Data Governance, Asian Alternatives: How India and Korea Are Creating New Models and Policies

Deepening concerns about digital authoritarianism have led many observers to posit a stark contest between democracy and autocracy that will shape the governance of technology and data.¹ In this reckoning, the world’s democracies are said to have open approaches that rely on market mechanisms. By contrast, the world’s autocracies, this thinking goes, privilege the role of the state and aim to strengthen its capacity to harness all data, both public and private.

But this binary framing elides the extent to which democracies have developed diverse approaches. Some democracies, especially in Asia, have adapted policy and regulatory features that deepen and extend the reach of the state. Some democracies, again especially in Asia, have developed data governance regimes that reflect the unique features of their institutions and political cultures.

It is important, therefore, to dig into this diversity, especially at a moment when there is a growing focus on data policy at both the international and national levels. This intensifying focus on data is being driven by several factors, including

• the growing power of multinational cloud services companies, such as Amazon Web Services;
• the extraordinary amounts of data being collected by social media platforms;
• the growing importance of the Internet of Things in many sectors of the global economy;
• widespread fears around the world that citizens’ data are being siphoned off for the benefit of foreign companies;
• the essential role that data used for contact tracing and quarantine restrictions played in mitigating the impact of the coronavirus pandemic; and
• excitement around new applications of artificial intelligence (AI), especially machine learning, which will benefit companies and countries able to generate, manage, and remix gigantic stores of high-quality data.

Amid this growing focus on data, the world is not fracturing into just two spheres—an autocratic Sinosphere dominated by China and an open, democratic sphere centered on the transatlantic West. Instead, third countries, many of which are consolidated democracies, are influencing debates about data policy, the business models of technology firms, and regulatory frameworks. If these countries can collaborate, leverage the power of open standards and open-source software, and demonstrate new approaches to digital development, they could become leaders in their own right as the next phase of the data economy unfolds.

This volume highlights some of the alternative models that have originated in two major Asian democracies, India and South Korea (hereinafter Korea). It compares these two countries’ distinctive approaches through case studies that demonstrate just how much more complex the world will be than the commonplace prediction of a battle between U.S.- and Chinese-centric approaches.

This volume is a sequel to a 2021 study, The Korean Way With Data, a multichapter deep dive into three critical aspects of Korea’s distinctive experiences with data: data resilience, data localization and privacy, and online authentication and data access control. This follow-up volume extends and expands that earlier stream of work by explicitly comparing Korea’s experience in two areas—open data and cross-border data governance—with that of India, a leader in software and information technology (IT) services.

Bluntly put, to those who believe that the world faces a stark or binary choice between transatlantic-centered democratic models or China-centric authoritarian ones, this volume should be an eye-opener. Like the 2021 volume on Korea, this study demonstrates that additional players are leading the way in several key respects. Both India and Korea are consolidated democracies, and neither of them is simply emulating U.S. or European experiences. Instead, they are pioneering their own approaches, mixing and matching elements of their unique democratic institutional frameworks with national requirements and policies derived from distinctive political cultures.

To be sure, progress on data governance in both India and Korea has been uneven. Their stories are by no means simple ones. For example, this volume shows that different agencies in the governments of each of these countries have conflicting policy goals and, when their preferred policies have collided, it has proved almost impossible to develop a clear, consistent vision and strategy. The result has been inadequate investment; stalled-out projects; and missed opportunities to share, combine, and use data to solve problems in the Indian and Korean public and private sectors.

When Policies Collide

An important theme that links both the 2021 and 2022 volumes is that disparate agencies in a fragmented bureaucracy can lead to disparate policy goals. The two chapters in this volume by Korean authors (along with a chapter in The Korean Way With Data, by Nohyoung Park) highlight inconsistencies and points of conflict and competition across the Korean bureaucracy in Seoul.²

At international fora such as the Group of 20 (G20), Korea’s Ministry of Foreign Affairs has worked hard to forge agreements to facilitate cross-border flows of data. The ministry’s efforts have been supported by the Korean Ministry of Economy and Finance, which strives to maximize opportunities for Korean firms that want to provide data-driven services to customers and companies around the world. But at the same time, Korea’s national security agencies have blocked the export of certain types of map data and other data that they judge could be used by North Korea or other adversaries to attack South Korea. These security-focused agencies fret not just about physical attacks but also malicious hacks and information warfare (including disinformation). Meanwhile, Korea’s financial regulators and various government agencies tasked with protecting the privacy of Korean citizens’ personal data are leery about allowing foreign companies to store and process Korean data in other countries, particularly in countries with inadequate, unclear, or poorly enforced data protection regulations.

The situation is quite similar in India. The country’s Ministry of Electronics and Information Technology has championed the cause of a “borderless” digital world so that Indian firms can move data easily across borders and better serve their customers, no matter where they happen to be located.³ But as Smriti Parsheera shows in her chapter in this volume, there are many barriers to realizing this Indian vision for cross-border data. As in the case of Korea, these obstacles include objections from India’s privacy regulators, who are developing Indian data protection rules that could block the export of Indian citizens’ personal data to other countries.

Even more serious are the demands of Indian law enforcement agencies, which want access to data to conduct criminal investigations and ensure regulatory compliance. These agencies fear that if Indians’ data are stored overseas, whether in corporate databases, social media platforms, or cloud computing centers, they will struggle to gain access to the data they want.

But India and Korea do diverge in one respect: in India, these arguments from law enforcement often seem to win the day. In Korea, by contrast, national security concerns have had a much greater impact on outcomes and policies than the concerns of law enforcement have.

The Need for Digital Leadership

Interestingly, in both India and Korea, digital policy sits atop the list of national priorities. That is why both countries’ governments are tackling digital and data-related issues at the highest possible level. India’s Prime Minister Narendra Modi made the Aadhaar biometric identity project, which has given hundreds of millions of Indians a form of digital identification, a personal priority. Similarly, in the 2022 Korean presidential election, the major parties’ candidates debated the topic of digital identity (and the failures of earlier national efforts). This is not typical of most countries today. This provides yet another reason why Korean and Indian efforts to craft digital policies deserve much more attention globally than they have hitherto received.

Countries whose presidents and prime ministers take the lead on policy decisions related to the digital economy often force competing ministries to forge a consensus. These countries end up with a huge advantage in helping data-intensive industries compete. Ultimately, these countries tend to fashion new e-government solutions, foster machine learning, and enable new, data-driven business models.

Just take Estonia, a much smaller economy than either India or Korea: it has benefited hugely from the digital leadership shown by former president Toomas Hendrik Ilves, who became an internationally respected champion for e-government and cybersecurity policy.⁴ In the United Kingdom, former prime minister Tony Blair’s personal involvement in promoting e-government helped break through bureaucratic barriers that hindered agencies online, and the work of the Tony Blair Institute for Global Change is helping current leaders go digital.⁵ In the United States, some have argued that the early successes of former president Bill Clinton’s administration in promoting the commercial internet, which made the U.S. government a leader in using the World Wide Web and in fostering e-commerce, owed much to the powerful role played by the White House (and especially by then vice president Al Gore).⁶ Gore and the White House took on a very high-profile role in crafting all-of-government strategies for the internet.⁷ White House events, high-profile speeches, public relations campaigns, and demonstration projects (such as the White House’s first website) also helped to highlight the need for proactive digital policies.⁸ More recently, former president Barack Obama’s personal participation in digital initiatives led him to be labelled the “Digitizer in Chief” and the “Geek-in-Chief.”⁹

Today, in most countries, there is even more potential for digital innovation but less digital leadership. The result has been conflicting policies promulgated by different agencies that can discourage innovators and risk-takers in both the private sector and the government bureaucracies. These players want to offer new tools and online services but fear running afoul of government regulations regarding data protection, export controls, surveillance requirements, cybersecurity, and more. From a global perspective, the Indian and Korean experiences highlighted in the four chapters that follow are standouts.

Faulty Metaphors Can Lead to Faulty Policies

But, of course, leadership does not mean that presidents and prime ministers must delve deeply into the arcana of data management and technical standards for them to shape digital policy. In many cases, their most important contribution can simply be to share a vision for how information technology and the data it generates, collects, combines, and analyzes can benefit the citizens they govern and the countries they lead. Simply put, savvy national leaders can explain how to think about the digital future.

But unfortunately, too many policymakers have adopted faulty metaphors and models that only confuse their countries’ thinking about data. The most obvious example is the frequent statement that “data is the new oil,” which was popularized by a 2017 cover story in the Economist.¹⁰ While it is certainly true that data is valuable like oil, in many ways this analogy is not only not useful but is even downright harmful.¹¹

For one thing, comparing data to oil implies that data is a commodity to be sold and consumed. But data is not, in fact, a finite good that, like oil, is traded and shipped back and forth. Indeed, unlike oil and other commodities, it is simple to replicate and share data, increasing its use and value. The idea that data is a “fuel” for the digital economy is leading too many policymakers to assume that countries should hoard the data produced within their borders.¹² Even more misleading is the idea that data is “currency,” implying that data should be either tightly controlled or traded, like a national currency, rather than shared jointly.¹³

What, then, is a better model? A simple one is that data is actually more like air or water than like either oil or currency.¹⁴ Like air, for example, data can be viewed as something that should be allowed to flow freely, transcending national borders. That is because air, like data, can be used and reused for many different purposes by many different people. It can be polluted like the air, but it can also be cleaned. This approach to thinking about data—as air rather than as oil or a currency—works particularly well when addressing scientific data, such as environmental data, since researchers all over the world need it.

But water is another useful metaphor because for most data, there are reasons to place some limits on its use and flow. Reasons to do so can include data protection and privacy, national security, copyright enforcement, assuring commercial advantage, and others. In these cases, a different analogy can be used. Instead of flowing freely like air, such data should be treated like water.¹⁵ After all, almost all the world’s water circulates freely in oceans, rivers, lakes, and atmospheric clouds or is locked in cold storage in ice sheets and glaciers. But some of the world’s water is captured in reservoirs, filtered, and piped to customers. And some water, usually from underground aquifers, is then bottled, branded, and sold.

For policymakers who want to put some limits on data, this water analogy works quite well. It effectively conveys how important data is to life in the digital age and how leaders need to work to ensure more clean data are made available to more people. Treating data like water makes it clear that not all data is the same or has the same value and, most importantly, that data is something—like water—that can be reused and remixed.

Key Choices for Policymakers

The critical top-level issue for policymakers wrestling with data policy is whether to try to create a single overarching approach to data management or instead to take a more federated approach.¹⁶ To extend the water metaphor a bit further, the choice policymakers face is whether to have a single unified national water utility that serves every home, or instead to encourage the formation of multiple local water companies and home-based wells that operate within a broad regulatory framework.

In their chapter in this volume, Indian authors Rahul Matthan and Shreya Ramann explain how the Indian government is promoting a Data Empowerment Protection Architecture (DEPA) to consolidate data sets throughout the Indian government and beyond. But in Korea, as Taewoo Nam shows in his chapter, the government has encouraged hundreds of companies to work with different ministries to find new, useful ways to apply the data they collect. These two Asian democracies have thus arrived at two very different approaches.

From our perspective at least, the Korean approach that Nam describes is much easier to implement when companies are permitted to take full advantage of the many cloud service providers that can give even small or medium-sized companies access to powerful data storage, machine learning tools, and cybersecurity services. These were previously only available to large IT firms. But because many of these services are now provided by American or Chinese companies, countries that lack homegrown cloud services providers fear that foreign countries will not adequately protect the data they process. In the Chinese case especially, there are national security concerns that come into play because Beijing has an intrusive approach to data generally.¹⁷

As the following chapters make clear, law enforcement agencies, including those of India, are especially concerned that they will not be able to access the data they need to catch and prosecute criminals if that data is stored in data centers controlled by companies overseas. In the United States, similar concerns led to the Clarifying Lawful Overseas Use of Data Act (or the CLOUD Act), which specifies how foreign governments can request data from U.S.-headquartered cloud service providers.¹⁸ But countries like Korea and India have not yet been able to benefit from this U.S. legislation.

There have, therefore, been calls in Korea and India for more data localization, motivated by both governments’ desire to protect citizens’ privacy and by India’s aspirations to enable greater data access for law enforcement surveillance.

India in particular has benefited from Indian IT firms that process data for companies around the world. In the past, India has permitted the free movement of data across its borders, but pending domestic legislation would reverse these more open practices.¹⁹ Similarly, in Korea, arguments for and against localization are becoming more pronounced, as Kyung Sin “KS” Park documents in his chapter in this volume. The few studies that have assessed the economic impact of data localization requirements have found that limiting cross-border data flows can significantly slow gross domestic product (GDP) growth.²⁰ How governments decide to balance economic benefits against other factors will help to define the future of the data economy. Park makes an important argument that the free flow of data should also be viewed as a human rights issue since citizens want to be able to choose which companies control and protect data about them and which governments might be able to access that data.

But this will require them to think differently and adopt some new approaches. One particularly exciting new model for data governance involves data unions or data cooperatives, an idea being promoted by U.S. computer scientist Sandy Pentland and his colleagues at the Massachusetts Institute of Technology among others.²¹ A data cooperative functions like a bank or credit union, but rather than handling and distributing money, it stores and shares data about individual users. The key to making this model work is that the cooperative is contractually obligated to users or users’ organizations to protect and use data about an individual or group for that party’s own benefit. The most important impact of this approach is that it would enable a very distributed data architecture, where data would not need to be pooled in a few data oceans controlled by just a small handful of companies.

The following chapters highlight the digital policy challenges governments are facing, and why these challenges are becoming increasingly complicated and ever more important. Indian and Korean experiences, models, and struggles can help digital policymakers around the world, especially in other raucous democracies, design their own governments’ data policies.

Implications for Internet Governance

The main focus of this volume is what is happening in India and Korea at the national level and what other national policymakers can learn from their experiences. But there is another dimension to the volume—namely, how these models could influence debates in international fora about the future of the internet.

Internet governance is a broad term encompassing the full range of decisions, large and small, made by governments, corporations, standard-setting bodies, and users that affect how the internet operates and evolves.²² For years, diplomats, technology policymakers, corporate representatives, and others have debated how these decisions are made and whether more international coordination is needed. Thousands of international meetings have been held, and an extensive literature has developed about these choices.

Today, these debates about internet governance are more important than ever. A key question is whether the internet will continue to be an open, global network connecting users everywhere or whether it will fragment into national and regional networks as governments exert more influence over how it is designed and how it is used.²³ A new and broader debate has also emerged about digital policy. Rather than just focusing on the networks that connect internet users to the applications they wish to use, the data and equipment attached to the internet, such as smartphones, Internet of Things devices, data centers, and cloud computing facilities are also drawing attention.

This growing attention is reflected in debates about international data governance, data sovereignty, and “the datasphere.”²⁴ The secretary general of the United Nations (UN), António Guterres, has been promoting “digital cooperation,” which builds on the work of the Internet Governance Forum and various UN agencies and offices but extends far beyond merely shaping the Internet and how it functions.²⁵ Much of the UN-related work Guterres has promoted focuses on data policy and the need to make high-quality data more available to more people for more purposes (with a special emphasis on fulfilling the UN’s Sustainable Development Goals).

Placing more of a focus on data and how it can be applied could help remove the barriers that prevent innovators in countries around the world from developing and experimenting with new online services. This includes a wide array of activities ranging from conducting life-changing and life-saving research to helping workers be more productive and energy-efficient and making lives safer and more secure. But in most countries, data policy has been an overlooked backwater. Unlike politically fraught issues like online privacy, hate speech on the internet, or disinformation and the polarization it causes, discussions about making government data more available or about cross-border data flows simply do not generate headlines. Worse, there are no easy answers to these policy questions because different types of data require very different types of treatment.

Most governments (including those of India and Korea) have no clear and singular focal point for data policy decisions. Internationally, there is similarly no such body as a World Data Organization (and most, including us, would argue against any such idea). Instead, there are many different intergovernmental organizations and scientific organizations that tackle different pieces of this data puzzle. At the highest level, for example, the G20 has added cross-border data flows to its agenda, not least through the late Japanese prime minister Abe Shinzo’s push at the 2019 G20 Osaka Summit for “data free flow with trust.” Abe’s initiative led to the emergence in 2021 of the G7’s Digital Trade Principles, which aim to remove barriers to the sharing of data across national borders.²⁶ But notably, one of the two countries at the heart of this volume—India—refused to sign up for Abe’s Osaka initiative.

These international efforts to focus more attention on data policy should continue and should motivate both developed and developing countries to clarify the mishmash of national policies that affect how data are handled, shared, and used. International organizations have a critical role to play in showcasing how individual countries, like India and Korea, are taking steps to enable their citizens and companies to unleash the power of data. These multilateral and multinational groups, both formal and ad hoc, can push back against policies and models that would prevent that.

Open Data

The first two chapters on open data feature Rahul Matthan and Shreya Ramann on India’s experience and Taewoo Nam on Korea’s. Both countries are making access to government data a high priority and have legislation ensuring that government agencies share data that can be safely made public. But precisely how this legislation is implemented will determine the course through which many innovative and new applications of that data develop. Nam’s chapter shows that in Korea, hundreds of companies are already using government data sets. In India, meanwhile, Matthan and Ramann delve into a growing debate on access to and the use of nonpersonal data, a critical ingredient for machine learning tools.

What is ultimately important is that policies for government data (and the infrastructure built to provide access to such information) offer models for access to other types of commercial and consumer data in safe, secure, and reliable ways. But unfortunately, some government data protection and data localization regulations could unintentionally severely hinder the development of these new approaches.

India’s DEPA architecture is designed to improve inclusivity and allow those most in need to access online services but also have broader oversight on consent. Matthan and Ramann show that since data storage is cheap, Indian and foreign entities can amass vast volumes of it. But this data is siloed and usually only available to those who have harvested it, while the Indian citizens to whom the data pertains have almost no say in its use. Indian data policies, they argue, aim to deal with both challenges, not just by minimizing privacy risks and potential misuse of data but by giving individuals practical means to access, control, and share their data for their own benefit. They describe regulatory and technological advances being made in India, especially around DEPA, and how such models can be used to build on data governance initiatives around the world.

For his part, Nam addresses three main issues in Korean open data policy governance: institutions, policies, and organizational capacity. In all three areas, he sees progress but finds some flaws in the country’s current approach. One example is a regulatory framework that divides responsibility among diverse ministries with different approaches. This arrangement, he says, becomes even more complicated once local governments enter the mix. Public and private data cannot be easily integrated since they fall under different bureaucratic jurisdictions that functionally overlap but remain institutionally divided.

Likewise, Nam argues, Korea simply does not provide well-defined criteria for success to guide the wide variety of actors who use and leverage data. As a result, many corporate data users in the country complain about the low value of open public data while even government employees lack a substantial understanding of what data-driven administration means and why it is important for the public sector, much less the country’s corporate and academic sectors.

Cross-Border Data

The next two chapters turn to cross-border data, pairing up Smriti Parsheera on India’s experience with “KS” Park on Korea’s. These two chapters are anchored by the pivotal roles these two countries play in the global ecosystems that require rapid and secure international sharing of confidential business data. They explore how each country has sought to manage the delicate balance between localization and internationalization.

Some proposals for data localization, often motivated by governments’ desire to protect citizens’ privacy or to enable law enforcement surveillance, can hinder this free flow. For example, India has, in most cases, allowed for the free movement of data across its borders, but pending domestic legislation would hamper these more open practices. Similarly, in Korea, arguments for and against localization are becoming more pronounced. The few studies that have assessed the economic impact of data localization requirements have found that limiting cross-border data flows can significantly slow GDP growth—a tricky challenge for India and Korea at a time when both countries face growing domestic and global economic headwinds.²⁷

Parsheera begins with the central contradiction India faces: the country has reaped significant benefits from being digitally connected and following an open market policy, but the country is also grappling with the challenges posed by data monopolization, barriers to lawful access, and limitations on the effective enforcement of laws, rules, and regulations in the digital sphere. India aims to transition from a user to a controller in digital markets and, to this end, it has leaned on technological self-reliance combined with frequent assertions of “digital sovereignty.”²⁸

As in Matthan and Ramann’s chapter on open data, Parsheera traces a fragmented and often contradictory Indian institutional and policy landscape. But beyond the domestic sphere, she also explores whether and how international instruments like the Budapest Convention could be useful to New Delhi. India is not a signatory to the convention, a binding multinational treaty that comprehensively addresses both cyber crimes and the gathering of electronic evidence of noncyber criminal activity.

