Niti Aayog on how India can protect personal data

India needs a paradigm shift in personal data management that transforms the current organisation-centric data sharing system to an individual centric approach that promotes user control on data sharing for empowerment, said Niti.

India needs a paradigm shift in personal data management that will promote greater user control on data sharing, according to a new discussion paper by Niti Aayog.

The draft for discussion paper titled 'Data Empowerment and Protection Architecture (DEPA)' further said it is designed as an evolvable and agile framework for good data governance, given the rapid pace of change in this arena.

In a nutshell, it said, DEPA empowers people to seamlessly and securely access their data and share it with third-party institutions.

The draft paper further said that opening up an Application Programming Interfaces (APIs) based data sharing framework would bring significant innovation by new fintech entities.

APIs enable seamless encrypted data flow between data providers and data users through a consent manager, it added.

"India needs a paradigm shift in personal data management that transforms the current organisation-centric data sharing system to an individual centric approach that promotes user control on data sharing for empowerment," the discussion paper said.

It noted that DEPA is predicated on the notion that individuals should have control over how their personal data is used and shared.

The draft for discussion paper also pointed out that a well designed data governance framework for the Indian context would enable, not just secure data protection, but also grant users control over data through a safe and seamless protocol to share data across institutions, leading to individual empowerment and well-being.

According to the discussion paper, other countries have responded to data protection challenges by implementing efforts to improve data protection and consent-based sharing (such as Open Banking in the UK or General Data Protection Regulation (GDPR) in the EU), which India can learn from.

"However, these approaches have not addressed the issue in a manner that is fully relevant to India's scale and diversity, and to our objectives around accelerating financial inclusion, economic growth, and data democracy," it said.

In his foreword, Niti Aayog CEO Amitabh Kant wrote that in an evolving and fast paced digital landscape, headlines world-over have squarely placed data protection, privacy, and unauthorised data sharing or misuse in the limelight.

"In India, we not only need stronger data protection, but also data empowerment: everyday Indians need control over their own personal data to improve their lives.

"They should be able to leverage their digital history to access growth opportunities offered by different institutions," Kant wrote.

He further said that with DEPA, India will be taking a historic step towards empowering individuals with control over their personal data, by operationalising an evolvable regulatory, institutional, and technology design for secure data sharing.

Stating that beyond the financial sector, DEPA also presents opportunities in health, jobs and urban data, Kant said this has become more exigent in a post-COVID world.

"DEPA builds the right infrastructure. It inverts the traditional Western model where data is simply used to advertise and sell products, to one where data can be used to empower a billion Indians," the Niti Aayog CEO noted.

Photograph: Kacper Pempel/Reuters