Digital Public Infrastructure

The design of digital data sharing infrastructure must be federated. Where there is a need for data availability beyond the duration that data fiduciaries will retain it we need to build data storage alternatives that data principals can use. We should resist the temptation of getting the government to build these data stores as a public good because the role of the government is to govern - and it should not get into the business of data storage and data management. Instead we should take a market approach and encourage private data storage providers to offer federated, inter-operable solutions.

The reason why email is the most widely used messaging protocol is because it uses an open interoperable protocol that allows messages to be exchanged freely regardless of the underlying operating system. If we are to take advantage of the benefits of data we need to enable open interoperable protocols that will break down the silos of our digital infrastructure.

A number of countries have realised that they need to extend their data protection frameworks through new measures that will unlock data silos in order to make it easier for data to flow from one entity to another with the permission of the data subject. However, if these measures are adopted solely through legislation they will fail. Technology businesses must be regulated through a mixture of law and technology - strong principle based laws and protocol based technology guardrails to ensure compliance.

The proliferation of micro-entrepreneurs in India has been enabled by India’s radically unbundled e-commerce ecosystem. However, given the expansive wording of the new Consumer Protection (E-Commerce) Rules, the flourishing of this important ecosystem is threatened as the platforms enabling these entrepreneurs will have to comply with so many obligations as to make their operations commercially infeasible.

The DEPA framework encodes most of the privacy principles that run through most privacy regulations into the framework of data transfers. However, while it solves the questions of notice, consent and purpose limitation, once the data is in the possession of the transferee, the traditional DEPA framework has no control over what is subsequently done with it. This means that it will no address issues of use restriction, data minimisation and retention limitation. If we can integrate into the traditional DEPA framework the concept of Confidential Clean Rooms we should be able to address these remaining privacy principles as well.

Having multiple NPCI entities would be expensive and insecure. There is no benefit building multiple clearing and settlement centres. Its better to ensure that NPCI is neutral and redundant. We should build a separate standards setting body so that regulators can focus on running the system while the standards body can setting and maintain standards.

While dystopian science fiction is increasingly becoming true given the growing stratification of society, and the widening gap between the rich and the poor, technology has greatly exacerbated these differences. As we build our digital public infrastructure we need to redesign these technologies to ensure equitable access and benefits.

There were doubts as to whether Aadhaar would work because of India’s patchy infrastructure. It eventually went on to provide identity to many, but faced challenges like enrolment errors and biometric recognition issues. Because it was mandatory linked to various services, the Supreme Court moved to restrict private sector access - significantly constraining its ability to function as a tool of transformation.

The Lok Sabha passed the Aadhaar Amendment Bill, aiming to facilitate the continued use of Aadhaar within constraints set by the Supreme Court. The bill emphasizes voluntary use, gives statutory legitimacy to offline verification, strengthens privacy provisions, and controversially allows the private sector to regain access to Aadhaar infrastructure.

In the aftermath of the Supreme Court judgment the use of offline QR-based verification will prove to be a viable alternative that will allow us to continue to benefit from the Aadhaar identity system without exposing Aadhaar number holders to the many harms that the SC judgment was at pains to avoid.