Data market in the offing; non-personal data Bill outlines regulatory vision for this

Different entities of the government will serve as data trustees, which will then dispense data.

Given how the government had bungled up the Data Protection and Privacy Rules by giving itself an escape clause—the draft Bill said the government or its agencies couldn’t be scrutinised for data collection—the draft Non-Personal Data Bill seems progressive indeed. The Bill, drafted by the Kris Gopalakrishnan committee set up by the government in September last year, deals with the regulation of collection of data and the creation of a data market. If the Bill passes muster with Parliament, India would become one of the first countries to have a data market law in place. If the provisions are not changed, it would also mean that companies (data custodians) will need user (data principal) consent for the collection of even anonymised data, and would need to adhere to strict rules so that data cannot be de-anonymised. However, it is not clear whether companies will be able to deny service sans user consent on data-sharing. While the focus of the draft is data privacy, it also has provisions for the regulation of a data market. A Google or a Facebook cannot have data monopoly, and must share whatever information the government or start-ups deem essential at a reasonable price. Different entities of the government will serve as data trustees, which will then dispense data.

Although a lot of this data sharing happens even now, the processes are complicated, and far too often, obtaining data is difficult. Once the law is in place, companies would be asked to put data in the public domain to support the Indian start-up ecosystem. More important, the government can leverage this data to improve public services. For instance, if Google’s mobility trend data is available, then the government can create better traffic management systems. Similarly, if the government can put data in the public domain, companies can leverage this information for better service delivery. The Bill stipulates that both companies and the government will need to pay for data.
The provisions with regard to the data authority—to be set-up by the government for regulation of non-personal data—are a bit ambiguous. If any company refuses to share data, it would be incumbent upon the authority to decide whether data can be shared or not. A Google may not wish to share the information which it considers proprietary, but it will have to if the authority asks it too. Rather than giving the absolute authority to the panel, the government would have done better to lay down clear rules. The government has paved the way for data regulation, and once a market is established, consumers will also be able to benefit from it.