India could set up new panel to monitor personal data collection

New Delhi: India should set up a data regulator and require companies to disclose how they collect and store data devoid of personal details or which has been anonymised, a panel tasked to draw up such regulations has said in a draft report.

As India moves to tighten policies on its citizens’ data held and processed by companies such as Facebook, Google and Amazon, it set up the panel last year to make recommendations on the regulation of “non-personal data”.

This is a term for data viewed as a critical resource by companies that analyse it to build their businesses and describes information that is independent of personal details such as names, or anonymised to protect people’s identity.

“There is a need to create a regulator or authority for data business, which provides centralized regulation for all non-personal data exchanges,” the government-appointed panel said in the report. Such a regulator would be armed with legal powers to request data, supervise data sharing requests and settle disputes, it added.

The panel was headed by Kris Gopalakrishnan, a founder of Indian technology giant Infosys. The panel is in the final stages of deliberation on the report before it is submitted to India’s information technology ministry.

New norms

A company collecting data beyond a yet unspecified threshold should register as a “data business” in India, the report said, with government bodies also subject to the need to disclose what information they collect and store, and how they use it.

The panel consulted companies such as Amazon, Microsoft and Uber, as well as some international experts, in drawing up the report, it said.

Regulation of non-personal data is just one of several areas for which India looks to hammer out policy, which will affect tech giants in a regulatory trend gathering momentum as nations step up efforts to control data.

India has drafted an e-commerce policy that also calls for a new regulator, while a separate privacy bill under review has upset tech companies. Some data held by the private sector could be drawn on if needed to make policy and back wider social objectives such as healthcare, the panel said.

“The regulation of non-personal data would be driven by the need to unlock the value inherent in this form of data,” it added.