This theme links Parsheera’s chapter to Park’s because he, too, notes Korea’s absence from the Budapest regime. He argues that Seoul is thereby denying itself a useful pathway to pursue its interests. Indeed, Park finds much fault in Korea’s localization discourse and policy. He argues that the assimilation of international arrangements and instruments could enable Korean policymakers to realize their policy goals without mandating such data localization. For instance, the Budapest Convention could provide an alternative to time-consuming mutual legal aid treaty processes that require law enforcement agencies to request help from their foreign counterparts. Similarly, while acknowledging concerns about citizens’ privacy as an important policy goal, Park argues that the adequacy process of the European Union’s General Data Protection Regulation or the certification process of the Asia-Pacific Economic Cooperation forum’s Cross-Border Privacy Rules may provide the needed level of protection, no matter where the data may be stored and processed.²⁹

Democratic Diversity

As the four chapters in this volume demonstrate, major Asian democracies like India and Korea are not simply following the lead of the United States and Europe on data governance. Instead, in many areas connecting to both open data and cross-border data, they are pioneering their own unique approaches, which are anchored firmly in their own consolidated democratic institutions.

The goal in this volume is to highlight these alternative models and to compare and contrast their distinctive features. Indeed, like the 2021 volume on The Korean Way With Data, this sequel volume demonstrates that the future will be much more complex than a putative battle between U.S.- and China-centric approaches, much less between democratic and authoritarian approaches. Much can be learned—and some things can be emulated—from the experiences of these two unique and important Asian democracies.

Notes

¹ See, for example, Adrian Shahbaz, “Freedom on the Net 2018: The Rise of Digital Authoritarianism,” Freedom House, https://freedomhouse.org/report/freedom-net/2018/rise-digital-authoritarianism.

² Nohyoung Park, “A Korean Approach to Data Localization,” in The Korean Way With Data: How the World’s Most Wired Country Is Forging a Third Way, ed. Evan A. Feigenbaum and Michael R. Nelson, Carnegie Endowment for International Peace, August 17, 2021, https://carnegieendowment.org/2021/08/17/korean-approach-to-data-localization-pub-85165; Kyung Sin “KS” Park, “Korea’s Path to Best Practices for Cross-Border Data Flows,” in Data Governance, Asian Alternatives: How India and Korea Are Shaping Rules and Standards, ed. Evan A Feigenbaum and Michael R. Nelson, Carnegi Endowment for International Peace, August 31, 2022; and Taewoo Nam, “Open Data Policy in Korea,” in Data Governance, Asian Alternatives: How India and Korea Are Shaping Rules and Standards, ed. Evan A Feigenbaum and Michael R. Nelson, Carnegi Endowment for International Peace, August 31, 2022.

³ Smriti Parsheera, “India’s Domestic Priorities and International Positioning on Cross-Border Data Flows,” in Data Governance, Asian Alternatives: How India and Korea Are Shaping Rules and Standards, ed. Evan A. Feigenbaum and Michael R. Nelson, Carnegie Endowment for International Peace, August 31, 2022; and Indian Ministry of Electronics and Information Technology, “India’s Trillion-Dollar Digital Opportunity,” Indian Ministry of Electronics and Information Technology, 2019, 9, https://web.archive.org/web/20220604181319/https://www.meity.gov.in/writereaddata/files/india_trillion-dollar_digital_opportunity.pdf.

⁴ Susan Fourtané, “e-Estonia: The World’s Most Advanced Digital Society,” Interesting Engineering, February 24, 2020, https://interestingengineering.com/e-estonia-the-worlds-most-advanced-digital-society.

⁵ Diane Frank, “UK Finds New e-Gov Boss,” Federal Computer Week (FCW), May 27, 2004, https://fcw.com/workforce/2004/05/uk-finds-new-e-gov-boss/235596/; and Akos Erzse and Melanie Garson, “A Leader’s Guide to Building a Tech-Forward Foreign Policy,” Tony Blair Institute for Global Change, March 25, 2022, https://institute.global/sites/default/files/articles/A-Leaders-Guide-to-Building-a-Tech-Forward-Foreign-Policy.pdf.

⁶ William J. Broad, “Clinton to Promote High Technology, With Gore in Charge,” New York Times, November 10, 1992, https://www.nytimes.com/1992/11/10/science/clinton-to-promote-high-technology-with-gore-in-charge.html; and “Al Gore and Information Technology,” Wikipedia, https://en.wikipedia.org/wiki/Al_Gore_and_information_technology.

⁷ Ronald H. Brown, “The Global Information Infrastructure: Agenda For Cooperation,” National Telecommunications and Information Administration, June 1, 1995, https://www.ntia.doc.gov/report/1995/global-information-infrastructure-agenda-cooperation; and “The National Information Infrastructure: Agenda for Action,” U.S. Department of Commerce, September 15, 1993, https://eric.ed.gov/?id=ED364215.

⁸ Elahe Izadi, “The White House’s First Web Site Launched 20 Years Ago This Week. And It Was Amazing,” Washington Post, October 21, 2014, https://www.washingtonpost.com/news/the-fix/wp/2014/10/21/the-white-houses-first-website-launched-20-years-ago-this-week-and-it-was-amazing.

⁹ Thomas H. Davenport, “Who Can Succeed Barack Obama as Digitizer in Chief?,” Fortune, April 1, 2016, https://fortune.com/2016/04/01/who-can-succeed-barack-obama-as-digitizer-in-chief; and David K. Li, “Obama Is the Geek-in-Chief,” New York Post, April 25, 2016, https://nypost.com/2016/04/25/obama-is-the-geek-in-chief.

¹⁰ “The World’s Most Valuable Resource Is No Longer Oil, But Data,” Economist, May 6, 2017, https://www.economist.com/leaders/2017/05/06/the-worlds-most-valuable-resource-is-no-longer-oil-but-data.

¹¹ Antonio García Martínez, “No, Data Is NOT the New Oil,” Wired, February 26, 2019, https://www.wired.com/story/no-data-is-not-the-new-oil; and Michael R. Nelson, “Internet Myth-Busting,” Intermedia 47, no. 1 (April 2019):

https://www.iicom.org/intermedia/intermedia-apr-2019/internet-myth-busting.

¹² Harishankar Singh, “Data Is the New Fuel, AI Is the Accelerator,” IBM Digital Transformation Blog, May 14, 2021, https://www.ibm.com/blogs/digital-transformation/in-en/blog/data-is-the-new-fuel-ai-is-the-accelerator.

¹³ Jane Barratt, “Data as Currency: What Value Are You Getting?” University of Pennsylvania Wharton School of Business, Knowledge at Wharton, August 27, 2019, https://knowledge.wharton.upenn.edu/article/barrett-data-as-currency.

¹⁴ Howard Ting, “Data Is Like Air—So, How Do You Contain It?,” Forbes, May 11, 2022, https://www.forbes.com/sites/forbestechcouncil/2022/05/11/data-is-like-air-so-how-do-you-contain-it.

¹⁵ Dan Vesset, “Data Is the New Water,” Medium, July 27, 2020, https://medium.com/digital-bulletin/data-is-the-new-water-62ed9bb5158a. (This post is based on a study on data by IDC and Qlik.)

¹⁶ “Centralized Versus Federated: State Approaches to P-20W Data Systems,” National Center for Education Statistics Institute of Education Sciences, October 2012, https://nces.ed.gov/programs/slds/pdf/federated_centralized_print.pdf.

¹⁷ Ryan D. Junck, Bradley A. Klein, Akira Kumaki, Ken D. Kumayama, and Steve Kwok et al., “China’s New Data Security and Personal Information Protection Laws: What They Mean for Multinational Companies,” Skadden, Arps, Slate, Meagher & Flom, November 3, 2021, https://www.skadden.com/Insights/Publications/2021/11/Chinas-New-Data-Security-and-Personal-Information-Protection-Laws; Matt Burgess, “Ignore China’s New Data Privacy Law at Your Peril,” Wired, November 5, 2021, https://www.wired.com/story/china-personal-data-law-pipl; “Why China’s New Data Security Law Is a Warning for the Future of Data Governance,” Foreign Policy, January 28, 2022, https://foreignpolicy.com/2022/01/28/china-data-governance-security-law-privacy; Yvonne Lau, “Here’s What Beijing’s Sweeping New Data Rules Will Mean for Companies,” Fortune, September 1, 2021, https://fortune.com/2021/09/01/china-data-security-law-beijing-management-regulation-internet; and “China’s New National Privacy Law: The PIPL,” Cooley, November 30, 2021, https://www.cooley.com/news/insight/2021/2021-11-30-china-new-national-privacy-law.

¹⁸ U.S. Department of Justice, “CLOUD Act Resources,” U.S. Department of Justice, https://www.justice.gov/dag/cloudact.

¹⁹ Anirudh Burman and Upasana Sharma, “How Would Data Localization Benefit India,” Carnegie India, April 14, 2021, https://carnegieindia.org/2021/04/14/how-would-data-localization-benefit-india-pub-84291.

²⁰ Nigel Cory and Luke Dascoli, “How Barriers to Cross-Border Data Flows Are Spreading Globally, What They Cost, and How to Address Them,” Information Technology and Innovation Foundation, July 19, 2021, https://itif.org/publications/2021/07/19/how-barriers-cross-border-data-flows-are-spreading-globally-what-they-cost/; and “Restrictions on International Data Flows Have Doubled in Four Years, With Measurable Economic Consequences, ITIF Reports,” Information Technology and Innovation Foundation, July 19, 2021, https://itif.org/publications/2021/07/19/restrictions-international-data-flows-have-doubled-four-years-measurable.

²¹ Alex Pentland, Alexander Lipton, and Thomas Hardjono, Building the New Economy: Data as Capital (Cambridge, MA: Massachusetts Institute of Technology, 2021), https://mitpress.mit.edu/books/building-new-economy.

²² A couple of examples are the annual Internet Governance Forum conferences held under the auspices of the United Nations and the digital policy work done by the Organisation for Economic Co-operation and Development. See Internet Governance Forum (IGF), “IGF Annual Meetings Proceedings,” IGF, https://www.intgovforum.org/en/content/igf-annual-meetings-proceedings; and “Internet Policy and Governance,” Organisation for Economic Co-operation and Development, December 9, 2021, https://www.oecd.org/sti/ieconomy/internet-policy-and-governance.htm.

²³ Adam Segal and Gordon M. Goldstein, Confronting Reality in Cyberspace: Foreign Policy for a Fragmented Internet, (New York: Council of Foreign Relations, July 2022), https://www.cfr.org/report/confronting-reality-in-cyberspace/download/pdf/2022-07/CFR_TFR80_Cyberspace_Full_SinglePages_06212022_Final.pdf.

²⁴ Datasphere Initiative, “About Us,” Datasphere Initiative, https://www.thedatasphere.org/about-us. This initiative was started by the Internet and Jurisdiction Policy Network.

²⁵ United Nations, “Secretary-General’s Roadmap for Digital Cooperation,” United Nations, May 29, 2020, https://www.un.org/en/content/digital-cooperation-roadmap/.

²⁶ Anne-Marie Trevelyan and the UK Department for International Trade, “G7 Trade Ministers’ Digital Trade Principles,” Anne-Marie Trevelyan and the UK Department for International Trade, October 22, 2021, https://www.gov.uk/government/news/g7-trade-ministers-digital-trade-principles

²⁷ Rajat Kathuria, Mansi Kedia, Gangesh Varma, and Kaushambi Bagchi, “Economic Implications of Cross Border Data Flows,” Indian Council for Research on International Economic Relations and Internet and Mobile Association of India, November 2019, https://icrier.org/pdf/Economic_Implications_of_Cross-Border_Data_Flows.pdf.

²⁸ “‘India Won’t Compromise Its Digital Sovereignty,’: Ravi Shankar Prasad,” Hindustan Times, June 6, 2021, https://www.hindustantimes.com/india-news/india-won-t-compromise-its-digital-sovereignty-ravi-shankar-prasad-101622919207459.html.

²⁹ “What Is the Cross-Border Privacy Rules System,” Asia-Pacific Economic Cooperation, October 2021, https://www.apec.org/about-us/about-apec/fact-sheets/what-is-the-cross-border-privacy-rules-system.

Introduction

India has witnessed rapid digital growth in a short time span. This has resulted in technological advances, new governance regimes, and bespoke, India-only digital policies. Taken together, these changes have come to define the Indian model of data governance. In turn, this model aims, from an Indian perspective, to empower citizens.

As the pace of government adoption of new technologies and services has picked up, public debates in India about the need to balance data rights with digital innovation have accelerated in lockstep.¹ This trend has been driven by India’s rapid digital expansion and concerns that citizens unfamiliar with the potential harm that could arise from the misuse of data will suffer. Despite these concerns, India does not yet, as of August 2022, have a uniform, comprehensive data protection law, even though data has become central to most private enterprises and public initiatives.

 

Since data storage is cheap, Indian and foreign entities can amass, day after day, year after year, vast volumes of information on the off chance that it will be of use someday, rather than risk not having it on hand when they need it.² However, since these data are siloed and usually only available to those who have harvested it, little is being done to unlock the full value of the data. Worse, the Indian citizens to whom the data pertains have almost no say in its use.

Indian data policies have focused on addressing both these challenges. In addition to traditional approaches to minimizing privacy risks and the potential misuse of data, these Indian policies are also meant to provide individuals with a practical means by which they can access, control, and share their data for their own benefit.

 

India’s approach to data governance has evolved in light of India’s domestic priorities and international position. This analysis specifically describes and assesses the evolution and implementation of various regulatory and technological advances in India and how such models can be used to build on data governance initiatives around the world.

The sections below examine new initiatives and policies, evaluate the effects of India’s regulatory approach on the country’s domestic growth and global position, and look at the role these initiatives play in the broader data governance ecosystem worldwide.

The first section discusses India’s digitization and the data boom that followed, a period that began in earnest in the 1990s. It looks at the increasing proliferation of digital services and examines how data has and will continue to affect the growth of the Indian economy. The second section looks at the existing and future legal framework for data governance in India. It covers both existing regulations as well as notable public policy proposals on personal, nonpersonal, and government data. The third section examines the technology infrastructure that the Indian government has put in place to augment legal frameworks for effective data sharing. With a focus on the implementation of the Data Empowerment Protection Architecture, this section describes India’s technolegal solutions for empowering individuals to wield control over the data they generate. The fourth section concludes by weaving together themes from India’s data governance strategy. It contextualizes India’s proposed initiatives in relation to other global approaches to data governance. Issues such as data sovereignty and data colonialism are analyzed to assess how they affect India’s standing in the global data market.

India’s Data Economy

In the 1980s, India’s information technology (IT) sector was focused primarily on software exports and services and was valued at only $25 million, constituting approximately 0.01 percent of India’s GDP at the time—primarily because the sector was closed to the world and subject to high import tariffs.³ Software was not a government-recognized industry, and Indian exporters were unable to convince banks to finance their activities.⁴ The country’s early IT industry thrived despite the government—not because of it.

By contrast, India’s IT industry and related sectors currently have annual revenues of $200 billion and account for 13 percent of the country’s GDP.⁵ India long has been known as a global powerhouse in exporting IT services, but the country’s IT sector is no longer solely dependent on exports for growth. Over the past decade, domestic demand for IT services has grown rapidly,⁶ with the aggregate value of domestic demand for digital services in India outpacing the total value of exports.⁷ Today, digital services are used more widely than ever in India. This change was made possible by the deep penetration of mobile internet access through all strata of Indian society—including into the country’s rural hinterland. More than 750 million Indians use smartphones, or approximately 54 percent of the country’s total population, allowing them to access entertainment, information, and public services on the go.⁸

In addition, over the past ten years, India has rolled out digital infrastructure on a commensurate scale, enabling residents to make rapid strides toward a paperless virtual existence, allowing them access to digital services from anywhere in the country without having to carry physical documentation or visit specific service-delivery locations. Today, more than 5.4 billion digital payments take place each month over India’s Unified Payment Interface (UPI), a digital payment system that makes it easy to transfer money between bank accounts, mobile money accounts, and digital wallets.⁹ These transactions range from small purchases of chai and biscuits from pushcart street vendors to substantial e-commerce payments for goods and services. The interface has also made it possible for microlevel entrepreneurs and small businesses alike to identify and take advantage of commercial opportunities that were previously unavailable to them.

A similar revolution is poised to unfold in new data services, enabled by a new digital framework in the financial services sector.¹⁰ Other sectors (such as healthcare and education) are similarly expected to benefit from this framework.¹¹ Finally, work is underway to unbundle location-based digital commerce, allowing different elements across the commercial ecosystem to interact more efficiently and opening the door to greater competition between players.¹² When rolled out, this open network of digital commerce will likely reduce the dependence of consumers and smaller retailers on vertically integrated platforms in favor of a more disaggregated, decentralized approach.

Each of these projects has contributed to the widespread use of data and illustrates the importance of effective and efficient data governance. However, before getting into the details of India’s data governance regime, it is necessary to first understand how the IT sector has evolved and grown to its current size and state.

India’s Promotion of Information Technology

Three critical factors enabled the development of India’s IT industry starting in the 1990s: the economic liberalization of 1991, industry-specific measures such as the establishment of software technology parks in 1989, and intensive government procurement of IT equipment and services. This welcoming environment encouraged several multinational companies to set up shop in India, a development that in turn sparked an IT services export boom.¹³ By 2000–2001, India’s total software exports grossed $6.4 billion.¹⁴

Economic reforms, liberalization, and the steadily increasing presence of foreign multinational companies in India led to several ancillary developments, including the launch of cable internet and the passage of India’s first IT-related legislation.¹⁵ In 2015, the Digital India initiative was launched.¹⁶ This ambitious, multifaceted program aimed to transform the country’s digital infrastructure into a public utility—facilitating digital governance and empowering citizens. Several additional programs have been launched under the broad umbrella of Digital India, including BharatNet (a program to provide internet access to all villages in the country), Universal Access to Mobile (a program designed to provide mobile connectivity to over 55,000 villages in India that previously lacked mobile access), and the Smart Cities Mission (a program to transform all Indian cities into smart cities).¹⁷

Increased digitization, the proliferation of online services aimed at Indian customers, and the use of new technologies have dramatically increased the volume of data in circulation. According to government projections, emerging technologies in India could conceivably generate as much as $1 trillion in economic value; the wealth of data in India could be harnessed to achieve the country’s ambitions of becoming a $5 trillion dollar economy in overall terms by 2025.¹⁸

Digital Infrastructure

Over the last decade, India’s digitization efforts have been greatly accelerated by the deployment of population-scale digital infrastructure. These open protocol–based frameworks, layered one on top of another, form a digital stack. At the base are foundational elements such as digital identity markers, while specific applications (including payments, consented data sharing, and unbundled commerce) are layered on top. These complementary levels of digital infrastructure are commonly referred to as India Stack (see figure 1).¹⁹

Digital means of identification. India Stack began in 2010 with the issuance of unique identification numbers to all Indian citizens as part of the national identification program known as Aadhaar. Before the program was established, an estimated 400 million Indian citizens did not possess any form of identification.²⁰ As a result, citizens, particularly in the country’s lower socioeconomic classes, struggled to access the government funds and subsidies to which they were entitled. This problem was exacerbated by the ease with which funds could be diverted by malicious actors. All told, depending on the program, between 10 percent and 60 percent of funds earmarked for subsidies and social welfare services fell prey to leakage or misuse, according to one study.²¹

Aadhaar was meant to provide all Indian residents with a unique identifier, making it possible to more accurately deliver services to the right people. Since the identifier was digital, it could be linked to technology-based solutions that leveraged digital verification to offer services that are presenceless, paperless, and more efficient.

