Data is almost universally recognised as the most valuable economic resource today. Seven out of the top 10 companies globally by market capitalisation are data-centric. In these circumstances, it appears strange that there has hardly been any worthwhile attempt to look at who has economic rights to various kinds of data, and how these rights can be exercised.
The present situation of data’s non-governance in economic terms suits the powerful actors that dominate digitally across the globe – US and Chinese companies and their respective governments. Whoever collects data de facto owns its economic value. So much so that data is increasingly spoken of as the property of the collecting digital companies, whereas the fact is that many court judgments and legal opinions consider property rights over data as extremely dubious. As digital systems build and get entrenched in all sectors, the default economic ownership of data by data collectors would soon be a fait accompli, impossible to reverse.
Some laws and rights do exist around an individual’s personal data, but they are mostly about protection from harm (privacy, for instance). There are no real economic rights to data. If some weak ones may exist for individuals, digital corporations get past them by the simple expedient of obtaining “consent”, which comes as a condition for availing digital services. The other ploy is to anonymise personal data. The moment data is anonymised, it goes beyond the reach of privacy rules, and is essentially in a lawless land.
Non-personal data, which includes anonymised data is increasingly becoming almost as important as personal data. It is the real fuel for artificial intelligence (AI). As Russian President Vladimir Putin put it, whoever controls AI will rule the world. Countries’ AI strategies focus on widespread data sharing as essential to establishing a strong domestic AI industry. This is the only way to avoid complete AI dependence on either the US or China. But what is not made clear is: Why would the digital behemoths, whose monopoly the AI strategies of countries seek to counter, voluntarily share their data to facilitate the process? How can data sharing take place without an adequate legal basis, which requires allocation of various kinds of economic rights to data, including non-personal data?
It is in this context that a committee set up by the government on governing non-personal data, headed by Kris Gopalakrishnan, co-founder of Infosys, recently put its draft report for public consultation. Taking the bull by the horns, the report asserts that non-personal data collected from a particular group or community legally belongs to it. Since the articulation of such a claim requires a legally-recognisable entity, the report posits appropriate representative bodies as trustees for communities or groups.
Such a conception of “community data” makes it legally incumbent upon all data collectors to, if asked for, share the concerned data for the community or society’s benefit. The purpose is to support data/AI start-ups, and the development of necessary data-based public goods. This alone can ensure a robust domestic data and AI industry in India. What the AI strategies of countries/regions like the UK, France and EU just hope for in terms of widespread sharing of data for establishing a strong domestic AI industry, the Gopalakrishnan report plans to actually make possible.
Although the scheme of community data, trustees, etc. in the report may appear somewhat complex, it exists to provide an adequate conceptual and legal basis for data sharing. The actual act of data sharing is much more straight-forward. Any non-personal data collected by a company from outside sources (community/society) is to be considered shareable on demand. Every business that deals with data beyond a certain threshold, whichever sector that business may otherwise be in (hospitality, transport) will have to register as a data business. It will need to list out its major data activities, including the kinds of community data collected. This way, any potential data/AI start-up will easily know what kind of datasets are available and legally shareable. It can accordingly put a request for data sharing. If required, a proposed Non-Personal Data Authority may step in to enforce legitimate data sharing requests.
Non-personal data that arises from, and is about, the society, or the things associated with it (like nature, public infrastructure), rightfully belongs to the society. This, however, should not hinder getting economic value from data but greatly promote it. Access to such data should be widely available in society, and not monopolised by a very few, mostly, global corporations. Instead of basing their business advantage on monopolistic hoarding of society’s data – which should be a “social commons” — digital corporations need to shift it towards innovatively employing the wide availability of such data for the society’s and consumers’ benefit.
It must be highlighted that the report excludes from sharing obligation data that is entirely private to an entity — about processes, materials, etc. It also recognises that if a data collector adds considerable value to collected data, it is entitled to some privileges regarding such data. For sharing of such data, fair and/or market terms may apply.
Apart from economic rights, the report for the first time also provides protection rights for individuals and communities even for anonymised data. This is achieved by putting a justiciable “duty of care” on data collectors to handle and use such data in the best interest of data subjects. The report further lays out technical principles for safe and effective data anonymisation and sharing.
The Gopalakrishnan report is the first policy document globally that thoroughly addresses economic governance of digital society’s most important resource. It will hopefully set the stage for building a strong, and competitively diverse, domestic data/AI industry in India. The report is also likely to kick-start a much-needed discussion on the most important contemporary issue of economic governance of data. The EU intends to bring out an economic-issues-focussed Data Act in 2021. If the Gopalakrishnan report is taken forward in right earnest, with its recommendation for new data legislation, India could steal a march over the EU.
This article was originally published in the Indian Express.