While framing any future-looking policy on data, the Government must adopt a well-calibrated approach, keeping in mind the interest of all
Reams of paper and gigabytes of data are being used to analyse the results/outcome and meaning of the great Indian ‘desi data elections’ of 2019. As I sit down to type, data analysts are still trying to slice and dice packets to arrive at a conclusion — an exercise mirroring what went into the 2019 Lok Sabha poll. Yes, it was the biggest dance of democracy but also one of the largest data-crunching exercises.
This brings us to the heart of the debate over data. To put this byte in perspective, there are at least five pieces of open legislation currently being discussed by various Government departments, including a soon-to-be-tabled piece of legislation in Parliament. The decision/policy expected to emerge will shape industry 4.0 and pave the path for a new digitally democratic connected India. Billions of dollars of existing and future investments, millions of jobs and digital lifestyle choices of a billion plus Indians will ride on the outcome.
It may sound simplistic but debate and deliberations on data democracy is at best an evolving policy framework. Globally, each geo-political giant with its clutch of data innovation-driven companies and eco-political interest is trying to negotiate/fit in/flag off India’s evolving policy framework on data. It will be hard for our country to relegate the job of policy-making to a clutch of Government officials and sectoral Ministries and not take a wider inter-departmental framework view. Consider this: While the new data protection Bill restricts non-consensual data processing by certain group of fiduciaries, it allows a wide space for non-consensual data processing by States under the broad headline of national security/interest and an extension of welfare activities.
What the Government is forgetting is that ‘right to privacy of personal data’ is an individual’s fundamental right as ruled by the Supreme Court. Therefore, the challenge towards infringement can potentially come from a billion plus individuals. It may take shape in a simple challenge in the form of a ‘right to be forgotten’ (a provision envisaged in the proposed Bill) petition, but a question may arise on the tonnes of cache data the individual may have produced in the past and which would have been widely processed without any restriction by impacting “said” consumer’s commercial and political buy-ins.
Take another example: If one visits a new “connected or digitally smart” commercial building in Gurugram today, chances are that access will be provided only after creating a temporary pass. Generations of temporary access passes are subject to sharing of mobile numbers, generating one-time passwords, filling personal details form (name, company name, person visiting) and getting a picture clicked. Ok, let’s say this makes the job fairly quick and based on individuals voluntarily sharing information for access. What makes this situation potential cause of conflict and say infringement of data privacy is the very fact of it being digital and, therefore, sitting on some server for eternity with a potential of being sold online.
In its earlier avatar, authorised access to buildings, in most cases, used to be restricted to making a manual entry in a register and a phone call made from chowkidaar chambers to the concerned person. An affirmative response from the other end ensured smooth passage. Precious personal information of the visitor used to stay manually in a register as a silo vs another byte in the individual’s data journey. Now, the question is, will the new policy also have a view on these micro pieces of everyday use cases? If so, would we need another separate department in city planning to act as the guardian for all such data access?
Clearly, the challenges are manifold and almost quantum in terms of their being both ‘on’ and ‘off’ and at the same event horizon. Here lies the dilemma for policy-makers. Do they just need to restrict their knowledge horizon outreach and/consultation within the technical expert committee or should they also look at references from philosophers and thinkers? There is no contest to claim that a citizen’s right to data should be protected at all costs, but sometimes, rights of a collective or greater good takes over the former. It is, therefore, important to take a calibrated approach while framing a future-looking policy having cross-sectoral impact.
My humble solution is to keep the basic principles. Simple, easy to follow and provide simple guiding paths towards the journey. It will seem a considerable wash-down from the current proposed legislation draft but it will go a long way in establishing the preamble to the exhaustive Constitutional framework on data policy.
(The writer is a free thinker)