Data Governance

The latest draft of India’s Digital Data Protection Bill, 2022, stands out for its simplicity and new concepts like “voluntary undertaking” and official recognition of “consent managers.” However, it omits features like data portability and the right to be forgotten. Critics argue the draft lacks safeguards and over-delegates legislative authority, particularly around the concept of “deemed consent.” But the principles-based approach it espouses could ensure agile and enduring data protection regulation.

Data asymmetry allows those with access to large data sets to gain insights that can be used for various purposes, including manipulation. Solutions like India’s DEPA framework aim to reduce this asymmetry. However, challenges remain in knowledge and intelligence asymmetry, requiring democratisation of data science techniques and addressing biases in AI algorithms.

In India, the absence of comprehensive privacy law has led to over-reliance on CERT-In Rules, 2013, for data breach guidance. Recent directions by the Ministry of Electronics and Information Technology has expanded mandatory reporting requirements, raising concerns about inundating CERT-In with trivial incidents and, as a result, hindering its ability to respond to serious breaches.

John Perry Barlow’s 1996 “A Declaration of the Independence of Cyberspace” argued for internet exceptionalism, where the online world would be free from real-world regulations. This belief shaped the liberal terms of service on websites, but with the internet’s growth and concentration in the hands of dominant platforms, the enforcement of these terms has led to serious global consequences. Barlow’s vision of a more humane online civilization may have been overly optimistic.

European negotiators have agreed on the Digital Markets Act, a law aimed at regulating dominant platforms in Europe. A key focus appears to be interoperability, particularly among messaging platforms. While it is intended to increase competition, mandatory interoperability may degrade privacy and create conflicts with global technology platforms’ policies.

We can have a new international approach to data governance that draws inspiration from the Bretton Woods Agreement. This would call for the creation of a global alliance with a commitment to data protection as well as a Data Stability Board to coordinate regulatory dialogue, aiming for harmonization and interoperability in global data governance.

There are divergent approaches to data regulation across the US, China, and Europe. The US has a laissez-faire approach, China tends to be oriented towards state-centric control, and Europe is overtly rights-based. The growing schisms between these approaches are causing fragmentation, leading to a call for a common ground in global data governance.

Francis Fukuyama coined the term “vetocracy” to describe a gridlocked decision-making system where individuals can prevent policy implementation through vetoes. But while the physical world may suffer from excessive vetocracy, the digital sphere often leans towards autocracy. We need a balance between these two extremes and that is even more important in the context of India’s digital infrastructure. Vetocratic processes can be used to protect core principles, while maintaining flexibility to foster innovation.

There is a growing recognition of the fact that we can use technology tools to make our regulations smarter. There are 2 categories of tools to do this. The first gives users more control over what can be done with their data by placing data in pods and only allowing them to be accessed in accordance with the privacy management protocols. The second unlocks data silos allowing data to move between them with the consent of the user. While these tools seem contradictory they operate at opposite ends of the data spectrum can can be combined to augment statutory frameworks.

The fictional science of psychohistory is predicated on the proposition that while human behaviour is erratic in isolation, when aggregated to population scale it becomes predictable. Today we use big data to predict customer behaviour and third wave economics uses real-time data to solve real world problems. In time this will allow us to understand the steps we need to take to shape desirable outcomes.