The widespread adoption of Aadhaar has led to improvements in digital service delivery across India. The Indian government has issued around 1.3 billion Aadhaar cards since 2016, covering nearly 96.4 percent of the country’s population.²² This has allowed the government to make large-scale wealth transfers in an efficient manner. For instance, during the coronavirus pandemic, nearly $44 billion has been disbursed to farmers and other marginalized groups using India Stack.²³ And it is estimated that the government has saved almost $30 billion as of March 2021 by eliminating duplicate beneficiaries.²⁴ The adoption of Aadhaar also exposed millions of rural Indians to digital transactions and led to an uptick in digital literacy and digital penetration across the country.

Aadhaar has led to the creation of various means of authentication, including an e-authentication process in which a service provider uses an Aadhaar number to query the Aadhaar database, which is managed by the Unique Identification Authority of India. Authority officials respond to such requests by indicating if the database contains a record that matches the Aadhaar number and the details contained in the request, thus providing an accurate means of identity verification. Aadhaar’s electronic know-your-customer service, which uses this authentication method, has already carried out around 75 billion identity verifications, in response to requests from the government and other institutions in finance, telecommunications, and other utilities.²⁵ Similarly, Aadhaar’s e-sign capability allows any Aadhaar number holder to generate a legally valid, verifiable digital signature.

As the Aadhar program and related services matured, the share of India’s population with a bank account jumped from 35 percent in 2011 to 80 percent in 2017.²⁶ The World Bank estimates that Aadhaar’s know-your-customer service brought down the costs of customer onboarding for an Indian bank from $23 to just $0.15.²⁷ Aadhaar-based customer verification provided telecommunications companies with a huge boost in terms of customer acquisition, specifically in rural markets where there was immense untapped potential. Faster, cheaper, and simpler onboarding led one company—Reliance Jio, a late entrant to the Indian telecoms market—to decide to make Aadhar the only way for new subscribers to acquire a SIM card. Jio acquired 16 million subscribers in the first month after it opened for business and 50 million in under ninety days.²⁸

Digital payments. With the penetration of mobile phone connections and bank accounts across India, policymakers needed to make bank usage cheaper and more accessible. This need prompted the design of the next layer of India Stack: UPI.²⁹ In simple terms, UPI is a payment markup language that runs on a central switch operated by the National Payments Corporation of India. Since all licensed banks are connected to the National Payments Corporation of India’s server, payment messages can be sent to and from these entities, allowing payment transactions to take place almost instantly.

UPI is itself a three-level stack. The base layer is built and operated by the National Payments Corporation of India, and it consists of the switch that handles the routing of payment messages. The next layer involves banks and other regulated financial entities that are permitted under law to hold user funds and pay and receive amounts into these accounts. The third and top layer is made up of payment apps operated by lightly regulated fintech players that create customer interfaces that allow ordinary users to access the payment ecosystem. Given the fundamental interoperability of these protocols, every participant in the payment stack can interact with every other participant using the same universal set of application programming interfaces (APIs). As a result, the Indian payment ecosystem has avoided having to laboriously establish one-to-one relationships between banks to make it possible for customers to transfer money to each other.

Another UPI innovation is its use of a virtual payment address (VPA), a unique identifier that maps a given user’s bank account to an easily memorized string of names, letters, and numbers that can be shared for the purpose of receiving payments. While this method offers the advantages of privacy and security (because knowledge of a VPA offers no information whatsoever about the associated bank details), since the VPA is ubiquitous throughout the ecosystem, the VPA is agnostic to payment apps, allowing money to be exchanged even between users on different payment apps.

In June 2022, an estimated 5.9 billion transactions, amounting to about $127 billion, were conducted using UPI, and it has been a recognized success both in India and abroad.³⁰ A wide range of internet and mobile offerings have been integrated into the UPI ecosystem, with foreign players such as Amazon, Google, Meta, and Walmart relying on it in India.³¹ Countries like the United States have also been considering adopting UPI features within their own domestic payment systems.³² UPI has emerged as a leading homegrown payment system with the potential to give India self-sufficient alternatives to reliance on global payment solutions.

Data sharing. Having built widely trusted identification and payments systems, India consequently began to generate vast amounts of transaction data. The next logical step was to use this data for empowering citizens eager to use e-commerce and e-government services, particularly those who had no other means of accessing the formal financial system.

The third layer of India Stack, called the Data Empowerment and Protection Architecture (DEPA), was designed to facilitate consented data sharing. Unlike previous layers that were predominantly technological, DEPA is, by its design, a technolegal architecture that individuals can use to exercise greater autonomy over how their personal data are used. It offers technological tools for people to invoke the rights made available to them under applicable privacy laws. Framed differently, it is a technological system that ensures that all transfers of a person’s data from one data fiduciary to another take place through an encrypted digital workflow that is only triggered after that person’s consent has been electronically obtained.

DEPA has already been rolled out in the financial services sector, and work is underway to implement it in the healthcare system. It is not hard to envision how this framework can be applied across a range of sectors such as education, telecommunications, and more. The data governance principles inherent in the technological design of the DEPA framework are examined in more detail below.

India’s Need for Data Governance

With the launch of Digital India and the India Stack, the prevalence of smartphones in rural India grew from 9 percent to 25 percent by 2018, the number of Indians who use social media jumped from 142 million in 2015 to 326 million by that same year, and between 2015 and 2018 average data usage each month increased by 129 percent (assuming a compound annual growth rate).³³ The direct impact of the aggressive digitization of the Indian economy has been the unprecedented volumes of data that have been and continue to be generated. India’s online population is expected to increase by nearly 45 percent in the next few years, growing from approximately 622 million in 2020 to 900 million in 2025.³⁴ The amount of wireless data Indian consumers use increased by leaps and bounds to reach over 30,000 petabytes in the first quarter of 2021–2022. At the same time, the average consumer went from using 1.2 gigabytes of wireless data in 2017–2018 per month to a staggering 14.1 gigabytes in 2021–2022.³⁵ Monthly data consumption is also expected to climb to up to 50 gigabytes per smartphone by 2027.³⁶

India is now digitizing faster than most other economies, creating a rapidly growing consumer base that is being targeted by both domestic and foreign companies. It goes without saying that, without an appropriate system of governance, the benefits that are being derived from all this data might not be enjoyed by all Indian citizens. India is looking to bridge the regulatory gap between burgeoning data creation and the need to regulate and leverage available data. In doing so, India has developed frameworks for both data protection and data sharing, measures that aim to further both government and private-sector use of data for socioeconomic benefits.

Legal Frameworks for Data Governance in India

While there are several types of data in circulation and various issues pertaining to the governance of each kind, this analysis exclusively deals with data types that the Indian government is actively looking to regulate, such as personal data generated from individuals and nonpersonal data, which in some cases may also be derived from personal data but also includes data with no relationship to individuals. This research does not examine how other types of data—including scientific data, commercial data, and the like—are shared, though these kinds of data are equally important to broader discourse on data governance. Indian data governance practices will primarily be analyzed in terms of data sharing between government entities, businesses, communities, and ordinary people for both public-good and business purposes.

It is also important to set out the different stakeholders in the Indian data ecosystem so as to better understand the interplay between them. The priority of the Indian government is to use digital technologies for domestic development, leveraging data for the benefit of its citizens and for their protection. The private sector, which is largely focused on commercial gain, used to view data governance as a hindrance, but in more recent times companies have come to appreciate that customers view good data governance practices positively. Finally, individual citizens and the communities that they are a part of have an interest in ensuring that they can exercise meaningful control over their data to protect themselves against potential harms.

Around the world, data governance is implemented by regulating the collection and use of personal data. In most countries, such regulations have taken the form of data protection legislation that sets out what can and cannot be done with personal data and strives to ensure that citizens have a greater say over how their data are used. In recent times, other aspects of data governance have also come into focus. The European Union’s Digital Strategy, for example, attempts to regulate digital markets in goods and services to promote greater competition while facilitating the creation of so-called data spaces within which data can be shared.³⁷ Similar efforts are underway to regulate the use of data for developing artificial intelligence systems and to mitigate the effects of such systems on personal privacy.³⁸

Though India has made considerable strides in digitizing its economy, Indian legal frameworks have not kept pace with this rapid growth. India does not yet have a comprehensive legal framework for data governance. A draft data protection law had been introduced before the parliament, but it was recently withdrawn.³⁹ It is likely that a simplified and more comprehensive version of the draft bill will be introduced, but the timeline is unclear.

Delays in establishing a comprehensive legal framework for data governance could play to India’s advantage if it can learn from the experience of other countries and use that knowledge to implement a modern framework for data governance. This could include some of the proposals being discussed in Europe as well as other novel solutions aimed at addressing these issues. India’s DEPA framework (described in more detail in the next section) is one such novel solution: this technolegal governance regime embeds data protection principles into a technology stack.

In the meantime, this section will discuss the legal frameworks that India has put in place for data governance as well as the proposals for new legal frameworks that are being considered. The subsequent section will then examine the technological frameworks that have already been implemented for data governance in India.

Data Governance in India

At present, India regulates personal data through the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which serve as a basic framework for regulating sensitive personal data.⁴⁰ These rules do not provide a comprehensive framework for data protection along the lines of most data protection laws in other jurisdictions. (They do not, for instance, regulate children’s data rights or cross-border data transfers, nor have they even established a data protection regulator.) Instead, these rules are limited primarily to the collection, possessing, storage, handling, retention, transfer, and disclosure of sensitive personal data by corporations through the introduction of a consent requirement for all such activities. The law also prescribes certain “security practices and procedures” for the handling of sensitive data.⁴¹

Although these rules came into force more than a decade ago, delays and insufficient administrative and adjudicatory mechanisms have plagued its implementation.⁴² Since 2011, there has been little or no regulating carried out under its provisions. Companies comply with its provisions but have received little or no guidance on how to handle the many ambiguities that have arisen.

Indian citizens and civil society, however, have grown increasingly aware of the harms that are inherent in the collection, generation, and processing of personal data. In 2018, a landmark Supreme Court judgment, which upheld the use of India’s Aadhaar digital identification numbers, had to address concerns around government profiling and surveillance. The Supreme Court in another judgment in 2017 had held that the right to privacy is a fundamental right that—while not specified in the Indian Constitution—is derived from the right to life and personal liberty.⁴³ These rulings focused public attention on the rights of individuals to have autonomy over what is done with their data.

India’s approach to data governance is proceeding along three different tracks. First is the regulating of personal data in ways that draw heavily on the principles set out under the EU’s General Data Protection Regulation (GDPR) as well as other international regulations on personally identifiable information. Second, India is in the process of establishing a nonpersonal data framework—a path down which no other country has yet embarked. The broad contours of this policy can be gleaned from draft reports released by a Committee of Experts known as the Gopalakrishnan Committee.⁴⁴ The third aspect of this work has to do with the governance of government data, which is covered under the National Data Sharing and Accessibility Policy.

Personal Data

While the Supreme Court was still considering the constitutionality of the Aadhaar program, the Indian government established a committee, chaired by retired justice B.N. Srikrishna, to look into the establishment of a personal data protection law for the country. The committee issued its report in 2018 along with draft legislation.⁴⁵ In December 2019, the Ministry of Electronics and Information Technology introduced in the Indian parliament a slightly revised version of the legislation called the Personal Data Protection Bill, 2019.⁴⁶ The bill was referred to a joint parliamentary committee for further consideration. After consulting with various stakeholders, the joint parliamentary committee published a December 2021 report, along with yet another draft bill.⁴⁷ The revised law was called the Data Protection Bill, 2021 (DP Bill). While the bill has now been withdrawn, its provisions signaled the government’s approach and likely policy shifts with respect to personal data. The key features of the bill are highlighted below.

The DP Bill defined personal data as information “about or relating to a natural person who is directly or indirectly identifiable” (by “natural person,” the bill meant a human being as opposed to a nonhuman juridical person such as a corporation or a government agency).⁴⁸ Such data specifically is information pertaining to a feature of identity (virtual or physical) or a combination of such features, including “inferences drawn from such data for the purpose of profiling.”⁴⁹ This definition is largely in line with those of similar laws elsewhere, like the EU’s GDPR.⁵⁰ The DP Bill also defined sensitive personal data, a separate class of data subject to enhanced compliance thresholds. Sensitive personal data include financial data, healthcare data, official identifiers (including government-issued identifiers such as social security numbers or Aadhaar numbers), information on gender identity and sexual orientation, biometric data, genetic data, caste or tribe affiliations, religious or political beliefs or affiliations, and any other category of information so designated in the future by the relevant authorities.⁵¹

As for the entities involved in data processing, the DP Bill defined a data fiduciary along similar lines as GDPR defines a data controller.⁵² The DP Bill referred to the individual whose personal data is being gathered as the “data principal,” a term equivalent to the concept of a “data subject” in GDPR.⁵³ Consent remains the primary grounds for processing personal data.⁵⁴ However, similar to other privacy legislation, the DP Bill also specified a few nonconsensual grounds for data processing.⁵⁵ In line with both the Indian government’s aim of ensuring individual autonomy over data as well as global norms, data principals have been accorded various rights with respect to their data under the control of a data fiduciary; these provisions include the rights to access, erasure, correction, and portability, as well as the right to be forgotten.⁵⁶

The DP Bill also introduced the concept of consent managers—a new category of data fiduciaries to operationalize consented data flows.⁵⁷ Data principals were meant to provide consent through these consent managers to share information with various data fiduciaries.⁵⁸ This construct would support the DEPA framework, as discussed in the third section.

The DP Bill aimed to create a Data Protection Authority to govern implementation and enforcement of the law. In theory, the Data Protection Authority could designate certain entities as “significant data fiduciaries.”⁵⁹ Such determinations were to be made based on criteria like how much personal data has been processed, how sensitive it is, the scale of the fiduciary’s annual turnover, the “risk of harm” from data processing, the employment of new technologies, or whether the entity processes children’s data or provides services to minors.⁶⁰ Social media platforms that have more than a specified number of users or ones whose actions “are likely to have a significant impact on electoral democracy, state security, public order, or India’s sovereignty” also may have been designated as significant.⁶¹ Significant data fiduciaries would have been subject to greater compliance obligations including the need to undertake mandatory data protection impact assessments as well as record keeping and audit requirements.⁶² They also must appoint a data protection officer.⁶³ India is among the first nations to press heightened obligations on a certain class of data fiduciaries, with parallels only now appearing in regulations such as the EU’s Data Governance Act.⁶⁴

The DP Bill deviated from other countries’ data protection legislation in certain key aspects. Prominent among these is the fact that, under the DP Bill, a child was defined as a data principal under eighteen years of age.⁶⁵ This is a higher age cutoff than has been prescribed in most other jurisdictions.⁶⁶ Data fiduciaries have an obligation to confirm the age of minors and to get parents’ consent to process their data.⁶⁷

The DP Bill did not subject personal data to any transfer restrictions. Its terms “allow transfer of sensitive personal data, for the purpose of processing and with the explicit consent of the data principal, to any countries with certain safeguards.”⁶⁸ The DP Bill also empowered the central government to designate certain types of personal data as “critical personal data,” which could only be processed in India and could only be transferred outside the country for limited purposes.⁶⁹ What constitutes critical personal data still remains undefined.

The DP Bill also allowed for compensation to be paid to data principals for harm caused to them by a data fiduciary because of a violation of the bill’s provisions.⁷⁰ The definition of harm under the DP Bill was very broad and extended to all types of evaluative decisions regardless of human involvement.⁷¹ Notably, the concept of harm is defined more specifically in data governance laws in other jurisdictions such as the EU’s GDPR and the draft of the United Kingdom’s Online Safety Bill. The definition of “content that is harmful” in the draft UK bill is very specific regarding the parameters within which harm must be assessed. The law provides definitions and further context on the scope of what harm means and key definitions, including terms such as “reasonable grounds” and “material risk,” as well as factors to take into account when making such an assessment.⁷²

Once India passes a data protection law, there will likely be a transition period during which data fiduciaries will have to prepare themselves for the new regulatory regime. This is also when the Data Protection Authority will be established and tasked with setting up the administrative framework for implementing the new law. This task would include issuing codes of practice establishing, through subordinate legislation, many of the substantive and procedural details required to bring the law into force.

Several provisions of the DP Bill prompted a strong response from governments and businesses around the world. The U.S. government, for instance, sees the Indian government’s push for data localization as a significant barrier to digital trade between the two countries.⁷³ U.S. officials have suggested that the requirement would result in increased costs for businesses that presently store and process data outside India and in particular would act as a market access barrier for small foreign firms.⁷⁴

Industry bodies such as the U.S.-India Business Council, the U.S.-India Strategic Partnership Forum, the Information Technology Industry Council, BusinessEurope, and the Japan Electronics and Information Technology Industries Association, as well as major technology players that provide services in India such as Microsoft, Apple, Amazon, Google, and Dell have raised concerns (in addition to the localization issue) about provisions such as the inclusion of nonpersonal data in the bill and mandatory hardware certifications.⁷⁵ They argue that such provisions are not in line with global best practices for data protection and that such stipulations would create disincentives for innovation in India by reducing operational efficacies and lessening the ease of doing business.

Nonpersonal Data

Various public and private entities have also accumulated vast, proprietary sets of nonpersonal data that they can leverage to their competitive advantage. If such nonpersonal data could be liberated from the exclusive control of their current holders, it is believed that this information could be redeployed for the public good.

The need to regulate nonpersonal data was first expressed in the report by the Srikrishna Committee on personal data protection. The early draft of the law also referred, albeit by exclusion, to the concept of nonpersonal data. In the fall of 2019, the Ministry of Electronics and Information Technology convened the Gopalakrishnan Committee to brainstorm how India should govern nonpersonal data. The committee was tasked with studying various issues related to nonpersonal data and making specific recommendations on how the central government should regulate nonpersonal data.

The latest draft of the committee’s report was released for public consultation in November 2020.⁷⁶ While the committee’s final findings are not yet public, the latest draft report suggests that the governance framework for nonpersonal data in India will cover the following ground.

The Gopalakrishnan Committee defined nonpersonal data as data that never related to an individual (such as weather conditions or data generated from public infrastructure, to cite a few examples) and information that was once personal data and subsequently was anonymized in such a way that it cannot be used to identify an individual (such as anonymized healthcare records of patients). Nonpersonal data only refers to these two categories of data. The committee’s report classified entities (whether government bodies or private organizations) that collect, process, store, or manage data as data businesses. These entities hold nonpersonal data that the proposed governance framework seeks to unlock for public benefit.

The report also gave communities rights over data that are relevant to them. A community is defined in the report as any group of persons bound by common social or economic ties, territorial parameters, or another interest or purpose. The Gopalakrishnan Committee expressed the belief that communities should be allowed to benefit from data that pertains to them and allowed to protect themselves from any harms that could arise when data businesses process their data.

The Gopalakrishnan Committee recommended the establishment of a separate Nonpersonal Data Authority. This authority would be required to work closely with the Data Protection Authority that the DP Bill sought to establish. While this suggestion indicates that the Gopalakrishnan Committee supports a framework for the regulation of nonpersonal data that “is separate and distinct from [that for] personal data,” the DP Bill appeared to also regulate nonpersonal data.⁷⁷ Two provisions in the DP Bill mentioned nonpersonal data: clauses on breaches involving nonpersonal data and those on the obligation of data fiduciaries to provide the central government with nonpersonal data for the “targeted delivery of services” or “evidence-based policy making.”⁷⁸

To protect the rights of communities in relation to their nonpersonal data, the Gopalakrishnan Committee recommended the creation of data trustees (either government entities or private nonprofit organizations) for this purpose. After all, “data trustees have a duty of care” to ensure that nonpersonal data are used only in the interests of these communities.⁷⁹ To effectively protect communities’ data rights and ensure public benefits are derived from nonpersonal data, the report recommended that data trustees become the repositories for high-value data sets created from community data.

