Data regulations: Muzzling the roar of Make-in-India?

If a dominant player abuses their status and unethically suppresses competitors, this type of situation falls under the purview of the Competition Commission of India (CCI) whose mission is to “promote and sustain an enabling competition culture through engagement and enforcement that would inspire businesses to be fair, competitive and innovative; enhance consumer welfare, and support economic growth”.

Data regulations: Muzzling the roar of Make-in-India?

Imagine a new business that supplies vegetables from the local farms at the click of a button. In time, customer patterns give them insight into receptive localities, best-value farms, optimal times for delivery, and more. Now imagine that this data, albeit anonymised, is handed over to their biggest competitors, mandated by law.
Unfortunately for startups and small to medium-sized businesses (SMBs), this frightening scenario may soon be a reality. That is if the proposals in the recently released ‘Report of the Committee of Experts on Non-Personal Data Governance Framework’—released by a task force led by Infosys Co-Founder Kris Gopalakrishnan—were implemented as is.

The report tackles non-personal data (NPD)—data without personal identifiers like names and addresses. It attempts to separate this from an individual’s personal data covered under the Personal Data Protection Bill (PDP). There are three categories of NPD: Private, Public, and Community. ‘Private’ and ‘Public’ refer to data collected by private and government organisations, respectively. Most NPD discussions hover around the “Community” category—data collected from a group of individuals sharing a common interest or purpose.

The overall goals of this report are commendable, but there are a few concerns, namely:

1. We must encourage competition, not stifle success: The report intends to leverage data for the public good and minimise data monopolies. It states that NPD data must be shared when required for sovereign purposes like national security, core public interest like research, and economic purposes to encourage competition. Under this, any organisation can request access to underlying data from any other private entity. If the request is denied, a new regulatory body, the Non-Personal Data Authority (NPDA) will assess the level of public interest benefit in the data and may mandate that it be shared.

Lowering regulatory hurdles and encouraging competition is the most effective way to prevent the abuse of power by dominant players. But, the mere existence of a few dominant enterprises is just part of the natural ebbs and flows of a growing market. Infosys is a great example. From the humble beginnings of seven employees to over 2.4 lakh people, Infosys’s success is India’s pride. They are clearly a dominant player in their domain, and there is nothing wrong with that. They are entitled to grow and contribute to our GDP.

If a dominant player abuses their status and unethically suppresses competitors, this type of situation falls under the purview of the Competition Commission of India (CCI) whose mission is to “promote and sustain an enabling competition culture through engagement and enforcement that would inspire businesses to be fair, competitive and innovative; enhance consumer welfare, and support economic growth”.

2.  Mandatory data-sharing may encourage more monopolies: In trying to thwart monopolies, the NPD report may inadvertently nurture an ‘Oligarchic Raj’. Only very large corporations have the power and resources to drive business growth and simultaneously engage in sustained data “custody” battles. Multiple data requests from other organisations will weigh down SMBs. How do they protect their information from competitors and capture the market share from larger players when regulatory and legal red tape diverts resources and attention?
This exercise is an expensive aside for India at a time when we should be an attractive environment for Indian entrepreneurship and foreign investment.

3. Communities of individuals should have rights over their data: In an apartment complex, individuals have total ownership within their four walls. Each homeowner also shares collective ownership over community areas like elevators, walking paths, and parking. These areas may be physically “anonymised”, but that does not grant people from the “baju-wali” complex a right to them.

In this digital era, ownership of “property” must extend to intangible assets such as knowledge and data as well, not just physical assets. Without this, there may be serious encroachment upon the well-established principles of proprietorship and ownership to intangible assets like data, under the Copyright Act, protected by our Constitution.
The NPD regulatory framework must focus on securing the right to data and privacy of communities of citizens. Unfortunately, this report focuses on how the government can access data belonging to private entities but does not establish the rights of a community over their data. Just because data has value, it does not automatically mean others are entitled to it. In the end, all data is personal—even anonymised.

4. The value lies in the “eye of the beholder”, not one authority: The report allows the NPDA to classify community NPD into trivial, non-trivial, and significant, and assign values to these categories. How can one body have the bandwidth and expertise needed to accurately determine value? Particularly, when the value of data is subjective. For example, there is no value assigned for raw, factual data collected. However, most often, the proprietary nature of a data set, whether raw or processed, hikes up its value. This is not only because of the information within but for the data-driven decision making it empowers.

Take the Rs 1,070K crore Indian home healthcare market (Ken Research, 2019). While it may seem harmless to share raw “community” NPD, competitors can unfairly use this data to train their algorithms and target the same demographics through sales and marketing. This decimates any fair-market advantage that the first player rightfully earned. In the world of artificial intelligence and predictive analytics, even raw data is a key component of an organisation’s intellectual property.

Agri-tech startups collect data from their communities. Their value lies in the level of information they collect like the voice of local customers, and types of soil. Seemingly innocuous requests from sources with potentially malicious intent can cannibalise this type of competitive edge. An environment where a business’s data may be up for grabs at any point will severely deter investors and innovation.

Also, for data to be considered non-personal, at least minimal anonymisation is needed. This cost is in addition to data processes and the entities that collect, sanitise, and maintain databases. These resources have value to their organisation, even if not to the NPDA.

Access to sensitive data for national security by the government is already covered under the Official Secrets Act of 1923. The Unified License covers sensitive telecom data, and financials are under RBI’s purview. To advance research and aid policy-making, there are many research organisations to leverage. Public-private data-sharing can be encouraged through attractive incentives, not through devaluations and mandates.

To facilitate data-sharing in critical sectors, the government may encourage a “self-regulated data exchange” framework through a self-regulating industry body as it exists in the field of broadcasting and telecom.

Implementing the report as it stands may result in a twisted labyrinth of legal and regulatory turf wars, and not just between private players. The formation of an NPDA blurs the lines of jurisdiction between the Data Protection Bill, the Copyright Act, the Competition Act, the fundamental Right to Privacy, and their governing authorities.

Why move away from the market-friendly approach that fuelled India’s explosive growth in the past decade? Why not incentivise data exchanges instead of mandating them? Will India lose out as other countries remove regulatory barricades to attract investment away from us? I sincerely hope this does not happen, and India blooms into the preferred powerhouse for global innovation and manufacturing for decades to come.

With research inputs by Chandana Bala.

The author is President, Broadband India Forum, and founder & CEO, Advisory@TVR. Views are personal.

Get live Share Market updates and latest India News and business news on Financial Express. Download Financial Express App for latest business news.