By Kazim Rizvi & Karthik Venkatesh
The non-personal data (NPD) governance framework sets out norms for regulation of data by referring to its socio-economic value and to ‘unlock innovation’ for the Indian entrepreneurial ecosystem. The purpose states that start-ups require access to NPD and the apparent lack thereof stunts innovation. However, this premise is built on shaky foundations. The assertion that the start-up community needs a mandatory data-sharing regime to spur innovation has little evidentiary basis. India has the third-largest start-up ecosystem in the world, expected to grow 12-15% in the coming years. Moreover, in an attempt to democratise certain aspects of the data collected and open it up to the market for innovation, it is important to negotiate what aspects of data get democratised and what get commodified.
Data sharing in the proposed regulatory regime
The report envisages a regime that mandates data sharing by any entity collecting data above a certain threshold, and establishes reporting obligations towards benefits from NPD. Compliance requirements include disclosure of data elements collected, stored and processed, and open access to metadata. The framing of the data-sharing mechanism risks a backdoor channel for the government that could lead to unfettered access and arbitrary use of power. In case data insights hold economic value, then the value-added may be reflected in terms of monetary compensation that is driven by market forces. The report ends up creating a scheme for ‘statutory licensing’ of private data (including some elements of community data), at graded pricing levels towards this end, which would require legislative backing.
In the absence of a data protection law, it remains to be seen how mandatory data sharing would be operationalised without compromising individual privacy.
Mandatory data sharing and market disruption
Creating a mandatory data-sharing regime, including proprietary data (crucial to providing competitive edge to many businesses), might lead to unwarranted disruption. Several international instruments have acknowledged sui generis rights over databases, the rationale being the effort and resources that are invested in creating such databases.
Insights are not a natural resource freely available for everyone. It involves investment in terms of collection, processing and maintenance costs. Tech companies invest heavily in data science to make use of collected data. A mandatory open data-sharing policy will negate the competitive advantage held by these companies and make their investment worthless. In the jurisdictions that India holds a good relationship with, such a forceful data-sharing policy does not exist. It could negatively impact foreign investments and the capital might be transferred to those countries where the right of the companies’ proprietary data is respected. A false equivalence should not be drawn in respect of data collected, managed or processed by various businesses, by painting them with the same brush of voluntariness.
Mandating data sharing will create compulsory licensing provisions for copyright. In the past, there have been situations of private organisations volunteering to share large volumes of datasets for processing and use by the public without intervention. Fostering an environment of trust and cooperation will ensure maximum benefit can be unlocked for the public, without setting back years of progress.
In the information age, the driving force for any business is insights and intelligence. As one of the first countries to propose a framework for regulating NPD, India stands at a good footing to shape global policy discourse by adopting a more nuanced approach based on voluntary data-sharing mechanisms. A strong framework of rights must be established to reduce the existing disparity in powers between the government, industry and data principals.
It might also be prudent to study the self-regulation model of the EU to allow free flow of NPD in the digital economy where the market forces are a deciding factor. The government must work with industry and civil society to fine-tune regulations, and for a robust data governance regime it is imperative to first enact a data protection law to protect the rights of consumers and subsequently explore frameworks to realise the economic value of data.