One of the report’s core recommendations was the creation of high-value data sets. All data businesses will be required to submit metadata pertaining to all the nonpersonal data under their control. This metadata will be stored in a single metadata directory and managed by the Nonpersonal Data Authority. The directory will be made available for anyone to access, allowing data trustees to identify opportunities in which such data could be used for public good. Data trustees will have the right to request access to relevant data subsets to create a high-value data set. The relevant data business must provide such data by a specified date.

Crucially, high-value data sets could only be created with the approval of the Nonpersonal Data Authority, a body set up for the supervision of nonpersonal data sharing. The authority would approve applications based on their projected impact on the public interest, the data trustee’s capacity to undertake its obligations, adequate buy-in from the relevant community, and public consultation. This purpose-driven approach to data sharing focuses heavily on the manner in which nonpersonal data can be used and predicates data sharing on the basis of advancing the public good. The report clarified what constitutes a high-value data set that serves the public good, with examples of such purposes including research and education, healthcare, agriculture, and poverty alleviation, to name a few. Parallels may be drawn with the United States’ Demand-Driven Open Data model, which regulates data-sharing requests based on specific use cases.⁸⁰ This demonstrates the government’s intent to create a framework that focuses not only on protection from harm but also on the societal benefits that can arise from the sharing of nonpersonal data in a regulated ecosystem.

As for data that was once personal but has since been anonymized, the report recognized the rights of the original data principals. The report recommended that, when the personal data are collected, data principals decide whether to provide consent for a data business to anonymize their data. Such consent should also be revocable.

With regard to nonpersonal data that is derived from personal data, the report suggested that such data would “inherit the sensitivity of the underlying personal data” for the purposes of complying with localization requirements.⁸¹ For example, based on the DP Bill, a copy of nonpersonal data derived from sensitive personal data has to be kept in India.⁸²

India’s nonpersonal data governance framework is novel. While the principles enshrined in the DP Bill protected personal data from misuse by data fiduciaries, the framework for nonpersonal data was designed to free up data that is not personally identifiable so that it can be used for the sake of wider societal benefits. Whereas on the one hand the data protection framework would lock down data that ought to be kept private, the nonpersonal data framework would unlock data that can be used for public good from the confines of the data silos in which they are stored.

Concerns have been raised about the imposition of mandatory data sharing. At the same time, businesses have questioned whether such a regime would be able to address skewed market powers favoring large technology companies who hold vast amounts of nonpersonal data.⁸³ Some have argued that data-sharing requirements of this kind have the potential to obstruct innovation, thereby hampering India’s digital growth.

Government Data

Even though nonpersonal data held in government hands is expressly accounted for in the proposals of the Gopalakrishnan Committee, the Indian government has separately created a policy to deal with the sharing of such data for the public good. The National Data Sharing and Access Policy makes disparate government data assets available for the public to access.⁸⁴

The policy applies to all nonpersonal and nonsensitive data generated using public funds across all levels and departments of the government and its authorized agencies. The data that must be provided under this policy include all digital, analogue, machine- and human-readable formats, and suitable payment structures have also been set up to incentivize data sharing. The government has taken a technolegal approach to this task by developing the Open Government Data Platform on which data shared under the National Data Sharing and Access Policy are made publicly available.

Since the launch of the Open Government Data Platform in 2012, several other open data platforms have been launched. As Sam Neufeld has pointed out, examples include the India Urban Data Exchange of the Ministry of Housing and Urban Affairs (an open-source data exchange for citywide data among various stakeholders), Open Budgets India created by the Centre for Budget and Governance Accountability (which includes data on central and state budgetary allocations and spending), and the proposed National Data and Analytics Platform by NITI Aayog, a platform that aims to improve the user experience on data retrieval by standardizing data across government sources for improved research, innovation, and public consumption.⁸⁵

While the Open Government Data Platform offers more information and data to users, as well as functionalities for social media, data visualization, and data suggestion, there are many opportunities to strengthen its utility. For instance, standardizing data-sharing and release processes, anonymization and deidentification processes, metadata quality, licensing structures, and the pricing and valuation criteria for data sets will encourage more data-sharing efforts by Indian government departments.

To this end, the Indian government has introduced a revised draft of the India Data Accessibility and Use Policy and a draft of the National Data Governance Framework Policy,⁸⁶ which aim to build upon the National Data Sharing and Access Policy and increase access to government data by leveraging emerging technologies. The draft of the National Data Governance Framework Policy focuses on the sharing of nonpersonal data collected by the government from Indian citizens and residents through the India Datasets Program. This policy introduces a new framework for the governance of citizens’ data that will include the creation of the Indian Data Management Office to establish a large repository of Indian data sets and set standards for storing and collecting such data sets.

The Indian Data Management Office expects private entities to contribute to the data sets as a part of this program. This office will be responsible for ensuring that data principals retain ownership over all such data. Any requests by third parties for nonpersonal or anonymized data sets will be vetted by the Indian Data Management Office before the data are dispersed. The office can receive and vet requests for these data sets from researchers, startups, and private companies, and it has the ability to limit the number and range of data requests from an entity. These policies are in the drafting stage and are awaiting public comments.

Technological Frameworks for Data Governance in India

The last section discussed the legal frameworks that are being developed in India for data governance. These frameworks are already novel in that they not only look to regulate the processing of personal data but also seek to unlock nonpersonal data from isolated silos to advance the public good. However, the Indian approach to data governance has one additional nuance—namely, DEPA. This is a technolegal framework for consented data sharing between data fiduciaries, as articulated in the DP Bill.⁸⁷ The framework would embed legal principles in technological infrastructure developed for the DEPA, offering novel solutions to data regulation challenges that have vexed countries around the world.

What Is DEPA?

Even though privacy laws recognize the rights that data principals have over their data, they often lack a means for principals to exercise meaningful control over their personal data. For instance, citizens trying to use financial products and services that require evidence of creditworthiness often suffer if they are unable to effectively access their own data. The process often involves physically gathering one’s own data from financial institutions, a cumbersome task that involves physical printouts, notarization, and manual submission. Digital mechanisms to implement data portability are hamstrung by the existence of multiple differing data storage formats and a fundamental lack of standardization across the ecosystem.

To address this, India is seeking to implement DEPA, a technolegal solution that uses an electronic, consent-based framework to put data principals at the center of data sharing in certain sectors, including finance and healthcare. DEPA gives individuals greater agency over how their personal data are transferred, helping them use data in ways that will ultimately empower them. Central to the privacy-enhancing nature of the framework is its use of institutional intermediaries to facilitate consent (called consent managers). This makes it possible to disaggregate the consent flows from the data flows: data providers are primarily responsible for data and consent managers are primarily responsible for consent. This arrangement enables a double-blind data-sharing environment that maximally protects the private information of data principals.

In figure 2 below, entities requesting access to data (known as data users) have been arrayed on the right while the entities that have the data that the data users require (data providers) have been arrayed on the left. In the middle is the consent manager, and right on top is the data principal.

This model has been fully implemented in India’s financial sector under the Reserve Bank of India’s Nonbanking Financial Company Account Aggregator Directions, 2016.⁸⁸ It implements consented data sharing between different parties in the financial ecosystem including banks, insurance companies, pension funds, and all entities regulated by the country’s securities regulator. Specific financial entities have been permitted to register as account aggregators, which play the role of consent managers and oversee financial data flows between service providers in the sector.

First, any data principal who wishes to transfer their financial data between various fiduciaries so as to use various financial services must first enroll with an account aggregator (or consent manager). At this stage, the data principal provides the consent manager with a list of all the financial service providers (that is to say, data providers—including insurers, banks, brokers, credit rating agencies, and others) with whom the person has an account. The consent manager then creates links to all these data providers; this way, when a data transfer request is received, it has an approved list of data providers from which data can be requested. At no stage does the consent manager have any visibility into the contents of these accounts or into any of the personal or financial data of the data principal. After this initial preparatory work, the data principal is ready to approve financial data transfers using the DEPA infrastructure.

To initiate a data transfer, financial institutions that require customer data to provide services can direct such a request (step 1) to the consent manager. The request is made using a digital consent artefact, a “machine-readable document” that records the details and specifications of consent provided alongside a data-sharing request.⁸⁹ A digital consent artefact requires the data user to provide details on the information sought, the purpose for the request, the duration for which the information will be retained, and the financial institution seeking this information. The consent manager then sends this request to the data principal (step 2) and, if the data principal consents to the data transfer (step 3), sends the digitally signed request for data to the data provider (step 4). Having verified that the data transfer request was approved by the data principal, the data provider then transfers the required financial data in accordance with the request. The data are encrypted and transferred from the data provider to the data user through the consent manager (step 5).

As of August 2022, six nonbanking financial companies have been given a license to operate as authorized aggregators, and five of them have launched client-facing mobile applications.⁹⁰ At this time, the authorized aggregator ecosystem has successfully fulfilled more than 1 million consent requests.⁹¹

Privacy by Design

Many data protection laws around the world are broadly aligned around a common set of what are known as privacy by design principles.⁹² DEPA implements a technological framework that supports and complements each of these privacy principles.

Notice and consent. Encoded in the electronic consent requests are all the notice requirements that most international privacy laws require. Consent is specifically collected for each data transfer request. In this way, DEPA offers data principals the opportunity to provide more meaningful consent than is otherwise possible.

Purpose limitation. Data users are required to specify how they intend to use the data before it is collected and used. DEPA enables more effective purpose limitation since the data principal is notified of each data transfer request.

Data minimization. DEPA allows the purpose to be narrowly defined since it must be stated proximate to the time of the data transfer request.

Retention limitation. Each data transfer request under DEPA includes how long the personal data will be kept. Since the data are transferred only for as long as it is needed for processing and after that must either be transferred back or destroyed, data users are not permitted to retain such data any longer than specified.

Data integrity and confidentiality. Since all data transfers under DEPA are encrypted end-to-end, data confidentiality is built into the system’s design. DEPA was designed with privacy at its core. Consent managers are, as a matter of design, data blind and have no visibility into the contents of encrypted data packages. Since data requests are not made directly from data users to data providers, data principals’ privacy is protected vis-à-vis data users. Since consent managers are data blind, data principals’ privacy is also protected vis-à-vis consent managers.

The Digital Consent Artefact

Consent is processed using the digital consent artefact. The electronic consent artefact used by DEPA implements the so-called ORGANS principles: open, revocable, granular, auditable, notice, and secure (see below).

• Open: the consent standard is designed to operate as an open standard ensuring that all institutions have the same interoperable approach to consent;
• Revocable: the consent is designed to be revocable at any point in time by the data principal who provided it;
• Granular: consent needs to be provided in each instance and must specify what data has been requested, how long it will be retained, and who will process it;
• Auditable: records of all consents provided by a data principal can be retained in machine-readable logs;
• Notice: data principals will be provided notice of how their data will be used, the parties that will process it, and the duration for which it will be retained; and
• Secure: the digital consent artefact is secure by design.

When a data transfer request is made, verification by the consent manager happens only against the details contained in the consent artefact, and data users must store the data according to the consent artefact’s specifications.

When DEPA’s digital consent workflow is combined with the right to data portability provided to data principals under the DP Bill (or a similar piece of legislation) and applied to the healthcare and finance sectors, this development will help formalize the DEPA framework within and across all these sectors.

For instance, a core component of India’s healthcare digitization mission is the creation of digitized healthcare records that citizens can easily access and transfer to different service providers in the healthcare ecosystem, per their requirements. Citizens may need to transfer healthcare records from a hospital or clinic to their health insurance provider to file an insurance claim. Rather than reproducing their healthcare records or status, they can use DEPA to transfer their health records from the hospital (data provider) to the insurer (data user) through a data intermediary designed specifically for the healthcare sector (consent manager) to oversee the transfer of this sensitive medical data. This arrangement would go a long way toward facilitating constructive public health outcomes. The DEPA framework is being used for this purpose, ensuring the privacy and authenticity of healthcare data transfers.⁹³

Another technolegal framework for data sharing is the Open Government Data Platform. The platform hosts all government data published under the National Data Sharing and Access Policy and enables public access to and the downloading of such data. Developed using open source stack, the platform contains multiple modules and APIs, including a module for data management that hosts data catalogues by various government agencies and a module for visitor relationship management, which collates and disseminates viewer feedback on various data catalogues.

Several state governments have launched their own open data portals using the Open Government Data Platform’s software as a service model, including the Open Government Data Portal by the state government of Sikkim and a portal by the Surat Municipal Corporation.⁹⁴ India’s Open Government Data Platform is also packaged as a product and has been “made available in open source” for countries around the globe to implement.⁹⁵

India’s Approach to Data Governance

India’s data governance regime has been shaped by the country’s historical development, the value evident from increased data generation, civil society activism, and digital innovation outside of the country. While India’s efforts at developing a data governance regime have been influenced by global regulations such as GDPR and the Asia-Pacific Economic Cooperation’s Privacy Framework, the Indian government is, at the same time, looking to chart its own path in certain respects.⁹⁶

The passage of a new personal data protection law has assumed paramount importance. However, the protections proposed in the law additionally focus on improving data accessibility and availability, in contrast to GDPR, which is first and foremost about protecting individual privacy rights. These Indian policy frameworks on personal and nonpersonal data indicate that, while data protection is essential, data sharing and data empowerment are the most important drivers of India’s strategy on data governance.⁹⁷

The Indian approach is also distinct from other global models due to the tools and mechanisms that support the proposed regulatory framework. The development of unique digital infrastructure projects such as the India Stack provides policymakers with the resources to implement unique citizen-centric solutions, while also offering important lessons to other nations.

The Technolegal Approach

A central feature of India’s data governance approach is its use of homegrown technolegal mechanisms. These regulatory frameworks and technical systems are used to implement policy objectives through technology design. India views frameworks like DEPA as necessary for data empowerment. Indian officials have even gone so far as to compare DEPA’s design to the development of Transmission Control Protocol/Internet Protocol for online communication and GPS for navigation.⁹⁸ This approach is similar to that described by the U.S. legal scholar Lawrence Lessig, who has suggested that software and systems often can shape behavior and the adoption of technology at least as effectively as regulations.⁹⁹

Technolegal solutions such as DEPA, the Nonpersonal Data Framework, and the Open Government Platform make it possible to develop markets for data transactions, creating interoperable grids for seamless data sharing. The role of technology in these mechanisms is clear. Entities that act as intermediaries in such ecosystems (the consent managers within DEPA and data trustees for nonpersonal data) should ideally be entities with considerable technology-related organizational capacity.¹⁰⁰

India’s Push for Data Sovereignty

The development of these frameworks has been driven, in part, by the objectives of India’s digital policies. The Indian government is working to ensure that Indian data are domestically controlled and leveraged so that Indian citizens’ data serve national interests before those of foreign players.¹⁰¹ The government, supported by Indian industries, has moved to promote the domestic use of data while guarding against the threat of data imperialism (or data colonialism) by foreign technology companies.

This focus on data sovereignty stems from multiple policy goals. Given India’s increasing focus on the value of data as a tool for economic growth, there has been a push to retain data in the country so that such information can be used by domestic players. Similarly, there have been efforts to more aggressively regulate the activities of foreign technology players who have access to Indian data. Concerns that foreign tech giants have too much control over India’s technology landscape have led to further concerns about the misuse of and lack of access to Indian data that are stored overseas. In addition, concerns have proliferated about how market dominance leads to imbalances in bargaining power between foreign tech giants on the one hand and Indian citizens, businesses, and the government on the other.¹⁰²

This thinking is evident in recent measures on data governance that the Indian government has introduced, the most significant of which is a cross-governmental push for data localization. Through sector-specific regulations in the banking, insurance, and telecom sectors; the DP Bill; and the nonpersonal data framework, the Indian government has made it clear that certain types of data will have to be stored within the country to enable domestic access. The primary policy goals in support of these measures are the need to overcome barriers faced by law enforcement personnel who struggle to access Indian data stored in other jurisdictions and the importance of ensuring the accessibility of Indian data to domestic players so that the relevant economic and social benefits can be tapped into.¹⁰³

The nonpersonal data framework explicitly calls out this principle of data sovereignty, recognizing it as a key to unlocking economic benefits from nonpersonal data for India and its citizens, communities, and organizations. Other policy documents “reconceptualize the notion of community data as ‘societal commons’ or a ‘national resource,’ where the undefined ‘community’ has rights to access data but the government” retains ultimate control over the use of such data to advance the public welfare.¹⁰⁴ The requirement for mandatory data sharing under the proposed nonpersonal data framework is also indicative of the government’s push to democratize the use of data and to disrupt the monopolization of data in the hands of a few companies.

That said, questions have been raised as to whether India’s decision to exert its right to data sovereignty by extending its data governance framework to also cover nonpersonal data is going too far. Nonpersonal data covers a broad swathe of information that would otherwise have been left untouched, potentially affecting the rights of commercial enterprises to their trade secrets and confidential business practices. There is also the question of how exactly nonpersonal data will be distinguished from personal data given the numerous examples of how, even after it has been anonymized, personal information has been reidentified.¹⁰⁵ The still-awaited final report of the Gopalakrishnan Committee might hold answers to these questions.

India’s Approach in a Global Context

India’s approach to data governance should also be viewed within a larger global context. Many nations are starting to weigh in on the question of regulating cross-border data flows. Japan has advocated for the free flow of data across borders, a position formalized in its leadership on the Osaka Declaration on Digital Economy in 2019.¹⁰⁶ The United States has adopted a laissez-faire approach that supports the unrestricted flow of data across borders. The United States does not have all-purpose federal legislation on data protection for either personal or nonpersonal data. In contrast, Europe has codified data governance through various directives and acts of legislation, which individual countries have implemented.¹⁰⁷ Europeans have taken a human rights–based approach to data sharing by permitting cross-border sharing under specific circumstances to countries that meet the EU’s requirements.

China has a radically different approach to data governance. Its cyber sovereignty approach involves the use of advanced technologies for the aggressive enforcement of sovereignty, data localization requirements, and strict monitoring of domestic data.¹⁰⁸ This approach has been adopted to varying degrees by other nations such as Russia and Egypt.¹⁰⁹

In contrast, India declined to sign the Osaka Declaration promoted by Japan at the 2019 Group of 20 (G20) summit out of concerns that the negotiations conflicted with its policy priority for data localization.¹¹⁰ This has made it clear that economic, national security, and developmental ramifications can no longer be separated from domestic or international data governance efforts.¹¹¹

There are lessons to be learned from the data colonization of African nations that suffered from the absence of robust data protection policies. Indigenous technology development on the African continent is heavily influenced by large technology giants from the United States and China.¹¹² Several African nations, such as Nigeria and Rwanda, are now considering localization regulations of their own to counteract these effects.¹¹³

India is charting a new path for data governance. Given the size of the country’s population (a significant share of which has yet to come online), its growing technological prowess, and its novel governance solutions, India can play a decisive role in shaping global data governance.

Notes

¹ Arvind Gupta and Philip E. Auerswald, “The Ups and Downs of India’s Digital Transformation,” Harvard Business Review, May 2019, https://hbr.org/2019/05/the-ups-and-downs-of-indias-digital-transformation.

² Telecom Regulatory Authority of India, “Consultation Paper on Regulatory Framework for Promoting Data Economy Through Establishment of Data Centres, Content Delivery Networks, and Interconnect Exchanges in India,” Telecom Regulatory Authority of India, Consultation Paper No.10/2021, https://www.trai.gov.in/sites/default/files/CP_16122021_0.pdf. The report states that—based on “the cost of manpower, real estate, and bandwidth”—data storage in India is “at least 60 percent cheaper” than in the United States or Singapore.

