Disincentives to foreign investment in non-personal data

Global internet-based companies have invested greatly in systems that allow them to harvest and monetise non-personal data. Their incentives to do so in India may soon be reduced. The Committee of Experts on Non-Personal Data (NPD) Governance Framework released its revised report (report) on 1 January 2021 for comments and feedback. Its guiding principle is “India has rights over data of India, its people and organisations”, and one of its goals is “to create an enforcing framework that establishes rights of India and its communities over its non-personal data”. Community is loosely defined as “any group of people that are bound by common interests and purposes, and involved in social and/or economic interactions”.

The report would like to extend the jurisprudence of natural resources as evolved by the Supreme Court to NPD. Its principle is that “natural resources belong to the people, but the state legally owns them on behalf of its people”. Therefore, the state is empowered to use or distribute natural resources. In this context, the Report on Data Protection 2018 defined community data as a body of data that has been sourced from multiple individuals, and stated that “such data is akin to a common natural resource, where ownership is difficult to ascertain due to its diffused nature across several individual entities”.

This approach faces challenges at the conceptual level as well as in the process of implementation. It does not consider the distinctive nature of NPD compared to such natural resources as forests, air, water, land, coal, minerals, petroleum and natural gas. NPD is created by individuals and organisations belonging to a community which is open-ended, geographically dispersed, virtual and temporary in nature. The varying nature of datasets and the existence of mixed datasets, makes it nearly impossible to identify who constitutes the community, and thereby establish who has rights over it. Even beyond the problem of definition, the inter-relationship between the data custodian, the data trustee and the community remains ambiguous. It is likely that their interests will not align with, or may even be pulling in the opposite direction to those of a community.

The report proposes to create an NPD Authority (NPDA) along with the Data Protection Authority (DPA) in the Personal Data Protection Bill, 2019 (bill). The jurisdiction of these authorities will depend on the nature of data in any given circumstance. For instance, personal data will be subject to the DPA, but if it is anonymised it will be subject to the NPDA, and if re-identified, it will again be subject to the DPA. Mixed datasets will be subject to the DPA. The report permits sectoral regulators to frame regulations outside the NPD framework. Given the constantly changing and intersectoral nature of datasets, the NPDA will run into jurisdictional disputes with regulators in closely linked sectors, or will operate in an environment of competing and contradictory goals pursued by statutory authorities. The report does not accept the definition of anonymisation in the bill. The bill applies the principle of irreversible process to convert personal data to NPD in the definition of anonymisation. The report, however, classifies de-identified personal data which can be re-identified as anonymized data. Since anonymised data is under the NPDA, there could be jurisdictional disputes.

NPD generated through commercial activities has economic value, and can be proprietary in nature. However, the report requires mandatory data sharing of high-value datasets (HVD) for public good purposes. It also stipulates that data businesses share metadata and the underlying data. This approach follows the principle that such data should be treated like natural resources, ignoring the distinctiveness of NPD. The mandatory sharing of HVDs creates disincentives to de-identify personal data as it loses exclusive rights of use. It does not promote a financial incentive model or value-based pricing of NPD.

Another issue is that state legislatures make laws with respect to the subject matters set out in the state list of the seventh schedule to the constitution. The question arises, therefore, as to who makes NPD law relating to the subject matters of the state list, parliament or the state legislatures?

To conclude, India is ahead of the curve in discussing the regulatory framework of NPD. However, after considering inputs from stakeholders, it should create a framework based on sound legal and commercial principles.

Asim Abbas is a partner and John Simte is an associate at L&L Partners