The proposed Personal Data Protection (PDP) bill, 2019 is an Indian initiative in this regard. The PDP deals with personal data that is not anonymized, as once the data is anonymized, it is believed that it cannot identify a person. (However, developments in algorithms and big data contest this claim, as re-identification is possible). Along with the initiative of regulating personal data to protect privacy of individual citizens, the government set up a Committee of Experts (CoE) for regulating non-personal data (NPD). The CoE came out with its second version of its report in December 2020. It defined NPD as all data that is not covered by the PDP. Thus it includes personal anonymized data.

The focus of the NPD Report is largely on developing a framework for sharing data as a mechanism for spurring innovation from start-ups. The NPD Report identifies several actors along with their roles and responsibilities for this purpose. It identifies \u201cData Businesses\u201d, (organizations that have a certain threshold in terms of size, revenue etc) for mandatory data sharing for the creation of \u2018high value datasets\u2019(\u201cHVD\u201d) for the \u201cpublic good\u201d. The determination of what constitutes a HVD and \u2018public good\u2019 would be done by \u201cData Trustees\u201d and they are expected \u201cto exercise the rights of the community over non- personal data collected in these HVDs\u201d. The Data Trustees are expected to be organized as a non-profit (Section 8\/Trust\/Society). Each HVD would have an associated Data Trustee. The NPD Report proposes creation of an \u201cNPD Authority\u201d who is expected to develop the regulatory framework for data sharing and adjudicate if Data Businesses do not share data with the Data Trustees.

The NPD Report, seems to suggest mandatory data and metadata sharing for \u201cData Businesses\u201d, but requires some clarity on whether that mandate is only for HVDs or in general. The Report does make an exception to data sharing where the company\u2019s trade secrets are involved, but there could be instances where companies could rightfully claim that sharing any metadata, and hence the underlying data, would compromise their trade secrets. Adequate clarity in this regard could help address this matter appropriately. Further, the NPD Report does not address liabilities and harms that may arise because of such mandatory third party sharing.

The NPD Report is premised on the benefits of the data being made available to a \u201ccommunity\u201d from whom the data was collected. The NPD Report defines \u201ccommunity as any group of people that are bound by common interests and purposes, and involved in social and\/or economic interactions\u201d. The NPD Report recommends that such communities organize themselves as a non-profit organization such as a Section 8 company\/Society\/Trust for raising complaints about harms that arise due to sharing their NPD. However, how and what the benefits of data could be leveraged by the community is not clear.

Further, using the \u201ccommunity\u201d as a construct for ownership\/management of data is problematic in a digital context. This is because unlike for ownership of physical resources, where communities are relatively well defined and limited by geography, communities in the digital space are transient, emergent and likely to be transnational. Further, even if not transnational, members are likely to be dispersed and have loose interconnections.

Adopting frameworks developed in the physical world for the digital requires taking into account the underlying inherent aspect of the rapid rate of technological change and designing appropriate relevant instruments. The relevance of governance instruments of the physical resource, which are less influenced by technological change, needs to be established. Thus adopting the \u201ccommunity\u201d as a formal actor in this space, is problematic, not even considering that there is no legal way to define a community.

The success of start-ups depends on their ability to identify a latent product or service need, designing the product\/service and providing a solution that provides a value-addition to the customer. Airbnb and Uber are examples from the USA. In India, Paytm, Delhivery, Flipkart, 1mg, firstcry are examples of start-ups innovating in finding a solution to an existing problem or fulfilling a latent customer need. The did not emerge out of an analysis of huge amounts of existing data.

As an example, Delhivery that focused on the last mile delivery solutions, recognized the challenges in this segment. As an integral component of solutions that it sought to implement, it developed an AI based algorithm to generate the correct geographical location from incomplete or incorrectly and variously spelt addresses. This was a requirement as there is no standard way in which addresses in India are specified. Today, it could sell this as a product or service, if required. Delhivery bootstrapped from the existing data.

Therefore, merely supporting data sharing (in the first place, is data availability even always a bottleneck?) without support for and acknowledging the importance the underlying data infrastructure and algorithmic skills, the effectiveness of NPD management, whatever shape it takes in the future will be undermined. It is clear that start-ups need a lot more \u2013 algorithmic skills, incentives, finances, stable regulatory regime, legal support and a host of other factors to flourish.

The NPD Report in its present form could lead to considerable regulatory uncertainty due to the ambiguous and unclear role of various actors. In trying to be the first country to legislate a NPD Law and create the NPD Authority, in a national milieu characterized by institutional voids, the government could create even greater legal regulatory uncertainty than exists today. We need to examine whether mandatory data sharing is the only way to spur innovation and will it actually spur innovation.

By mandating data sharing and creating the regulatory super structures and oversights, as envisaged in the NPD Report, we are likely to create significant dampening effect on any innovation in the country. This would be really sad, given that we are seeing exploding use of Internet and IoT in the country, that could result in Indian businesses being world leaders in innovative products\/services.

","blog_img":"","posted_date":"2021-11-23 08:58:26","modified_date":"2021-11-23 08:58:26","featured":"0","status":"Y","seo_title":"When winning is not about being the first: The Non-Personal Data regulation","seo_url":"when-winning-is-not-about-being-the-first-the-non-personal-data-regulation","url":"\/\/www.iser-br.com\/tele-talk\/when-winning-is-not-about-being-the-first-the-non-personal-data-regulation\/5157","url_seo":"when-winning-is-not-about-being-the-first-the-non-personal-data-regulation"}">