³ In 1985, the IT industry exported software and services worth $25 million. See Devesh Kapur, “Causes and Consequences of India’s IT Boom,” University of Pennsylvania India Review 1, no. 2 (April 2022), https://casi.sas.upenn.edu/sites/default/files/bio/uploads/Causes_and_Consequences_of_IT_Boom.pdf.

⁴ Ibid.

⁵ United States International Trade Administration, “India - Country Commercial Guide,” United States International Trade Administration, October 22, 2021, https://web.archive.org/web/20220727072457/https://www.trade.gov/country-commercial-guides/india-information-and-communication-technology.

⁶ Kapur, “Causes and Consequences of India’s IT Boom.”

⁷ Ibid.

⁸ Deloitte, “Technology, Media, and Telecommunications - Predictions 2022,” Deloitte, February 2022, https://www2.deloitte.com/in/en/pages/technology-media-and-telecommunications/articles/tmt-predictions-2022.html; and World Bank, “Population, Total - India,” World Bank, 2021, https://data.worldbank.org/indicator/SP.POP.TOTL?locations=IN.

⁹ National Payments Corporation of India, “UPI Product Statistics,” National Payments Corporation of India, https://www.npci.org.in/what-we-do/upi/product-statistics.

¹⁰ This can be seen in the use of the Data Empowerment and Protection Architecture in the Reserve Bank of India’s Account Aggregator Framework. See Reserve Bank of India, “Master Direction - Non-Banking Financial Company - Account Aggregator (Reserve Bank) Direction, 2016,” Reserve Bank of India, October 5, 2021, https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=10598.

¹¹ NITI Aayog, “National Health Stack: Strategy and Approach,” NITI Aayog, July 2018, https://web.archive.org/web/20220215102833/https://abdm.gov.in/publications/NHS_Strategy_and_Approach; and NITI Aayog, “Data Empowerment and Protection Architecture,” August 2020, https://www.niti.gov.in/sites/default/files/2020-09/DEPA-Book.pdf.

¹² Indian Ministry of Commerce and Industry, “ONDC Project,” Indian Ministry of Commerce and Industry, April 2022, https://pib.gov.in/Pressreleaseshare.aspx?PRID=1814143.

¹³ Kapur, “Causes and Consequences of India’s IT Boom.”

¹⁴ Ibid.

¹⁵ India Code, “Information Technology Act, 2000,” India Code, https://web.archive.org/web/20220303025038/https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf.

¹⁶ Digital India, “About Digital India,” Digital India, https://www.digitalindia.gov.in.

¹⁷ Digital India, “Bharat Broadband Network (BBN),” Digital India, https://digitalindia.gov.in/content/bharat-broadband-network-bbnl; Digital India, “Universal Access to Mobile Connectivity,” Digital India, https://digitalindia.gov.in/content/universal-access-mobile-connectivity; and Indian Ministry of Housing and Urban Affairs, “Smart Cities: Vision,” Indian Ministry of Housing and Urban Affairs, https://smartcities.gov.in/#:~:text=Vision,that%20leads%20to%20Smart%20outcomes.

¹⁸ Indian Ministry of Electronics and Information Technology, “India’s Trillion-Dollar Digital Opportunity,” Indian Ministry of Electronics and Information Technology, https://www.meity.gov.in/writereaddata/files/india_trillion-dollar_digital_opportunity.pdf; and Indian Ministry of Commerce and Industry, “Vision of a USD 5 Trillion Indian Economy,” Indian Ministry of Commerce and Industry, October 11, 2018, https://pib.gov.in/Pressreleaseshare.aspx?PRID=1549454.

¹⁹ Tanuj Bhojwani, “The Best Way Forward for Privacy Is to Open Up Your Data,” iSPIRT, August 21, 2017, https://pn.ispirt.in/the-best-way-forward-for-privacy-is-to-open-up-user-data; and India Stack, “India Stack,” India Stack, https://indiastack.org.

²⁰ Nandan Nilekani, “India’s Aadhaar System: Bringing E-Government to Life,” Chandler Institute of Governance, Governance Matters Magazine, 2021, https://www.chandlerinstitute.org/governancematters/indias-aadhaar-system-bringing-e-government-to-life.

²¹ Ibid.

²² Unique Identification Authority of India, “Aadhaar Dashboard,” Unique Identification Authority of India, https://uidai.gov.in/aadhaar_dashboard; and World Bank, “Population, Total – India.”

²³ Deepa Krishnan, “What the World Can Learn From the India Stack,” Strategy and Business, December 6, 2021,

https://www.strategy-business.com/article/What-the-world-can-learn-from-the-India-Stack; and National Portal of India, “Pradhan Mantri Garib Kalyan Yojana / Package,” National Portal of India, September 7, 2020, https://www.india.gov.in/spotlight/pradhan-mantri-garib-kalyan-package-pmgkp.

²⁴ Direct Benefit Transfer (DBT) Bharat, “Estimated Benefits/Gains From DBT and Other Governance Reforms,” DBT Bharat, https://www.dbtbharat.gov.in/estimatedgain.

²⁵ Unique Identification Authority of India, “Aadhaar Dashboard.”

²⁶ World Bank, “Global Findex Database 2021: Financial Inclusion, Digital Payments, and Resilience in the Age of COVID-19,” World Bank, 2021, https://www.worldbank.org/en/publication/globalfindex.

²⁷ World Bank, “Private Sector Economic Impacts From Identification Systems,” World Bank, 2018, https://documents1.worldbank.org/curated/en/219201522848336907/pdf/Private-Sector-Economic-Impacts-from-Identification-Systems.pdf.

²⁸ “Reliance Jio 4G Claims It Crossed 16 Million Subscribers in First Month,” Indian Express, October 10, 2016, https://indianexpress.com/article/technology/tech-news-technology/reliance-jio-creates-world-record-16-million-subscribers-in-one-month-3073468; and “Reliance Jio Crosses 50 Million Subscriber Mark in 83 Days,” Indian Express, https://indianexpress.com/article/technology/tech-news-technology/reliance-jio-crosses-50-million-subscriber-mark-in-83-days-4400972.

²⁹ National Payments Corporation of India, “Product Overview: Unified Payments Interface,” National Payments Corporation of India, https://www.npci.org.in/what-we-do/upi/product-overview.

³⁰ National Payments Corporation of India, “UPI Product Statistics.”

³¹ See PhonePe, “PhonePe,” PhonePe, https://www.phonepe.com; Google, “Google Payments,” Google, https://pay.google.com/payments/u/0/home; WhatsApp, “WhatsApp Payments,” WhatsApp, https://www.whatsapp.com/payments/in; and Amazon, “Unified Payment Interface (UPI) - FAQs,” Amazon, https://www.amazon.in/gp/help/customer/display.html?nodeId=202212990.

³² See this letter from Google to the U.S. Federal Reserve. Mark Isakowitz, “Re: Federal Reserve Actions to Support Interbank Settlement of Faster Payments, Docket No. OP 1670,” Google, November 7, 2019, https://www.federalreserve.gov/SECRS/2019/December/20191227/OP-1670/OP-1670_110719_136981_396266957468_1.pdf.

³³ India Cellular and Electronics Association, “Contribution of Smartphones to Digital Governance in India,” India Cellular and Electronics Association, July 2020, https://web.archive.org/web/20220209070433/https://icea.org.in/wp-content/uploads/2020/07/Contribution-of-Smartphones-to-Digital-Governance-in-India-09072020.pdf; “India to Have 820 Million Smartphone Users by 2022,” Economic Times, July 9, 2020, https://economictimes.indiatimes.com/industry/telecom/telecom-news/indian-to-have-820-million-smartphone-users-by-2022/articleshow/76876369.cms?from=mdr.

³⁴ Kantar, “Internet Adoption in India: ICUBE 2020,” Kantar, June 2021, https://images.assettype.com/afaqs/2021-06/b9a3220f-ae2f-43db-a0b4-36a372b243c4/KANTAR_ICUBE_2020_Report_C1.pdf.

³⁵ Indian Ministry of Finance, “Economic Survey 2021–22,” Indian Ministry of Finance, 302, https://www.indiabudget.gov.in/economicsurvey.

³⁶ Ericsson, “Mobile Data Traffic Outlook,” Ericsson, https://www.ericsson.com/en/reports-and-papers/mobility-report/dataforecasts/mobile-traffic-forecast.

³⁷ European Commission, “European Commission Data Strategy: Next-Generation Digital Commission,” European Commission, https://ec.europa.eu/info/sites/default/files/strategy/decision-making_process/documents/c_2022_4388_1_en_act.pdf.

³⁸ European Commission, “A European Approach to Artificial Intelligence,” European Commission, June 30, 2022, https://digital-strategy.ec.europa.eu/en/policies/european-approach-artificial-intelligence.

³⁹ Soumyarendra Barik, “Explained: Why the Govt Has Withdrawn the Personal Data Protection Bill, and What Happens Now,” Indian Express, August 6, 2022, https://indianexpress.com/article/explained/explained-sci-tech/personal-data-protection-bill-withdrawal-reason-impact-explained-8070495/lite.

⁴⁰ Indian Ministry of Communications and Information Technology, “Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011,” Indian Ministry of Communications and Information Technology, April 11, 2011, https://www.meity.gov.in/writereaddata/files/GSR313E_10511%281%29_0.pdf.

⁴¹ Indian Ministry of Electronics and Information Technology, “White Paper of the Committee of Experts on a Data Protection Framework for India,” Indian Ministry of Electronics and Information Technology, https://web.archive.org/web/20220331220953/https:/www.meity.gov.in/writereaddata/files/white_paper_on_data_protection_in_india_171127_final_v2.pdf.

⁴² Sreenidhi Srinivasan and Namrata Mukherjee, “Building an Effective Data Protection Regime,” Vidhi Centre for Legal Policy, 2017, https://www.scribd.com/document/338204284/Building-an-effective-data-protection-regime-in-India.

⁴³ Supreme Court of India, “Justice K.S. Puttaswamy (Retd.) and Another Petitioner(s) Versus Union of India and Others Respondent(s),” Supreme Court of India, Judgement, September 26, 2018, https://uidai.gov.in/images/news/Judgement_26-Sep-2018.pdf; and Supreme Court of India, “Justice K.S. Puttaswamy (Retd.) and Anr. Versus Union of India and Ors.,” Supreme Court of India Writ Petition (Civil) No. 494 of 2012, August 24, 2017, https://main.sci.gov.in/supremecourt/2012/35071/35071_2012_Judgement_24-Aug-2017.pdf.

⁴⁴ Indian Ministry of Electronics and Information Technology, “Report by the Committee of Experts on Non-Personal Data Governance Framework,” Indian Ministry of Electronics and Information Technology, December 16, 2020, mygov_160922880751553221.pdf.

⁴⁵ Indian Ministry of Electronics and Information Technology, “White Paper of the Committee of Experts on a Data Protection Framework for India”; and Indian Ministry of Electronics and Information Technology, “Personal Data Protection Bill, 2018,” Indian Ministry of Electronics and Information Technology, https://web.archive.org/web/20220202023216/https://www.meity.gov.in/writereaddata/files/Personal_Data_Protection_Bill,2018.pdf.

⁴⁶ Parliament of India, Lok Sabha, “Personal Data Protection Bill, 2019,” Lok Sabha, http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf.

⁴⁷ Parliament of India, Lok Sabha, “Report of the Joint Committee on Personal Data Protection Bill, 2019,” Seventeenth Lok Sabha, December 2021, http://164.100.47.193/lsscommittee/Joint%20Committee%20on%20the%20Personal%20Data%20Protection%20Bill,%202019/17_Joint_Committee_on_the_Personal_Data_Protection_Bill_2019_1.pdf.

⁴⁸ PRS Legislative Research, “Annual Policy Review 2021–2022,” PRS Legislative Research, May 2022, https://prsindia.org/files/policy/policy_annual_policy_review/Annual%20Policy%20Review/2022-05-10/APR_2021-22.pdf.

⁴⁹ DP Bill Section 3(33); and Lok Sabha, “Report of the Joint Committee on Personal Data Protection Bill, 2019.”

⁵⁰ European Parliament and Council of the European Union, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons With Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation),” European Parliament and Council of the European Union, April 27, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN. See Article 4.

⁵¹ DP Bill Section 3(41); and Pawan Bali, “Data Protection Draft Bill Holds Hope for Privacy,” Asian Age, July 28, 2018, https://www.asianage.com/india/all-india/280718/data-protection-draft-bill-holds-hope-for-privacy.html.

⁵² See DP Bill Section 3(15).

⁵³ Ibid., Section 3(16); and Supreme Court of India, “Justice K.S. Puttaswamy (Retd.) and Another Petitioner(s) Versus Union of India and Others Respondent(s).”

⁵⁴ See DP Bill Section 11.

⁵⁵ Ibid., Chapter III.

⁵⁶ Ibid., Chapter V.

⁵⁷ Ibid., Section 3(11).

⁵⁸ Ibid., Sections 21(1) and 23(3).

⁵⁹ Ibid., Section 26.

⁶⁰ Amber Sinha and Elonnai Hickok, “The Srikrishna Committee Data Protection Bill and Artificial Intelligence in India,” Centre for Internet and Society, September 3, 2018, https://cis-india.org/internet-governance/blog?b_start%3Aint=930.

⁶¹ Arya Tripathy and Rishi Sehgal, “India’s New Data Protection Bill, 2021: Overview and Analysis of JPC Draft,” PSA Legal Counsellors, December 20, 2021, https://www.psalegal.com/indias-new-data-protection-bill-2021-overview-and-analysis-of-jpc-draft.

⁶² DP Bill Sections 27 and 28.

⁶³ Ibid., Section 30.

⁶⁴ European Commission, “Proposal for a Regulation of the European Parliament and of the Council on European Data Governance (Data Governance Act),” European Commission, November 2020, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0767; and Council of the EU, “Council Approves Data Governance Act,” Council of the EU, May 16, 2022, https://www.consilium.europa.eu/en/press/press-releases/2022/05/16/le-conseil-approuve-l-acte-sur-la-gouvernance-des-donnees.

⁶⁵ DB Bill Section 3(8).

⁶⁶ For example, under GDPR, data principals below the age of sixteen years are considered children, and member states may provide for a lower age up to thirteen years. See European Parliament and Council of the European Union, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons With Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation).”

⁶⁷ DB Bill Sections 16(2) and 16(3); and Vikram Jeet Singh, “An Introduction to India’s New Privacy Regime,” International Bar Association, June 22, 2022, https://www.ibanet.org/an-introduction-to-India-new-privacy-regime.

⁶⁸ DP Bill Section 34; and Deloitte, “Draft Personal Data Protection Bill, 2019,” Deloitte, January 2020, https://www2.deloitte.com/content/dam/Deloitte/in/Documents/risk/in-ra-draft-personal-data-protection-bill-noexp.pdf.

⁶⁹ DP Bill Section 33(3).

⁷⁰ Ibid., Section 65.

⁷¹ Section 3(23) of the DP Bill defines harm to include “(i) bodily or mental injury; (ii) loss, distortion or theft of identity; (iii) financial loss or loss of property; (iv) loss of reputation or humiliation; (v) loss of employment; (vi) any discriminatory treatment; (vii) any subjection to blackmail or extortion; (viii) any denial or withdrawal of a service, benefit or good resulting from an evaluative decision about the data principal; (ix) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; (x) any observation or surveillance that is not reasonably expected by the data principal;” (xi) psychological manipulation which impairs the anatomy of the individual; or (xii) such other harm as may be prescribed. See DP Bill Section 3(23); and Vijayashankar Na, “PDPA 2021: Regulating the Human Perceptions,” Naavi.org, August 16, 2022, https://www.naavi.org/wp/pdpa-2021-regulating-the-human-perceptions.

⁷² UK Parliament, “Online Safety Bill (As Amended in Public Bill Committee),” UK Parliament, Bill 121, https://publications.parliament.uk/pa/bills/cbill/58-03/0121/220121.pdf. For more information, see Edina Harbinja, “The UK’s Online Safety Bill: Not That Safe, After All?,” Lawfare (blog), July 8, 2021, https://www.lawfareblog.com/uks-online-safety-bill-not-safe-after-all.

⁷³ Dia Rekhi, “Global IT Bodies Express Concern Over Data Protection Bill,” Economic Times, March 2, 2022, https://economictimes.indiatimes.com/tech/information-tech/global-it-bodies-express-concern-over-data-protection-bill/articleshow/89930675.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst; and Surajeet Das Gupta, “India’s Data Localisation Rules to Be a Barrier to Digital Trade: US,” Business Standard, April 11, 2022, https://www.business-standard.com/article/economy-policy/india-s-data-localisation-rules-to-be-a-barrier-to-digital-trade-us-122041100008_1.html.

⁷⁴ Gupta, “India’s Data Localisation Rules to Be a Barrier to Digital Trade: US.”

⁷⁵ Rekhi, “Global IT Bodies Express Concern Over Data Protection Bill.”

⁷⁶ Unless otherwise noted, the insights from this part of the analysis come from the committee’s report. See Indian Ministry of Electronics and Information Technology, “Report by the Committee of Experts on Non-Personal Data Governance Framework.”

⁷⁷ Dvara Research, “Comments to the Joint Parliamentary Committee (JPC) on the Personal Data Protection Bill 2019 Introduced in the Lok Sabha on 11 December 2019,” Dvara Research, https://www.dvara.com/research/wp-content/uploads/2020/03/Dvara-Research-Final-Submission-Comments-to-the-Joint-Parliamentary-Committee-on-PDP-Bill.pdf.

⁷⁸ DP Bill Section 92(2) and 94(2)(e); and Prahalad Sriram, “Reconciling Localization Mandate of the Personal Data Protection Bill, 2019 With International Trade Obligations,” Narsee Monjee Institute of Management Studies (NMIMS) Law Review 2 (June 2020): 273–284, http://lawreview.nmims.edu/wp-content/uploads/2020/07/Volume-II-NMIMS-Law-Review.pdf.

⁷⁹ Indian Ministry of Electronics and Information Technology, “Report by the Committee of Experts on Non-Personal Data Governance Framework”; and Astha Kapoor, Sarada Mahesh, and Vinay Narayan, “Impact of the Non-Personal Data Governance Framework on the Indian Agricultural Sector,” Aapti Institute, February 2022, https://thedataeconomylab.com/wp-content/uploads/2022/02/Aapti-Report-Impact-of-the-Non-Personal-Data-Governance-Framework-on-the-Indian-Agricultural-Sector_Final.pdf.

⁸⁰ U.S Department of Health and Human Services, “Demand-Driven Open Data,” U.S Department of Health and Human Services, https://web.archive.org/web/20220120211847/https://www.hhs.gov/cto/projects/demand-driven-open-data/index.html.

⁸¹ Cuts International, “Cuts Comments on the Revised Report of the Committee of Experts on Non-Personal Data Governance Framework,” Cuts International, January 31, 2021, https://cuts-ccier.org/pdf/comments-on-revised_npd-governance-framework.pdf.

⁸² Centre for Information Policy Leadership and DSCI, “Enabling Accountable Data

Transfers from India to the United States Under India’s Proposed Personal Data

Protection Bill (No. 373 of 2019),” Centre for Information Policy Leadership and DSCI, August 2020, https://www.informationpolicycentre.com/uploads/5/7/1/0/57104281/cipl-dsci_report_on_enabling_accountable_data_transfers_from_india_to_the_united_states_under_indias_proposed_pdpb__8_september_2020_.pdf.

⁸³ “Why Non-Personal Data Governance Framework Needs a Rethink,” Financial Express, August 31, 2020, https://www.financialexpress.com/opinion/why-non-personal-data-governance-framework-needs-a-rethink/2069892.

