First Principles | What the new Data Protection Bill might look like

Ever wondered why do you get spammed with phone calls, emails and text messages from service providers of all kinds?Short answer: Because India does not have a comprehensive Data Empowerment and Protection Architecture (DEPA) in place. But there is one in the works that recognizes an individual’s right to privacy as fundamental. In any case, this was the stated intent of the Personal Data Protection (PDP) Bill which was withdrawn after much work had gone into it earlier in August this year. The official stance was that it had gotten outdated. Word in policy-making circles now is that a new version of this Bill will be tabled in Parliament by December. When fully implemented, all spam may end.So, what might the new Bill look like?Conversations with people such as Sharad Sharma, a volunteer at the thinktank iSPIRIT, offer some pointers. He suggests we begin by asking questions like: What happens to the financial details shared with a bank after applying for a loan? For that matter, what about personal health records that continue to reside with a pathology lab after your diagnostics are done? Or just how do e-commerce companies continue to track us after we’ve visited a site?As things are, Sharma explains, each time you access their services, they keep a copy of our data. And there are thriving marketplaces that deal with this data. Very simply put, people’s personal data is traded by third parties. This is a global problem that no one has been able to solve.By way of example, Sharma points to how most people access the internet. Over 90% of Indians use the Chrome browser built by Google to do that. While the browser is free, the data that Chrome collects about each user is used by another division of Google to serve users highly targeted ads. All the monies that accrue from these ads go to Google.“Most people turn their heads the other way and assume it may not be as bad as things are because individual user data is anonymised,” Sharma says. This argument is extrapolated across all other domains such as finance, healthcare, e-commerce. But the problem here, he explains, is that “If I anonymise with a lot of vigour, then the patterns in the data get hidden adequately and the utility of that data comes down.” It is inevitable then that some clever technology will find ways to de-anyonymise the data and identify individuals.This is why governments world over have been grappling with how to adequately restrict the amount of data an entity collects, and limit them to the purpose they ask it for. This is the hairy problem the upcoming PDP Bill will address, and India’s fintech and healthcare sectors are where it will be first implemented.When operationalised at a bank, Sharma explains, in the new scheme of things, the bankers will get to view a completely digital version of a borrower’s repayment history and all other assets that may be scattered. In turn, this gives them a more informed perspective than just credit scores they go by now.What it will give them is not just a view of the borrower's ‘current ability’ to repay a loan, but also whether they may have the ‘propensity’ to repay a loan in the future. And when such data is available digitally, a lender does not get to reuse it like they do now. There is a ‘purpose-limitation’. This restriction protects a user’s privacy unlike now when data is shared and often traded. This, Sharma says, is because the data vendors will have access to will be ‘Silver Copies’ that cannot be re-used as opposed to the ‘Gold Versions’ that can be used all over again.Pilot projects have been deployed in healthcare as well to track how user data is maintained. Then there are some experiments underway to figure if any monies that are earned from a user’s data can find its way back to the user. But all this will take a while because the entire ecosystem must be digitised.Policymakers from across the world will be watching closely how this Indian experiment, the largest of its kind in contemporary times, unfolds.