Data & Privacy: Formulating a Policy Framework
Takeaways from Carnegie India’s technology & policy discussion
Last week, your two founders at NIRA were fortunate enough to attend a policy event hosted by Carnegie India, focusing on technology and policy surrounding the ownership of personal data in India today. The keynote speaker was Nandan Nilekani; he spoke lucidly for an hour on the growth of data as a strategic asset over the last decade, his views on India’s need for a strategic view on data, and the shape that policy should take to accommodate the needs of both individuals, companies and the government.
Here we present our takeaways from the session. Credit for the content goes to Mr. Nilekani, Carnegie India, iSPRIT, and the other panellists at the event.
2007 was a significant year in the context of data. It was the year that the iPhone was first released, that Netflix started streaming films, and Google started mapping the world’s streets. Fast forward 10 years; now 2.5bn people globally have smartphones, 350mm in India. These people are creating vast amounts of data about themselves through their activity on their devices. The most successful tech businesses today are those that have been best able to acquire customer data and monetise it through new products that are designed from their insights into consumer behaviour. Indeed, in 2016, Google and Facebook accounted for 71% of total digital ad spend globally. Moreover, they accounted for 89% of the spending growth; their market share and power was growing! Superior data acquisition can result in a market where the natural equilibrium is winner takes all. Are tech companies too powerful? Has the Government lost control? Is the structure of the system benefiting the people to the extent it can? These were all discussed in the session.
We reflect on 3 insights that we drew.
(I) “Data inversion” is the key to user empowerment
In the traditional (i.e. Western) model, a platform has a lot of data on its customers or users and utilises this to sell its products in a targeted way. This makes sense in a world where the customer has a lot of spending power. Much of the Indian population is relatively poor and thus they offer a poor return on advertising dollars. Indians are however, data rich. Indeed, India is becoming a data rich country before it is becoming economically wealthy.
Data inversion is putting the data creator (the user) in a position of control, as opposed to the aggregator. The individual is able to control who sees their data and thus will be empowered to access goods and services through controlling the supply of their data. They can leverage their data which is valuable to many companies, giving them more freedom and choice. This is data democracy.
(II) A consent based framework is not enough
Technology companies have been accruing all types of data from users ostensibly to be able to develop their understanding of their market and thus be able to provide better products or services. The data they take is with the user’s consent. We are all familiar with the long Terms & Conditions page that we must adhere to before downloading a mobile app. Some questions can immediately be raised with such an operating model: how broad is the consent being granted by the user? Does the user understand the implications of their consent? How are the companies that take the data from the users then held accountable for their actions thereafter?
The consensus was that technology alone won’t provide a complete solution. While technology can help manage what data is transferred or shared, it’s difficult, if not impossible, to control how it is ultimately used. In addition to consent, we need an extra layer of protection for the consumer. This must come from the law. We can think of this as an accountability layer: legislation will hold companies to account with respect to how they use consumer data.
(III) India needs a strategic policy on managing its data FAST.
With 3 Indians experiencing the internet for the first time every second, the number of smartphone users increasing by 100mm each year, and more than 1.1bn people now registered with Aadhaar, India is becoming data rich very fast.
The growth of data and the applications for which it is used is occurring much faster than either law or policy has been able to adapt. As a country, India needs to think strategically into how it can define a policy framework which allows Indians to benefit from their data. It is imperative that India forms a response to the challenges that are resulting from a boom in data prevalence before it is misused or they lose control of the data that’s being created.
There are legitimate concerns that data on Indians is flowing out of the country and therefore out of the purview of the Indian authorities. Regulation is needed to prevent this. This is not about protectionism; any company, whether they are foreign of Indian are free to collect and operate on their business on data, as long as they respect the law of the land.
Data inversion will also help with this colonisation problem since the data owner is the user and their data is not kept in silos.
A second concern is a user’s privacy. Today we have a situation whereby a user can provide their data and in return expect a service. The user is however, required to give access to ALL the data that the service provider requests, even if they don’t think all of it is relevant. It is very much a take-it-or-leave-it model which clearly puts the power in the hand of a service provider. If the user is in control of their data, they can provide specific access on a needs-based use only.
Data inversion will help mitigate the winner-takes-all equilibrium by handing power back to the user. The objective here would be to allow a user to take back their data from one company and provide it to another. Related to the point above, individuals could demand consent of data sharing between services, even if they are owned by the same company. This unbundling will create real choice for users and stop a large tech company crowding out everyone else since they have the most data.
Indians will benefit most if they are given control of their own data. The technology and infrastructure that this requires is already in place. Now the Government and the regulators must respond to enact the necessary changes to ensure a more empowered future for its citizens becomes a reality.