⁸⁴ Indian Ministry of Science and Technology, “National Data Sharing and Access Policy,” Indian Ministry of Science and Technology, 2012, 10–15, https://dst.gov.in/sites/default/files/nsdi_gazette_0.pdf.

⁸⁵ India Urban Data Exchange, “Unleashing the Power of Data for Public Good,” India Urban Data Exchange, https://iudx.org.in; Open Budgets India, “Making India’s Budgets Open, Usable, and Easy to Comprehend,” Open Budgets India, https://openbudgetsindia.org; NITI Aayog, “National Data and Analytics Platform: Vision Document,” NITI Aayog, January 2020, https://www.niti.gov.in/sites/default/files/2020-01/Vision_Document_30_Jan.pdf; and Sam Neufeld, “Deploying Open Government Data for AI-Enabled Public Interest Technologies,” Observer Research Foundation, July 21, 2021, https://www.orfonline.org/expert-speak/ai-driven-public-interest-technologies-employing-open-government-data-achieve.

⁸⁶ Indian Ministry of Electronics and Information Technology, “India Data Accessibility and Use Policy (Draft),” Indian Ministry of Electronics and Information Technology, February 2022, https://web.archive.org/web/20220314080207/https://www.meity.gov.in/writereaddata/files/Draft%20India%20Data%20Accessibility%20and%20Use%20Policy_0.pdf; and Indian Ministry of Electronics and Information Technology, “National Data Governance Framework Policy (Draft),” Indian Ministry of Electronics and Information Technology, May 2022, https://web.archive.org/web/20220719055047/https://www.meity.gov.in/writereaddata/files/National%20Data%20Governance%20Framework%20Policy_26%20May%202022.pdf.

⁸⁷ For a detailed description of the DEPA framework, please see NITI Aayog, “Data Empowerment and Protection Architecture.” Also see Vikas Kathuria, “Data Empowerment and Protection Architecture: Concept and Assessment,” Observer Research Foundation, August 2021, https://www.orfonline.org/research/data-empowerment-and-protection-architecture-concept-and-assessment.

⁸⁸ Reserve Bank of India, “Master Direction - Non-Banking Financial Company - Account Aggregator (Reserve Bank) Direction, 2016.”

⁸⁹ National Digital Health Mission, “National Digital Health Mission: Health Data Management Policy,” National Digital Health Mission, https://ndhm.gov.in/health_management_policy.

⁹⁰ Sahamati, “Current List of AAs,” Sahamati, https://sahamati.org.in/account-aggregators-in-india.

⁹¹ Sahamati, “Live Dashboard,” Sahamati, https://sahamati.org.in/aa-dashboard.

⁹² Ann Cavoukian, “Privacy by Design: The 7 Foundational Principles,” International Association of Privacy Professionals, January 2011, https://iapp.org/media/pdf/resource_center/pbd_implement_7found_principles.pdf.

⁹³ NITI Aayog, “National Health Stack: Strategy and Approach.”

⁹⁴ Open Government Data Platform India, Ministry of Electronics and Information Technology National Informatics Centre, and State Government of Sikkim, “Discover Datasets by Sector (Sikkim),” Open Government Data Platform India, Ministry of Electronics and Information Technology National Informatics Centre, and State Government of Sikkim, https://sikkim.data.gov.in; and Surat Municipal Corporation Open Data Initiative, “Open Government Data Portal of Surat City,” Surat Municipal Corporation Open Data Initiative, https://www.re3data.org/repository/r3d100012679.

⁹⁵ Open Government Platform, “Table of Contents,” Open Government Platform, https://ogpl.github.io/index-en.html; and Dimple Patel, “Research Data Management: A Conceptual Framework,” Library Review, July 4, 2016, https://www.emerald.com/insight/content/doi/10.1108/LR-01-2016-0001/full/html.

⁹⁶ Anirudh Burman, “Will India’s Proposed Data Protection Law Protect Privacy and Promote Growth?,” Carnegie India, March 9, 2020, https://carnegieindia.org/2020/03/09/will-india-s-proposed-data-protection-law-protect-privacy-and-promote-growth-pub-81217.

⁹⁷ Amba Kak and Samm Sacks, “Shifting Narratives and Emergent Trends in Data-Governance Policy,” Yale Law School Paul Tsai China Center, AI Now, and New America, August 2021, https://law.yale.edu/sites/default/files/area/center/china/document/shifting_narratives.pdf.

⁹⁸ NITI Aayog, “Data Empowerment and Protection Architecture.”

⁹⁹ Lawrence Lessig, Code and Other Laws of Cyberspace (New York: Basic Books, 1999), https://lessig.org/product/code.

¹⁰⁰ “MediaNama: Discussion on the Governance of Non Personal Data,” YouTube video, 3:55:20, posted by “MediaNama,” January 15, 2021, https://www.youtube.com/watch?v=9ynaYd1_A3A.

¹⁰¹ Indian Ministry of Finance, “Economic Survey 2021–22.”

¹⁰² Indian Ministry of Electronics and Information Technology, “Report by the Committee of Experts on Non-Personal Data Governance Framework.”

¹⁰³ Indian Ministry of Electronics and Information Technology, Committee of Experts Under the Chairmanship of Justice B.N. Srikrishna, A Free and Fair Digital Economy Protecting Privacy, Empowering Indians (New Delhi: Committee of Experts Under the Chairmanship of Justice B.N. Srikrishna, https://web.archive.org/web/20220809182239/https://www.meity.gov.in/writereaddata/files/Data_Protection_Committee_Report.pdf.

¹⁰⁴ Arindrajit Basu, “We Need a Better AI Vision,” Centre for Internet and Society, October 12, 2019, https://cis-india.org/internet-governance/front-page/blog?b_start%3Aint=1050; and Indian Department for Promotion of Industry and Internal Trade, “Draft National E-Commerce Policy: India’s Data for India’s Development,” Indian Department for Promotion of Industry and Internal Trade, February 23, 2019, https://dpiit.gov.in/sites/default/files/DraftNational_e-commerce_Policy_23February2019.pdf.

¹⁰⁵ For instance, a Netflix database was deanonymized by comparing rankings and time stamps with data sets from other sources. See Arvind Narayanan and Vitaly Shmatikov, “Robust De-anonymization of Large Datasets (How to Break Anonymity of the Netflix Prize Dataset),” University of Texas at Austin, February 5, 2008, https://arxiv.org/pdf/cs/0610105.pdf. For more examples, see “Re-Identification of Anonymised Data Sets,” DigiTorc, April 10, 2019, https://www.digitorc.com/re-identification-of-anonymised-data-sets.

¹⁰⁶ Japanese Ministry of Foreign Affairs, “G-20 Osaka Leaders Declaration,” Japanese Ministry of Foreign Affairs, June 29, 2019, https://www.mofa.go.jp/policy/economy/g20_summit/osaka19/en/documents/final_g20_osaka_leaders_declaration.html.

¹⁰⁷ See, for example, European Parliament and Council of the European Union, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons With Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation)”; and European Commission, “European Data Strategy: Making the EU a Role Model for a Society Empowered by Bata,” European Commission, https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/european-data-strategy_en.

¹⁰⁸ The Personal Information Protection Law restricts or bans data transfers if they harm China’s national security, which is defined more broadly than in most other countries. It also requires all data processed by national agencies and critical information infrastructure operators be stored in China. Entities that handle personal information reaching a certain threshold are also required to store user data within China. See Standing Committee of the Thirteenth National People’s Congress, “Personal Information Protection Law of the People’s Republic of China,” translated by Rogier Creemers and Graham Webster, Digichina (Stanford University), September 7, 2021, https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021.

¹⁰⁹ Various Russian laws such as Federal Law No. 152-FZ on Personal Data contain data localization provisions and prescribe import substitutions for IT products used by government agencies, state-owned corporations, and critical infrastructure. See International Committee of the Red Cross, “Federal Law No. 152 FZ on Personal Data, 2006,” International Committee of the Red Cross, July 27, 2006, https://ihl-databases.icrc.org/applic/ihl/ihl-nat.nsf/implementingLaws.xsp?documentId=874FC74312B61FFAC1257EF200543AB8&action=openDocument&xp_countrySelected=RU&xp_topicSelected=GVAL-992BUA&from=topic&SessionID=DUJCM3QC81. In Egypt’s case, Law No. 151 of 2020 prohibits the transfer of personal data to recipients located outside Egypt except with the permission of the Egyptian Data Protection Center. See International Labour Organization, “Law No. 151 of 2020: Promulgating the Personal Data Protection Law,” International Labour Organization, 2020, https://www.ilo.org/dyn/natlex/docs/ELECTRONIC/111246/138543/F217894882/EGY111246%20Eng.pdf.

¹¹⁰ Indian Ministry of Commerce and Industry, “Shri Piyush Goyal Participates in the G-20 Meeting of the Trade and Investment Ministers,” Indian Ministry of Commerce and Industry, September 22, 2020, https://pib.gov.in/PressReleseDetail.aspx?PRID=1657874.

¹¹¹ United Nations (UN) Conference on Trade and Development, Digital Economy Report 2021: Cross-border Data Flows and Development: For Whom the Data Flow (New York: UN Conference on Trade and Development, 2021), https://unctad.org/system/files/official-document/der2021_en.pdf.

¹¹² Nima Elmi, “Is Big Tech Setting Africa Back?,” Foreign Policy, November 11, 2020, https://foreignpolicy.com/2020/11/11/is-big-tech-setting-africa-back.

¹¹³ Nigeria has required all subscriber and consumer data of ICT service providers as well as all government data to be stored locally within the country since December 2013 through the Guidelines for Nigerian Content Development in ICT. See Nigerian National Information Technology Development Agency (NITDA), “Guidelines for Nigerian Content Development in Information and Communication Technology (ICT),” NITDA, August 2019, https://nitda.gov.ng/wp-content/uploads/2020/11/GNCFinale2211.pdf. In Rwanda, the concept of data sovereignty has been at the core of the government’s Data Revolution Policy, which requires that national data should be hosted locally. See Rwandan National Institute of Statistics, “Data Revolution,” Rwandan National Institute of Statistics, https://www.statistics.gov.rw/content/data-revolution#:~:text=The%20Data%20Revolution%20Policy%20(DRP,open%20license%20and%20technical%20standards. A 2012 law states that all critical information data within the government should be hosted in one central national data center. See Rwanda Law Reform Commission, “Ministerial Order N°001/MINICT/2012 of 12/03/2012 (Ministerial Instructions Related to the Procurement of Information and Communications Technology Goods and Services by Rwanda Public Institutions,” Rwanda Law Reform Commission, March 12, 2012, https://www.rlrc.gov.rw/fileadmin/user_upload/Laws/Laws/RWA%20LAWS%20PUBLISHED%20IN%202012/RWA%202012%20%20%20MI%20N0%20001-MINICT-2012%20%20PROCUREMENT%20OF%20INFO%20AND%20COMMS%20TECHNOLOGY%20GOOD%20AND%20SERVICES%20BY%20RDA%20PUBLIC%20INSTITUTIONS%20%20%20-%20OG%20N0%2011BIS%20%20OF%2012%20%20MARCH%202012.pdf.

Having taken office in May 2022, South Korean President Yoon Suk-yeol and his administration are well-positioned to define new and far-reaching policies on open data. But to do so, his team will need to build on the sometimes-uneven efforts of his two predecessors, former presidents Park Geun-hye and Moon Jae-in. Despite substantial differences in their ideological orientations, the conservative Park and the progressive Moon both championed the concept of “open government,” which includes open data and freedom of information.¹

For South Korea (hereafter Korea), open government is focused particularly on how open data can spur a digital transformation and unleash the technologies of the Fourth Industrial Revolution. While Korea’s emphasis on and commitment to digital technology is well-known, how these efforts could be translated into more extensive cross-organizational interactions and even collaborative forms of governance has gained less attention. The good news is that successive Korean governments have developed a shared aspirational vision. The next challenge will be to address critical managerial and institutional needs, both of which are necessary for successful open government initiatives.

Since open data is the foundation of open government, this analysis discusses key issues related to Korean open data policy. In Korea, the term “public data” is sometimes used interchangeably with open data in English translations. It is believed that open data starts with releasing and sharing government-held data. When it comes to data in Korea’s case, the term “public” is often confused with “open” because open data actually means open public data (given restrictions on opening private data).

Technology can lead to further openness, but only if organizational and cultural barriers are removed. Even with well-funded public initiatives, strong executive leadership, and long-term political commitments, governments sometimes have failed to effectively harness open data to solve, or at least start to tackle, thorny problems. These problems span jurisdictions, policy domains, and levels of government. Designing multiorganizational, multidimensional, and multijurisdictional efforts that use government data is not a simple endeavor. National policy governance for open data in Korea provides several useful insights that other national and local governments can learn from. This analysis addresses three main issues regarding Korean open data policy governance: institutions, policies, and organizational capacity.

Korea’s Conflicting Institutional Landscape

An important initial consideration for understanding Korea’s open data policies is the country’s institutional underpinnings in this policy sphere. The Ministry of the Interior and Safety (MOIS), the Ministry of Science and Information and Communications Technology (MSIT), and Statistics Korea each oversee some aspects of Korea’s open data policies. These three central agencies play different respective roles: overseeing public-sector data, private-sector data, and authorized statistical data. But because the distinctions among these three categories have increasingly blurred with the emergence of big data and the complicated nature of new data sources and data sets, Korea’s institutional framework has become muddled.

This means that Korea’s institutions will need to evolve to combine data from many different types of organizations. And these institutional frictions are mirrored in contradictory legal and regulatory provisions and a lack of consensus among the Korean government, corporate players, and civil society. There is, in short, an absence of effective digital leadership at the national level.

Institutional Complexity of Open Data Policy

Korea’s open data challenges begin with the fact that the MOIS, the MSIT, and Statistics Korea each exercise responsibility and oversight over some elements of the country’s national data management system. These three agencies institutionally differ in their main missions and roles related to open data policy. But the differences are not entirely clear-cut. When open data initiatives were initially introduced, open data meant open public data only. Since 2021, the MyData project in Korea has allowed accredited companies (known as MyData operators) to manage personal information scattered across the financial, telecommunications, medical, and public sectors.² This project enables the further use of data through the pseudonymization and anonymization of personal information. In this sense, the distinction between big data in the private sector and existing open public data is becoming less pronounced, and the jurisdictional boundaries among Korea’s three major regulatory and policy institutions is also growing blurred.

The Bureau of Digital Government (formerly known as the Bureau of e-Government) within the MOIS acts as a control tower for the digital transformation within the Korean government, and its three divisions (the Division of Open Data Policy, the Division of Open Data Circulation, and the Division of Big Data Analysis and Use) in turn administer all work related to harnessing public data.³ The MSIT, by contrast, is the government’s lead agency for data generated in the private sector, including corporate data, industry data, and research data. The MSIT’s Division of Big Data Promotion helps establish data infrastructure, offers support for firms that handle data, and promotes data-related industries.⁴ The third key agency, Statistics Korea, creates statistical data, runs the country’s national statistics portal, and manages microdata integration services.⁵

The jurisdictional boundaries of Statistics Korea (which is tasked with the provision of official statistics) have become less distinguishable with the industry changes brought about by the rise of big data analytics. Both the MOIS and the MSIT recognize that the strict division between their data areas (data from the public sector and data from the private sector) is eroding. This institutional governance arrangement does not fit well with these rapid changes in the open data ecosystem. With the advent of big data, this ecosystem makes data even more valuable in new ways beyond authorized statistics and weakens the dividing line between public and private information.

To add another layer of institutional complexity, these are not even the only three players in Korea’s open data landscape. Other government agencies also shape policies that affect open data initiatives at the national level. For example, the Personal Information Protection Commission is a powerful regulator in charge of data security and privacy protection.⁶ This commission enforces Korean laws equivalent to the Privacy Act in the United States, where privacy protection is self-regulated, whereas Korea has a national control tower of privacy protection. Thus, the commission steps in when these three agencies involved with open data overstep in ways that harm citizens’ privacy.

Meanwhile, the Presidential Committee on the Fourth Industrial Revolution designs and coordinates Korea’s national digital policies.⁷ This committee deliberates on and then coordinates important policy matters pertaining to the development and acquisition of new advances in science and technology, including artificial intelligence (AI) and data technology, as well as new industries and services necessary for Korean society to embrace the Fourth Industrial Revolution. The committee includes the Data Special Subcommittee, which consists of experts and practitioners from related ministries, industries, and academia. The Korea Data 119 Project, which strives to harvest and harness ideas from the private sector, seeks to promote the opening, distribution, and utilization of data.⁸ Figure 3 shows eleven tasks and nine services conducted by a specific ministry or through collaboration between ministries. The three aforementioned key institutions play especially important roles in these eleven tasks.

Meanwhile, the Open Data Strategy Council, which is co-chaired by the prime minister and a data expert from the private sector, designs the basic plans for opening public data and improves these plans to assure better usage of public data.⁹ This council is a deliberative body that examines, coordinates, monitors, and evaluates government decisions and the implementation of major open data policies and plans. The MOIS formulates and refines the open data master plan, evaluates implementation, creates the relevant infrastructure, and releases data. Participating organizations under the council play other specific roles. To cite a few examples, the Open Data Center for Policy and Technical Support provides technical assistance and acts as a hub and clearinghouse for open data,¹⁰ the chief open data officer in charge of providing public data leads open data efforts at all public organizations, and the Open Data Mediation Committee handles disputes over public organizations’ refusal to share data or decisions to stop data sharing.¹¹

Legal Conflicts

This diverse array of institutions must operate within a legal and regulatory framework that, unfortunately, has some inherent conflicts and contradictions. Specifically, Korea’s data-related legal frameworks include the Framework Act on Intelligent Informatization,¹² the Personal Information Protection Act,¹³ and the Act on Promotion of the Provision and Use of Public Data.¹⁴ Reflecting a massive paradigm shift powered by AI-driven societal changes, the Framework Act on Intelligent Informatization is a revised version of the Act on Informatization, which has been a legal foundation of national informatization in Korea since 1995.

Korea’s bureaucratic diversity has been replicated in these laws and regulations. For instance, the MSIT is responsible for implementing the Framework Act on Intelligent Informatization, but the MOIS is responsible for implementing the Act on Promotion of the Provision and Use of Public Data. This regulatory diversity, in turn, has created confusion and potential conflicts. Yet no one law specifies which government body or bodies have the jurisdiction to manage the data that the private sector generates.

The same is true when local governments become involved. For instance, Korea’s current law on informatization requires all provincial and local governments to submit their basic plans for informatization (including open data) to the head of the MOIS because this official formally controls the local autonomy system in Korea, but the minister of the interior and safety must then provide these local plans to the minister of science and information and communications technology (ICT).

As a result, these two ministers need to coordinate and collaborate. This can be a tall order, however, because public data (under the MOIS) cannot be easily integrated with private data (under the MSIT) since the two different ministries’ jurisdictions may functionally overlap but remain institutionally divided. Invariably, then, these related laws can and do yield inevitable conflict among several different ministries.

Legal Rhetoric on Data-Driven Administration

The Act on the Promotion of Data-based Administration legally and institutionally gave rise to data-related processes, procedures, and resources.¹⁵ This formal support of data-driven administration highlights all data-related government processes, including excavation, collection, processing, registration, and reuse of data. The act stipulates that all Korean government agencies must designate a chief data officer and have an organizational unit dedicated to data-driven administration. But the right people—those with relevant expertise—are infrequently recruited for these jobs. A starting point of all data-driven administration is making government data available to the public. Unfortunately, most government organizations, including in Korea, find it easier to define a vision and write a plan than to substantively increase openness.

