Why the Draft Data Accessibility Policy is Dangerous


The government may very soon start selling your data based on a proposed policy issued by the Ministry of Electronics and Information Technology (MEITY), titled “Draft India Data Accessibility & Use Policy 2022”. The policy aims to “radically transform India’s ability to leverage public sector data.” If passed, it will govern “all data and information created/generated/collected/archived by the Government of India” as well as “state governments [who] shall also be free to adopt the provisions of the policy”. The dual purpose this data will serve will be government-to-government sharing and high-value datasets for evaluation and licensing. There are three clear reasons why this policy deserves a reminder by the Union government.

The immediate risk stems from perverse incentives when a government begins to allow citizen data. Over the past three years there has been a rapid expansion in the nature and scope of our most intimate details. While the middle classes have faced the lie of voluntarily linking their Aadhaar to their bank accounts and mobile connections, today digital swiping is ubiquitous. For farming, there’s an Agristack; for non-unionized workers, we have the e-SHRAM portal; in health, we have Aarogya Setu and ABHA (Ayushman Bharat Digital Health Mission); and for school children and teachers, there is NDEAR (National Digital Education Architecture). This list continues. For every area of ​​our lives, the government now has a database filled with our personal data. The stated purpose of the collection was to improve service delivery, planning and leakage control. Such methods have been criticized by privacy and welfare activists, but have been justified as serving public purposes.

This changes with the draft data accessibility policy. To borrow a phrase from start-up culture, the basis for such massive citizen data collection is undergoing a 180-degree pivot. Public data is now seen as a valuable asset of the Union government that should be freely shared, enriched, enhanced and licensed to the private sector. Since more data means more money, commercial interests will push the government to collect granular personal data through greater capture and increased retention periods. Tying government policy determinations to fiscal potential can also lead to distortion of the goals of data collection – the welfare of farmers, health care, unorganized workers or even schoolchildren. There is no indication that consent will be sought in any meaningful form.

Over time, the original purposes for which databases are built will become diluted in favor of commercial interests. Even past experience calls for caution, given that social risks such as arson and community violence prompted the Ministry of Roads, Transport and Highways to recall a policy of bulk sharing of permit data. driving and vehicles.

The second problem stems from the misleading wording of “making data open by default”. The World Bank notes that one of the primary benefits of open data is that it supports “public oversight of governments and helps reduce corruption by enabling greater transparency.” These principles have been recognized in previous government policy statements. Specifically, the National Data Sharing and Accessibility Policy 2012 and implementation guidelines formulated in 2017 reference the Right to Information Act 2005. values ​​and goals are missing. Of the 13 objectives listed, only one is relevant to transparency and is limited to a single sentence. The main and compelling purposes of the draft data accessibility policy and briefing note are commercial.

The final area to reconsider is a broader trend toward policy-based administration, detached from our constitutional framework. This is a disease that affects broad areas of data governance, with confusion over the enactment of data protection law. To complicate this problem, the current policy, like many others, is not linked to any legislative basis and does not contain any proposal for the creation of a legal framework. Parliamentary control is not a troublesome democratic artefact that can be abandoned for an expected economic windfall. According to the Supreme Court’s Puttaswamy judgment on the fundamental right to privacy, the first ingredient to satisfy constitutionality is the existence of a legal basis, most often legislative. Without law, there are no defined limits on data sharing that are enforceable and contain remedies.

In this case, the promise of privacy preservation through anonymization tools is unpromising when it cannot be independently assessed by a data protection agency. For example, Luc Rocher and co-authors from the Oxford Internet Institute note that “the results suggest that even heavily sampled anonymized datasets are unlikely to meet modern standards for anonymization set by the GDPR and seriously challenge question the technical and legal adequacy of the release-and-forget identification model.This becomes paramount since it is the main measure proposed in the draft data accessibility policy.

Such risks will become a reality without an independent regulator or sanctions. Parliamentary enactments also help build accountability through deliberations that promote foresight and contain financial memoranda – given that public money would be spent to enrich public data datasets. Since the policy contemplates data sharing between central government and state government databases as well as through centrally funded schemes, it may also be prudent to deliberate further in the Rajya Sabha. Federalism becomes a relevant issue given that this data, when generated, processed and enriched by state governments to comply with interoperability standards, will itself generate revenue. These are the glaring problems with this short 10-page draft data accessibility policy, which appears to turn the Union government into a data broker.

This column first appeared in the print edition of March 5, 2022 under the title “Our data, not for sale”. The author is the executive director of the Internet Freedom Foundation.


About Author

Comments are closed.