Draft Report on Regulating Non-Personal Data

Why in news?

The draft report by the Committee of Experts on Non-Personal Data Governance Framework was released recently, inviting feedbacks.

What is the committee on?

• The committee was set up in 2019.
• It is a nine-member panel, headed by former Infosys vice-chairman Kris Gopalakrishnan.
• It was tasked to study the issues on non-personal data.
• The draft report makes suggestions for consideration of regulation of such data.
• It has defined non-personal data, concept of community data and rights and privileges over such data.
• It has delved into crucial subjects such as ownership of data, undertaking a data business and data sharing.
• It has also recommended mechanisms for data sharing while defining its purpose.
• These include sovereign rights, core public interest, and economic purposes.

What are the key highlights of the report?

• Non-personal data refers to information that is not related to an identified or identifiable natural person.
• This would include data on weather conditions, from sensors installed on industrial machines, from public infrastructure, and so on.
• It also includes data which was initially personal, but were later made anonymous, according to the draft definition.
• It is to be noted that the Personal Data Protection (PDP) Bill 2019 is still in process.
• The Gopalakrishnan-led panel in its report has defined non-personal data as information which is not personal as defined in the above bill.
• Potential of data - The report has collated information from various studies in this regard.
• It has shown that companies with the largest data pools have "outsized, unbeatable techno-economic advantages".

• A few startups from the 1990s and 2000s have gone on to become USD 1 trillion market capitalisation multinational corporations.
• This is mainly because of their ability to collect and analyse data of users.
• Reportedly, Google and Facebook together control about 60% of the Internet advertising market in the USA.
• Amazon had a 37% share of the online e-commerce market in the USA in 2019.

What has the committee called for?

• There is a need to create a data-sharing framework.
• It thus calls for sharing non-personal data collected by both government and private organizations with citizens.
• This is to ensure that community data is available for social, public and economic value creation.
• Also, it simultaneously addresses privacy concerns and prevents collective harms arising from processing of non-personal data.
• This is likely to lead to increased transparency, better quality services, improved efficiencies, and more innovation.
• The shared Non-Personal Data may be useful for Indian entrepreneurs.
• It would help them develop new and innovative services and products from which citizens may benefit.
• The report puts forward useful suggestions on the need to set up a ‘non-personal data regulatory authority.’
• This is to manage India’s vast and emerging data space, while nurturing a creative and egalitarian technology architecture.

What are the concerns?

• Definition - A major concern with the new report is the lack of clarity on how it defines non-personal data.
• For instance, the report mentions on data that are aggregated and to which “certain data transformation techniques” are applied.
• The 'transformation' is to the extent that the individual or specific events related to them are no longer identifiable.
• This would be qualified as anonymous data, according to the report.
• But the data transformation techniques (that can be used to “anonymise” personal data) are not clearly defined.
• Possibly, vested interests can exploit the situation.
• Powers - The panel’s suggestions would lead to offering the State immense powers to define and determine non-personal data and use that for its interests.
• This does not augur well for a democracy, besides hurting business interests.
• This could possibly lead to a new form of digital control raj.
• Authority - Another potentially controversial idea is the suggestion to create a Non-Personal Data Authority.
• The panel suggests that data can be classified into three categories — public, community and private non-personal data.
• This is based on their ownership and origin of creation.
• Again, there is little clarity on who owns what kind of data as reflected in the way the report defines and identifies stakeholders.
• [The stakeholders include data principal, data custodian, data trustee and data trust.]
• The roles of these parties are still not delineated.
• These issues need to be addressed to avoid unethical practices, especially in a country like India which is witnessing a data economy explosion.
• Bringing transparency into the data debate is the need of the hour.

Source: The Economic Times, Business Line