Open public data is not the same as freedom of information requirements, although both necessarily require that government officials be transparent. Open data must have tangible benefits (and not necessarily financial ones) from further data use in industry, academia, mass media, and the public sector, whereas freedom of information programs must satisfy citizens’ constitutional (unavoidably abstract and symbolic) right to know certain information. Korea’s approach to data-driven administration tends to tout the idea that the country is opening as much data as possible, but that is simply not sufficient. Such rhetoric fails in practice because it does not provide well-defined criteria for success to guide the wide variety of actors who use and leverage data.

Without clear goals, Korea’s government will struggle, as many governments do, to work with nongovernmental organizations. Government employees who deal with public data need to be able to understand and explore the full range and richness of the data that different and diverse ministries capture. In many countries, not just in Korea, it is wrongly thought that the success of open data initiatives can be measured by simply counting the number of available data sets. Or else government-led open data initiatives showcase process flow charts and increased throughput instead of generating substantial societal benefits. This has been a clear challenge in Korea, too, as many corporate data users complain about the low value of open public data (due to its incompleteness, poor quality, lack of timeliness, or limited significance). Even government employees do not have a substantial understanding of what data-driven administration means and why it is important for the public sector, much less the country’s corporate and academic sectors.

Institutions Lag Behind Technologies

A related problem is that Korean laws and institutions do not always reflect the scope and intensity of technological change. Take, for instance, the Act on the Promotion of Data-based Administration, which on the surface would seem to demonstrate institutional readiness for wide-ranging, technology-driven changes.¹⁶ Both the executive branch and the legislative branch of the Korean government have passed several ambitious, innovative laws and regulations to this effect. Another is the Electronic Government Act,¹⁷ which was the first of its kind anywhere in the world. The Act on the Promotion of Smart City Development and Industry,¹⁸ the Framework Act on Intelligent Informatization, the Act on Promotion of the Provision and Use of Public Data, and the Act on the Promotion of Data-based Administration likewise aim to enable the societal changes and government innovation made possible by cutting-edge technologies. Korean legislators recognize the need for frequent revisions to these laws as new opportunities and challenges arise. For example, emerging technologies and new business models have shortened the cycle for necessary legal revisions. The executive branch and the National Assembly have revised laws quickly in response to emerging technologies. Interestingly, they aim to write proactive legislation, which is designed to remain effective not just today but also in the near future and over the long term.

But future-proofing legislation amid the blistering pace of technological change is never easy. Legal language, institutional culture, and organizational capacity do not always align. Well-designed legislation and regulations need to be paired with adequate budgets and staffing to provide the flexibility needed to adapt policy to new opportunities and challenges.

The trajectory of technological change and the policies that shape this arc are not preordained. Academics (and not just scholars in fields related to ICT) and government practitioners know that technological progress is not deterministic. They recognize that their actions can create new technological pathways, though they likely cannot truly or fully grasp the complexities of theories that try to combine sociological determinism and technological determinism or how those theories can guide their decisionmaking. Given how difficult it is to accurately predict the pace and scope of the development of technologies and relevant applications, much less their ultimate societal impact, public attitudes toward technology, whether technology-fueled optimism or a technology-driven backlash, can have more influence than rigorous analysis.

Over the last two decades, Korean legislation has had to be repeatedly and frequently updated to reflect changing social attitudes toward digital technologies. Recent laws were inspired by technology-based, hyper-powered optimism about open data. But because technologies have evolved faster than governments, businesses, and societies, institutional design by necessity has been and will continue to be modified frequently. While it is inevitable that some institutions will lag behind technologies, problems are bound to arise when open data authorities fail to be flexible and future-minded enough to deal effectively with the consequences of this lag.

A Bias Toward a Positive Regulatory System

Traditionally, Korea has featured a strong push for a positive regulatory system. Simply put, positive regulation lists what actors can do, while a negative regulatory system describes what they cannot do (a regulatory sandbox). The former enables interference, while the latter aims principally to prevent interference. For the former, the government intervenes to force the market to do only the specific tasks outlined in the regulation. In contrast, negative regulation imposes restrictions on the basis of law and bans or punishes certain actions.

In Korea, when government agencies have confronted emerging technologies, their reaction has nearly always been to establish positive regulations and thus to confine and bound the role and scope of the market. After all, all regulations ultimately have two purposes: encouragement (and promotion) or prevention (and prohibition). Data-related laws in Korea primarily seek to promote data-related industries and economic sectors. However, Korean corporations tend to recognize that the government institutions implementing and enforcing these regulations can matter as much as the words themselves. By means of an illustration, if a single data set on an open data portal is to be more meaningful, the data set should be aligned with other data, even data from the private sector. A firm may wish to use customer data from other firms, but Korea’s legacy of positive regulation does not attempt to monitor and regulate the results of using such integrated data (ex post regulation) but rather prospectively specifies who uses what data, from which different sources, and for what purpose (ex ante regulation). The result often is undesirable conditions for potential data users.

Discretion in Institutional Interpretation

Korea’s Act on Promotion of the Provision and Use of Public Data controls the data that all public agencies have, but this does not mean the law is applied to each agency in the same manner.¹⁹ Indeed, the nature of data and related processes (including data collection, storage, processing, analytics, and use) may differ between agencies. This dynamic results in a significant difference in institutional discretion in interpreting the act. For instance, while some Korean ministries are mostly focused on data stewardship, others strive first and foremost to facilitate more extensive use of data. Even within the same ministry, different bureaus can have different approaches to opening up data sets. Expectations from open data and the further use of open data can differ among government organizations. Differences in institutional interpretations also arise from asymmetries, which are common at the level of data access and in terms of expertise between different parties (including industry peers, industry and government, peer government bodies, and citizens and companies).

For example, defining what qualifies as personal data is not clear in some cases. Because of that, most decisions have ended up with an overly broad definition of personal data. There are guidelines that define a general strategy for the use of open data. But because these guidelines do not clearly specify what is possible or conversely what is not allowed, there are discretionary decisions about what data should be open and how this data should be shared. This leads to public confusion: external users of open data often ask why this data is open in one ministry but not open in another ministry. The Korean government’s bureaucracy has often showed that when tensions between data protection and data sharing arise, a conservative stance commonly prevails.

Policy Governance Issues

These various institutional, legal, regulatory, and other features are key parts of Korea’s model for governing open data. But a country’s bureaucracies, institutions, and laws are not the only relevant considerations for assessing its stance on open data. Its approach to governance matters too, and this is equally true in the case of Korea.

Cross-Government Policy Coordination

The leading agency tasked with managing public data (the MOIS) is different from that for managing open data (the Open Data Strategy Council), and open data actually seems to mean activities for opening up public data. An important definitional component of the open data concept is use by anyone for any purpose, but too often Korean open data initiatives focus on being government-led efforts for the public interest. To realize the full potential of open government data and to see visible, measurable, and provable improvements, there needs to be a renewed focus on letting any party use data for any purpose within reason.

To this end, Korean government agencies need policy coordination across their functional and jurisdictional boundaries. Digital leadership at the national level entails collaboration among different ministries and even with nongovernmental parties. In this sense, Korea needs a clearly identified and strongly empowered coordinating body for open data policy.

A Missing Governing Body

Korea quite simply lacks a unitary national institution for data management and control, which, in turn, makes it difficult to move and share data across sectors, domains, jurisdictions, and organizational boundaries. To a casual observer, the lack of such a body makes the country’s open data management system look fragmented, but the real problem is not a failure of institutional design but a failure of national-level data policy governance: this is because in the Korean government structure, one agency cannot impose policies on multiple ministries.

To remedy this problem, Korea has considered establishing a new ministry-level data agency, but the performance of any such agency would invariably depend on the attitude (and cooperation) of other existing ministries, which continue to resist this idea. An ongoing issue is who should manage the relationships among ministries related to open data.

The Legacy of Korea’s Public-Private Dichotomy

Historically, Korea’s public and private sectors have been clearly distinguishable. As a result of that legacy, the separation between public data and private data has been unnecessarily strict. A monumental exception was the early response to the coronavirus pandemic. Contact tracing for confirmed cases required the authorities to tap private data (such as telecommunications data and credit card data), which are purely personal data and owned by corporations.²⁰ But the successful use of this private data directly and entirely supported the public interest in slowing the spread of COVID-19. The legacy of this sudden shift in 2020 is that Korean government agencies, private corporations, and civil society organizations have started to rethink the scope of open data and how it can be used.

Still, the dichotomy between public and private data is apparent in the world of open data. As a result, both the MOIS and the MSIT take an integrated, society-wide view of public and private data, but their respective jurisdictions reflect the legacy of Korean institutional design and governance practices and history. What is more, this separation into public and private spheres under two different agencies also impedes organizational and sectoral collaboration and erects barriers to generating new value from data integration.

Big Data Crowds Out Statistics

Statistical data also factors significantly into Korea’s emerging open data regime because it plays a crucial role in spurring economic growth, industrial development, and policy formation. With the emergence of big data, the role of government-tallied statistical data is shrinking.

In Korea, almost all of the government’s statistical data—whether at the national, provincial, or city level—are open data. The authorized government data are validated by the national statistics office, but this process inevitably takes time. As a result, many academics and researchers use open data from Google, not official data from the Korean government. This raises the question of whether the big data compiled from Google can be considered accurate and valid for such users.

The scope of open data obviously expands with new technologies. Authorized statistical data are still important, but new sources of easily accessible open data are complementing and even supplanting official statistical data. Government agencies, businesses, and researchers inevitably have to decide how much to trust and rely on different sources of data and how to differentiate between reliable and unreliable sources. Given this situation, integrative and collaborative governance should consider both statistical data and nonstatistical data and how to combine and leverage both. Statistics Korea has a unique jurisdiction, but the Korean government should consider restructuring it to make it a governing body for managing open data.

Korea’s Open Data Conundrum

But Korea’s biggest conundrum and challenge with open data is for the government, in shaping data policy, to both protect sensitive data (such as personal information or data related to national security or law enforcement) and make data available in useful formats for a wide range of applications. Different nations provide different levels of data protection (for different reasons), yet they all face this conundrum. Korea is no exception.

The Open Government Partnership encourages member countries to learn from one another’s open data strategies and share their successes and failures.²¹ One performance metric involves counting the number of data sets that are open to the public via webpages, but that is not the only one. That metric merely measures input, not output. What is needed for performance management of open data efforts, therefore, is rigorous analysis of what is actually accomplished and how open data are used, for whom, and for what. If useful data is not made available in useful ways, it will provide little value.

The Korean business sector has taken a particular interest in this issue, not least by questioning the value of many of Seoul’s official open data initiatives. Korean data practitioners in the business sector often complain that there are simply few data sets of value on the country’s open data portal, where many data sets make it difficult to create new opportunities for industries, businesses, and academics. The data sets in the government’s open data portal are composed of many smaller ones that could have been stitched together, have many missing data points, and cannot easily be synced to match the formatting of others. It is time for government bureaucrats to change their approach and their attitudes. They need to focus on high-value, open public data and help market it to prospective users. This could help change the common perception in Korea that open public data tend to be low-value data.²²

Potential business users and researchers, in particular, can help push government agencies to make more open data available. If they wish to have access to truly meaningful data, they should make additional efforts to file freedom of information requests. To some, this may seem like an unusual approach, but open data initiatives and freedom of information legislation have a similar goal: more transparency and more useful insights from government agencies.

Of course, freedom of information requires one to make requests by filling out a form. Requesting information in this way is not like using a vending machine: there are various reasons, after all, that a government agency can reject such requests. Or some pieces of requested information can be redacted and masked with exemptions. It may be very hard to gain a perfect or complete data set in certain cases. If the data is about internal government operations, agencies often do their best not to give the requested information. But filing freedom of information requests not only makes more data available but can also create political pressure and ultimately motivate government agencies to make more data available (even without requiring time-consuming requests).

Korea needs a strong governing body that can juggle the tensions between the need to protect some data with the need for more access to data. Currently, Korean government bodies lack incentives to facilitate data use, and they worry about additional responsibilities, accountability, and criticism that might result from releasing data. The country’s national governing body must be able to let all government agencies recognize the social benefits and multidimensional effects that open data initiatives can produce.

Conflicting Priorities Across Organizations

The conflicting goals of data protection and data use are not only reflected throughout the Korean government’s data policies: this disconnect also complicates decisionmaking within agencies. Within a single ministry, different offices can have different priorities and different constituencies. For instance, the Ministry of Health and Welfare, which manages huge amounts of valuable, healthcare-related data, must juggle the need to support the further use of personal medical data and promote the healthcare data sector (data use value) with the need to protect patients’ personal healthcare data (data stewardship value). The ministry is not inherently in conflict with other agencies on the matter of data use, but it has internal conflicts within its own four walls. One such conflict concerns who owns data related to diseases: Is it the patients themselves? Or does it belong to hospitals and healthcare professionals? Or is it part of the national healthcare system? Or could it even be all of the above? Who owns or controls healthcare data depends on who creates the data, what contractual obligations they have, and what legal restrictions limit its use—and that all affects what kind of value is generated from such information.

Poor Communication on Open Data

As of now, the Presidential Committee on the Fourth Industrial Revolution is in charge of national open data policy in Korea, and it has to mediate among different stakeholders with a variety of viewpoints on open data.²³ The committee endeavors to listen to voices in data-related industries, but these voices reflect the interests of different sectors and can have very different priorities. Similarly, it can be hard for individual government agencies to ensure effective communication and collaboration between firms that need data and the offices that can provide it. And governments need to listen to and address the needs and concerns of individual citizens, too.

For Korea, this means that designing good data policy will require deeper, more effective communication between policy designers and all policy beneficiaries. Social media platforms and other interactive communication channels tend to be more effective at expressing their needs to the government than enterprises in traditional industries often are, but those communication channels can also provide collaborative tools to enable other stakeholders to express their views.

Korea’s Inactive Open Data Ecosystem

Data users, especially firms, often have a passive attitude toward open data. This attitude, in turn, reflects a lack of investment, interest, and even imagination. The commercial data industry is not as highly developed in Korea as it is in the United States.²⁴ So the government’s role will be critical for creating a more favorable environment for the data industry and improving policies related to open data.

One challenge is that Korean firms and nonprofits need to be ready to find new data sources and extract new value from such data. Unfortunately, most Korean firms have discovered very little of the potential value from open government data, which is free and available from government agencies via the open data portal. Open data is categorized into specific policy domains (by ministries, public agencies, and public corporations) and government jurisdictions (by province and locality). But many users would prefer to see data across industries, across ministries, and across jurisdictions, and the current focus of Korea’s approach to open data is often little more than releasing the data that each public agency is willing to publish. When a Korean government agency determines which data should be open, it too often does not consider how to make sure the data can be used to create new value through the integration of data from different ministries and other forms of nongovernmental data. The main actors in Korea’s open data ecosystem are public agencies, who measure their progress by the number of data sets uploaded and downloaded. Open data has simply not been thought of as an ecosystem of relationships among multiple actors, one that touches and connects all sectors of society.

Korea’s Organizational Capacity Challenges

Korea faces some pronounced issues of organizational capacity that it will need to remedy to maximize the efforts of its open data ambitions.

Bureaucratic Dysfunction

Korea’s governance structure for open data is a barrier to making more public data available. Functional and organizational inefficiencies in the country’s national data management keeps agencies from facilitating open data projects. The rule of law is the foundation of democracy and good governance, and this is no less true in Korea. But public officials in the country often abuse the principle either by highlighting institutional measures for enforcing a law rather than the underlying spirit and intention behind the law or by using outdated or vague regulations as an excuse for inaction.

Oftentimes, the rule of law is not the problem, per se. Instead, public officials misconstrue the implementation of a law, especially when the law’s scope is restricted to a specific area and is in conflict with broader government mandates to share data. Korean government agencies often forget the ultimate purpose of policy (what the law originally purports to do). All organizations tend to strive to keep and even broaden their turf. Thus, in Korea’s case, for example, different government bodies are responsible for the implementation of different data-related acts: the MSIT is in charge of implementing the Framework Act on Intelligent Informatization, the MOIS takes charge of implementing the Act on Promotion of the Provision and Use of Public Data, and implementing the Statistics Act is basically a core function of Statistics Korea.²⁵

Despite this parceling out of duties related to data governance, areas of overlap and duplication are inevitable, and these areas are increasing. Although having one agency, one law, and thereby one mission is the ideal, that is not the case in Korea today. When there is no agreement on who is responsible for what, bureaucratic inertia and classic infighting results. In that sense, open data governance suffers from the same bureaucratic problems that plague other government functions: a government office may try to push some data-related work off its plate onto another office, or an office may try to seize control of other data-related tasks away from another office. As a result, inefficiencies and missed opportunities can arise from both governing hot spots (areas rife with overlapping administrative efforts by competing ministries) and dead zones (areas without governing activity in which relevant offices try to avoid getting involved).

A Siloed Work Culture

As in most governments, the traditional bureaucracy in Korea tends to be stovepiped, making it difficult to horizontally share and integrate data and information. The central government’s ministries have established, developed, and advanced their own systems, including information systems, databases, and software systems. A better, more consolidated cross-agency system for data management and policy development is badly needed.

The Korean bureaucracy holds ministerial data according to the legal rationale for which a respective ministry exists. The rule-of-law principle in Korean public administration seems quite distorted or abused because sometimes bureaucrats cannot think beyond the law itself. A prevalent issue among Korean public-sector employees is “inactive administration.”²⁶ They do not consider the fundamental, original purpose of a law, but rather use their discretionary interpretation of the law according to their institutional preferences and what is convenient. The country’s bureaucracy was well-designed to address issues and solve particular problems defined in the law. However, ordinary organizational behaviors look very different from their design. Despite the necessity of cross-boundary data integration, it remains challenging work that is often considered out of ministry personnel’s jurisdiction.

Data integration requires all related organizations to be functionally connected, but the Korean system is beset by barriers. Meanwhile, even as government agencies struggle to overcome structural impediments to collaboration, data users are struggling to access meaningful information from publicly available open data. This, too, is difficult because siloed Korean ministries, in turn, have created siloed data sets.

A critical issue, therefore, is not whether Korea has a national portal site for opening public data—indeed, the country already has one—but rather how to make organizational silos actually open so that this data can be meaningfully integrated.

Improving Organizational Capacity

Beyond fixing Korea’s bureaucracy, however, the country also needs to improve some of the organizational obstacles that are impeding an open data regime. Job recruiters and headhunters complain about the paucity of data experts in the country.²⁷ And while Korea’s national government, much like its counterparts everywhere, understands the importance of data expertise and assertively recruits such expertise for the public sector, private sector organizations, including even high-profit firms in the tech sector, struggle to find relevant professionals and practitioners in data-based fields. Both sectors, public and private, are still struggling to do so. A shortage of people with the skill sets to deal with open data is a critical issue. Indeed, Korean government offices at every level—central ministries, provinces, and localities alike—lag behind the global leaders in data gathering, data storage, data analytics, and data use.²⁸ Furthermore, local governments face an even more serious gap in organizational capacity than the national government, while smart city initiatives increasingly highlight open data projects.

Korea will need to get more serious about this challenge if it wants to be a global leader in open data. Despite the Act on the Promotion of Data-based Administration’s requirement that all Korean public sector organizations designate a chief data officer, in most public organizations, that position is actually concurrently assigned to someone who may hold another post and may not have the typical technical expertise of a chief data officer. Dedicated data professionals are very rare in the Korean government,²⁹ and well-paid data practitioners in the private sector are often reluctant to work for the public sector.

As a result, Korean public organizations have outsourced jobs related to informatization, technological innovation, and more recently digital transformations (such as the adoption of AI, the use of big data analytics, and the transition to cloud computing) to the private sector and academia. This public-sector dependence on nongovernment parties is not automatically disadvantageous (since outsourcing does bring advantages, including flexibility and nimbleness). But the ever-widening gap between the unchanging bureaucratic core of the Korean government and innovative corporate expertise has put the country’s public sector at a considerable disadvantage.

