while it endows rights to citizens over their personal data, it doesn’t equip people with meaningful tools to actually manage their aggregated data.
Data democracy in India
India’s response presents a new model for data governance, one that seeks to balance the needs of its citizens, the innovation marketplace, and the state in its future data economy. India is developing new policies and technology-enabled solutions to form the basis for an emerging “data democracy”.
While still a nascent idea, a data democracy is a system in which people’s agency over their data and digital lives is intentionally maximized through public policy and digital platforms designed for the public good. In India’s emerging data democracy, all Indians will have access to their digital data and the tools needed to meaningfully manage who can use that data, for how long, and for what purpose. The hope is that this framework will allow individuals to leverage their personal data for improved access to critical services such as affordable credit and healthcare.
This is made possible in part from an emerging legal framework that, like the European GDPR, is expected to bestow data rights on all individuals that enable them to manage how the data they generate is used. Further, it is expected that India will create a data regulator that enforces compliance with the forthcoming data privacy laws.
Practical data management
What makes India’s approach to privacy and data unique is the set of emerging technology tools that promise to make it easier for individuals to actively manage their data and leverage that data for meaningful benefit. After years of development, India is rolling out new protocols to ensure data can be appropriately shared across parties in real-time in a way that is secure and auditable. These protocols standardize both how an individual user shares their personal data when applying for a product or service and how that data moves between the relevant databases.
For example, imagine this scenario: A small business owner applies for a loan from a finance company and the application triggers an “electronic data consent” process that enables the applicant to specify which datasets they want shared with the lender, for what purpose, and for what duration of time. The protocols further standardize how the data is shared with the lender. In defining these processes, India is embracing the notion that data need not be defensively held but rather can be liberated (and actively managed should it be in the interest of the individual) in a way that is secure and maximizes consumer agency and private sector innovation.
Only time will tell if India’s grand experiment in creating the world’s first data democracy delivers the impact it intends. There are many questions still to be answered — not least whether individuals will actually become proficient in managing their data responsibly — but it is an effort worth watching.
Priya Jaisinghani Vora, Matt Homer, and Kay McGowan are the co-founders of Future State, an entrepreneurial effort supported by the Rockefeller Foundation to advance inclusive and equitable digital economies.
This article was co-produced with emerge85 partner Future State.