To bridge this gap, the Korean government has promoted an approach to governance premised on collaboration among public and private actors. It has, for example, outsourced many service-delivery tasks. But it has also sought to ensure that decisionmaking about the digital transformation is informed by corporate experts, industry leaders, and academics.

Korea has some notable public-private partnerships of this type. That is why the country ranks high in the United Nations’ e-Government Readiness Index and the Organisation for Economic Co-operation and Development’s Digital Government Index.³⁰ However, this intensifying gap between the data expertise available to Korea’s public and private sectors is making the government fall behind in terms of how effectively organizations integrate data across organizational boundaries and how they increase the usability of open data for the public.

The outmoded recruitment and promotion practices of the Korean bureaucracy may be an enduring impediment to open data unless countervailing steps are taken. The bureaucracy tends to hire most government employees using a national open examination, which works better for recruiting generalists than specialists. These generalists do specialize as they move along their career paths, but very few end up with the industry-specific domain expertise that private-sector employees gradually acquire. Instead, most Korean officials become adept at navigating the organizational intricacies of the government. For instance, good public managers in one bureau could conceivably move to a director position in another bureau.

Of course, Korea’s public-sector personnel management system is more sophisticated, varied, and flexible than can be depicted in a few paragraphs. But this system poses a challenge to creating a truly world-class open data regime for several reasons. First, data manager positions are often not filled with data experts who possess expertise equivalent to data managers in the private sector. Second, the Korean government’s generalist personnel culture encourages circulation between jobs to provide for more diverse experiences and to avoid regulatory capture and corruption, so employees usually change roles every one or two years. As a result, government employees in data-related posts also cannot hone their own expertise throughout their career. Third, one of the most important motivations for Korean government employees is the opportunity for promotions to higher managerial positions, which means they do not want to remain merely data workers.³¹

One option would be for a single unit or team within a given agency to try to take charge of all data-related work. But even that approach has advantages and drawbacks. One problem is that most employees do not know all the different offices and people who could be involved in data-related work. Many data sets in Korea’s open data portal do not capture various aspects of government operations and public service delivery. And there are many cross-sectional open data sets that were not made with the long term in mind. In most cases, periods of missing data result from poor organizational capacity, especially a lack of good data sense. For example, sometimes government employees seem not to understand why certain data should be provided to the public and who would potentially use it.

Learning From Korea’s Struggles

This analysis has discussed more challenges than opportunities facing Korea in terms of open data governance. But ironically, the discussion should not leave a negative impression of the future of open data; rather, other countries can learn from Korea’s recent self-reflections about its trials and experiments.

The Korean government is a key leader and coordinator of open data governance at the national level. The inevitable lag of institutional readiness behind rapid technological change, organizational obstacles stemming from bureaucratic inertia, and the gap between the legal code itself and actual implementation are all evident in Korea’s efforts to improve its open data governance. All countries may have similar concerns and challenges to some extent. An important lesson from the Korean experience is that open government is vital to open data. But executing the vision is not easy precisely because government actors that champion open data may not actually open their own data for the cause.

Open data should be considered a process, not an end in itself. As Korea’s experience shows, given the pivotal role of national governments in open data, the rest of the world can learn from the pains Korea has weathered and leverage that experience to craft a better governance system for open data policy.

Notes

¹ Statistics Korea, “Open Data Portal,” Statistics Korea, https://www.data.go.kr/en/index.do; and Statistics Korea, “Information Disclosure at a Glance,” Statistics Korea, https://www.open.go.kr/com/main/mainView.do.

² Korea Data Agency, “About MyData,” Korea Data Agency, https://www.kdata.or.kr/kr/contents/mydata_01/view.do.

³ Korean Ministry of Interior and Safety, “Organizational Chart,” Korean Ministry of Interior and Safety, https://www.mois.go.kr/eng/sub/a02/organChart/screen.do.

⁴ Korean Ministry of Science and Information and Communications Technology (ICT), “Organization,” Korean Ministry of Science and ICT, https://www.msit.go.kr/eng/contents/cont.do?sCode=eng&mPid=19&mId=25.

⁵ Statistics Korea, “History,” Statistics Korea, http://kostat.go.kr/portal/eng/aboutUs/2/1/index.static.

⁶ Personal Information Protection Commission, “Vision and Mission,” Personal Information Protection Commission, https://www.pipc.go.kr/eng/user/itc/visionMission.do.

⁷ The Presidential Committee on the Fourth Industrial Revolution, “About PCFIR,” The Presidential Committee on the Fourth Industrial Revolution, https://www.4th-ir.go.kr/en/greetings.

⁸ The Presidential Committee on the Fourth Industrial Revolution, “Data 119,” The Presidential Committee on the Fourth Industrial Revolution, https://web.archive.org/web/20220613225537/https://www.4th-ir.go.kr/en/data119.

⁹ Open Data Strategy Council, “The Public Data Strategy Committee,” Open Data Strategy Council, https://www.odsc.go.kr.

¹⁰ Open Data Strategy Council, “Introduction on Open Data,” Open Data Strategy Council, https://www.odsc.go.kr/eng.

¹¹ Open Data Mediation Committee, “About Open Data Mediation Committee,” Open Data Mediation Committee, https://www.odmc.or.kr/eng.

¹² Korean Legislation Research Institute, “Framework Act on Intelligent Informatization,” Korea Law Translation Center, https://elaw.klri.re.kr/kor_service/lawView.do?hseq=54720&lang=ENG..

¹³ Korean Legislation Research Institute’s Korea Law Translation Center, “Personal Information Protection Act,” Korean Legislation Research Institute’s Korea Law Translation Center, https://elaw.klri.re.kr/kor_service/lawView.do?hseq=53044&lang=ENG.

¹⁴ Korean Legislation Research Institute’s Korea Law Translation Center, “Act on Promotion of the Provision and Use of Public Data,” Korean Legislation Research Institute’s Korea Law Translation Center, https://elaw.klri.re.kr/kor_service/lawView.do?hseq=47133&lang=ENG..

¹⁵ Korean Legislation Research Institute’s Korea Law Translation Center, “Act on the Promotion of Data-based Administration,” Korean Legislation Research Institute’s Korea Law Translation Center, https://elaw.klri.re.kr/kor_service/lawView.do?hseq=54647&lang=ENG..

¹⁶ Korean Legislation Research Institute’s Korea Law Translation Center, “Act on the Promotion of Data-based Administration.”

¹⁷ Korean Legislation Research Institute’s Korea Law Translation Center, “Electronic Government Act,” Korean Legislation Research Institute’s Korea Law Translation Center, https://elaw.klri.re.kr/kor_service/lawView.do?hseq=56406&lang=ENG.

¹⁸ Korean Legislation Research Institute’s Korea Law Translation Center, “Act on the Promotion of Smart City Development and Industry,” Korean Legislation Research Institute’s Korea Law Translation Center, https://elaw.klri.re.kr/kor_service/lawView.do?hseq=54507&lang=ENG.

¹⁹ Korean Legislation Research Institute’s Korea Law Translation Center, “Act on Promotion of the Provision and Use of Public Data.”

²⁰ Taewoo Nam, “How Did Korea Use Technologies to Manage the COVID-19 Crisis? A Country Report,” International Review of Public Administration 25 (2021): 225–242, https://doi.org/10.1080/12294659.2020.1848061.

²¹ Open Government Partnership, “About Open Government Partnership,” Open Government Partnership, https://www.opengovpartnership.org/about/.

²² Byeong-jin Jeon and Hee-Woong Kim, “An Exploratory Study on the Sharing and Application of Public Open Big Data,” Informatization Policy (2017): 27–41, https://papersearch.net/thesis/article.asp?key=3578603.

²³ Presidential Committee on the Fourth Industrial Revolution, “About PCFIR.”

²⁴ Korea Data Agency, “2021 Data Industry White Book,” Korea Data Agency, https://www.kdata.or.kr/kr/whitePaper/view.do.

²⁵ Korean Legislation Research Institute’s Korea Law Translation Center, “Act on the Promotion of Data-based Administration”; and Korean Legislation Research Institute’s Korea Law Translation Center, “Statistics Act,” Korean Legislation Research Institute’s Korea Law Translation Center, https://elaw.klri.re.kr/eng_service/lawView.do?hseq=44517&lang=ENG.

²⁶ Korean Anti-Corruption and Civil Rights Commission, “Introduction to Inactive Administration,” Korean Anti-Corruption and Civil Rights Commission, https://www.epeople.go.kr/nep/pttn/negativePttn/NegativePttnCotents.npaid.

²⁷ Korea Data Agency, “2021 Data Industry Survey,” Korea Data Agency, March 31, 2022, https://www.kdata.or.kr/kr/board/info_01/boardView.do?pageIndex=1&bbsIdx=33253&searchCondition=all&searchKeyword=.

²⁸ Hyerim Son, “Data-based Administration, No Budget and No People,” Busan Ilbo, June 29, 2012, http://www.busan.com/view/busan/view.php?code=2021062919264327694.

²⁹ Wookjoon Sung, “The Big Data Policy in the Public Sector From the Data Life Cycle Perspective,” Journal of Korean Association for Regional Information Society, 20 (2017): 25–41, https://www.kci.go.kr/kciportal/ci/sereArticleSearch/ciSereArtiView.kci?sereArticleSearchBean.artiId=ART002235943.

³⁰ United Nations (UN) Department of Economic and Social Affairs, “UN e-Government Surveys,” UN Department of Economic and Social Affairs, 2020, https://publicadministration.un.org/en/Research/UN-e-Government-Surveys; and Organisation for Economic Co-operation and Development (OECD), “OECD Digital Government Index,” OECD, https://goingdigital.oecd.org/indicator/58.

³¹ Seung-joo Hahn, “An Exploratory Study on Professional Identity and Accountability of Civil Servants,” Korean Review of Organizational Studies, 13 (2017): 1–32, https://www.dbpia.co.kr/Journal/articleDetail?nodeId=NODE07104052.

Introduction

A 2019 report by India’s Ministry of Electronics and Information Technology predicted that India could have a $1 trillion digital economy by 2025.¹ It also acknowledged that this growth potential could only be realized if the country creates an enabling environment of policies, platforms, and partnerships suited to the “borderless” character of the digital world, in which “capital, innovation, data, and design capabilities flow . . . to countries that offer the fewest pain points.”² But, despite these acknowledgments, the report did not remark further on the relevance of cross-border data flows for meeting its digital ambitions.

Yet the question of how to manage cross-border data flows is central to India’s digital future. After all, it is a country that has reaped significant benefits from being digitally connected and following an open market policy in this space, with the free flow of data being an integral part of that equation. But at the same time, it is also a country that is increasingly grappling with the challenges posed by unchecked data extraction, data monopolization, and barriers to lawful data access.

This dilemma has prompted a new wave of policy thinking, as reflected in debates on data governance and digital regulation, that signals India’s ambition to transition from a user to a controller of digital markets. India’s strategy of technological self-reliance combined with its frequent assertions of digital sovereignty are also reflected in its approach to cross-border data flows.³

Over the last two decades, India has benefited immensely from open practices enabling free cross-border data flows and the import and export of digital services. According to one study, digital trade generated $35 billion in economic benefits for India in 2019, and that figure was projected to rise to $512 billion by 2030, an amount equivalent to 10 percent of the country’s projected gross domestic product (GDP) at that point.⁴ At the same time, it is undeniable that the social and economic benefits of digital development are not evenly distributed within societies, between private actors, and among countries. To give an example, the revenues of six major U.S.-based technology companies in 2021 exceeded $1.4 trillion,⁵ which is more than forty times the size of India’s estimated benefits from digital trade in 2019. The data advantage that these large global players enjoy is a crucial component of their economic success.⁶ This realization is coupled with the limitations of regulatory and law enforcement control over international actors, concerns about privacy and security, and visions of supporting greater economic benefits for local companies. The confluence of all these factors has propelled state actors, in India and globally, toward more restrictive regimes on data flows.

A report by the Information Technology and Innovation Foundation recorded a recent surge in regulatory requirements focused on data localization. These include directives that data be stored and/or processed within a country’s territory, either on an exclusive basis or through the local mirroring of data that is stored elsewhere. Whereas thirty-five countries had sixty-seven localization requirements in 2017, the authors found that there were sixty-two countries with 144 data localization restrictions in 2021.⁷ The report found that India has the second-highest number of such restrictions (behind China), including in areas like financial services, the provision of cloud services to government agencies, telecom subscriber data, company accounts, and public data.⁸ In addition to the measures already in force, a number of localization proposals are in the pipeline, most notably under India’s proposed data protection law, though this draft has been withdrawn for now.

The subject of cross-border data flows has also moved front and center in several international forums. This includes attempts at building a shared plurilateral position on data flows under the Group of 20’s (G20) Osaka Track and as part of the Joint Statement on Electronic Commerce initiated by a group of countries at the World Trade Organization (WTO).⁹ In addition to data flows for commercial purposes, new arrangements to enable access to data for law enforcement are taking shape through mechanisms like the Second Additional Protocol to the Budapest Convention on Cybercrime¹⁰ and the United States’ Clarifying Lawful Overseas Use of Data Act.¹¹ Further, a 2019 United Nations (UN) resolution has paved the way to developing a treaty for “countering the use of information and communications technologies [ICT] for criminal purposes,” which will also cover issues of data access.¹²

India’s presence in forums like the G20 and the Global Partnership on Artificial Intelligence gives it the opportunity to be at the forefront of key international conversations on digital governance. Its position on data flows, however, stands apart from those of the other G20 members, most of whom have chosen to pursue international discussions on data flows under the Osaka Track.

India’s stated reasons for this difference revolve around its desire to maintain the space to formulate domestic policies on issues of digital governance and an insistence on more inclusive and multilateral decisionmaking. India’s position on data flows is also influenced by its roots in forums like the Group of 77 (G77) and the BRICS coalition alongside Brazil, Russia, China, and South Africa that allow New Delhi to represent developing and emerging world powers’ responses to the dominance of developed nations, including on matters of technology. But interestingly, and unlike India, others including China and Russia that also belong to the G77 or the BRICS have nevertheless opted to be a part of the Osaka Track. This suggests that, although India routinely relies on its groupings with other developing and emerging countries to assert its positions on issues of digital governance, such platforms may be more of a place to anchor its positions rather than the strategic impetus that brought the country there.

This analysis traces the main instruments and arguments that are driving India’s position on cross-border data flows with respect to domestic policies and international forums. It highlights how India’s unique position in this debate is being shaped by a mix of evolving domestic priorities and the multiple identities that the country straddles on the international stage.

The first section of this analysis outlines the actions and instruments shaping India’s current and proposed restrictions on cross-border data flows. The second section presents an overview of the drivers of data flow restrictions in India, as laid out in expert committee reports, regulatory directives, and other policy documents. The third section widens the lens of analysis from a local perspective to a global one by outlining the strategic and geopolitical dimensions of India’s participation in international conversations on data flows. The next section then looks beyond the issue of commercial data transfers to focus on the actions India has taken to facilitate law enforcement access to data through mechanisms like mutual legal assistance treaties (MLATs). The final section concludes with some suggested paths for reform.

India’s Current and Proposed Restrictions on Data Flows

Numerous policy documents have articulated the role of data in India’s socioeconomic development. This includes various forms of data, including personal and nonpersonal data, and data for various use cases, ranging from government functions to commercial purposes. In general, these discussions focus mainly on the benefits and risks of data processing and the need for regulatory or technical solutions to strengthen India’s data infrastructure.

But references to cross-border data flows tend to be rarer and are usually limited to proposed limitations on such flows, including in the form of localization norms. In this process, the real but invisible role of cross-border data flows in the success of India’s digital economy tends to be overshadowed by the equally real challenges posed by unhindered data flows, particularly for regulatory and law enforcement purposes.

For instance, the Indian Economic Survey of 2018–2019 dedicated a chapter to discussing the many benefits of data for policymaking, welfare delivery, and product innovation.¹³ It noted that these benefits are spurred largely by the decreasing marginal costs of gathering, storing, processing, and disseminating data. However, the chapter made no specific reference to the current market realities of cross-border data flows and the role they play in lowering the marginal costs of data storage and processing. Recent policy conversations—informed by the findings of the Gopalakrishnan Committee, which was set up by the Indian government in 2019 to develop the regulatory structure for nonpersonal data—follow a similar trend.¹⁴

The committee’s report speaks at length about the public benefits that can come from unlocking access to nonpersonal data (meaning information that is not personally identifiable, including anonymized personal data) and suggests a new regulatory structure to enable data access by government agencies and organizations registered in India. While discussing the process of value creation from data, the committee did not account for the role that cross-border flows have historically played and continue to play. Their treatment of the international character of data focused only on the data pools held by large multinational corporations and the resulting market dominance they hold.

The issue of cross-border flows has been more central in ongoing discussions on the regulation of personal data. A draft piece of legislation called the Personal Data Protection Bill, 2019, was introduced in the Indian parliament in December of that year, and a further modified version of the bill—the Data Protection Bill, 2021 (DP Bill)—containing the recommendations of a joint parliamentary committee was submitted in 2021, though the bill was subsequently withdrawn (see below). The bill contained several restrictions on cross-border flows, proposals that originated from the recommendations made by the Committee of Experts Under the Chairmanship of Justice B.N. Srikrishna (or the Srikrishna Committee), which prepared the first draft of the bill in 2018.¹⁵ In August 2022, India’s minister of electronics and information technology announced the decision to withdraw the pending bill.¹⁶ It is supposed to be replaced by a new draft, details of which are not yet publicly available, in the coming months.¹⁷

The Srikrishna Committee emphatically recognized that the “flow of data across borders is essential for a free and fair digital economy.”¹⁸ But the committee also noted that data flows cannot be seen as an “unadulterated good” as unchecked data transfers can generate substantial harm to individual privacy. The committee accordingly went on to suggest expansive restrictions on data flows, which included a requirement to maintain a live mirrored copy of all personal data in Indian territory. While the scope of the restrictions suggested by the Srikrishna Committee was curtailed in subsequent drafts of the bill, the implications of localization simultaneously evolved in light of other changes in the legislation. This includes the possibility of granting broad exemptions to select government agencies, such as law enforcement bodies, from “all or any” of the provisions of the draft law and the requirements relating to mandatory sharing of nonpersonal data.¹⁹

The Srikrishna Committee’s report cast the spotlight on data localization. The body of work that has emerged since then includes studies examining the motivations and policy processes behind localization,²⁰ those questioning the framing of the debate in terms of economic value,²¹ and attempts at quantifying the effects of localization.²² Alongside this work, researchers have also examined the barriers and challenges of cross-border data access specifically in the context of law enforcement and the U.S.-India trade relationship.²³ Building on this background, it is important to consider India’s internal moves and international positions on cross-border data flows both for law enforcement and commercial purposes.

Table 1 at the end of the chapter summarizes India’s restrictions on cross-border data flows as seen in various policy instruments and recommendations. It displays the type of data that is covered, the nature of the restriction, and the agency responsible for suggesting or implementing it.

Table 1 shows that India’s current restrictions on data flows can be grouped into four sectors or categories of data: data pertaining to financial services, data of telecommunications and broadcasting subscribers, corporate and compliance data, and government data. In addition, there are some cross-sectoral requirements, such as those pertaining to keeping logs of all ICT systems in India for 180 days and other policy proposals containing local storage and/or processing requirements for specific types of data.²⁴ The proposals related to the regulation of personal and nonpersonal data stand out among them, in terms of the omnibus cross-sectoral nature of the proposed laws and the range of entities and individuals that would be affected.

However, the history of the localization debate in India indicates that not all proposals may translate into actual restrictions, at least not in the form originally proposed. As noted earlier, this has been the case with the localization recommendations in the DP Bill, which have gone through several iterations since the proposal was first raised by the Srikrishna Committee. Table 1 references two other examples from the healthcare and e-commerce sectors—the proposal for