India and Indian organisations are still far behind global peers when it comes to data protection and privacy regulations. But with high profile data breaches, the conversation around data protection and the need for a clear policy framework has grown louder and is a subject that can no longer be ignored.
A report by Omnidyar Network India and Monitor Deloitte finds that not only is data privacy and protection a need to protect organisations and individuals, it will also play a key role in the potential growth of the economy.
“As tech-led investors focused on impact, we believe that technology can drive massive impact in ways that were not possible earlier and have invested in a unique portfolio of enterprises that accelerate the digital journey of India’s “Next Half Billion” to access aspirational services,” says Roopa Kudva, managing director, Omidyar Network India.
“This is why we support research and other entrepreneurial efforts to help inform policies, practices and behaviours by policymakers, businesses and users in good data practices, especially in privacy,” she said. But for this, it is critical for regulators, government, private enterprises, investors, individuals and civil society to come together.
Kudva believes that the key will be with the creation of awareness. She adds that data privacy needs to be a key subject into boardrooms supported by creating policy frameworks.
The report also conducted a survey of consumers and assessed that 60 percent of consumers would prefer to purchase products with companies that have a strong data protection and clear privacy norms.
With heightened regulatory action in the European Union, with the launch of GDPR, most governments have taken the ‘right to privacy’ to the regulatory framework. The current discourse in India around data privacy has largely focused on the legal dimensions of sovereign identity data in context to Aadhar.
However, with the government working on the data protection bill, Kudva believes the country will be more conducive to taking data protection from the current Privacy 1.0 to privacy 3.0.
The report identifies 10 conclusions on the current data privacy landscape:
India is witnessing a personal data revolution: High growth in personal data collection is projected to continue, driven by strong consumer, enterprise and government initiatives.
Personal data is adding value, but also new risks: Loss of privacy, financial losses, discrimination while unethical use can negatively impact enterprises and investors.
Personal data proliferation means that behavioural data is used to create detailed personal profiles: Many may find this unsettling.
Lack of a strong framework in handling data: Private enterprises collect large volumes of data, largely unknown to the consumer as well as share the data with third parties
Data governance regulations and practices not lagging behind data evolution of big data and business models: Pace of development a framework to ethically collect and process slower than the progress of Big Data and AI
India is at a nascent stage of evolution on privacy issues: As Indian consumers do not yet fully recognise the need for privacy, and the personal data protection bill is awaited, enterprises primarily adopt a “tick the box” compliance lens to data privacy and protection.
Foundational principles for an ideal future on privacy: Personal ownership of data, fair value in exchange for use of personal data, informed consent, accountability and transparency
Responsible approaches to big data can lead to innovation-driven profitability and growth: The issue need not be one of a tug-of-war between business opportunity and social acceptability. Looking at ethical and societal aspects of data collection and usage can lead to sustainable success in the marketplace
Collective action towards data privacy and protection: All four stakeholders – enterprises, investors, regulators and civil society -- must collectively join hands and work towards pursuing data privacy and protection
The roadmap for data privacy in India will evolve: From “privacy as compliance”, businesses will focus on privacy to build trust with their customers; eventually new business models will emerge to help individuals assume greater control of their data and narratives.
"We recognise that tech is not a silver bullet - the role of non-tech solutions and government, civil society and media in driving social change is vital, and we seek to actively engage and collaborate with them by the way of this report. As next steps, we’ll be working with our own portfolio to develop a deeper understanding and practical implications of these findings and recommendations,” Kudva added.
The report also has recommended action plans for private enterprises, investors and regulators which will be released as handbooks later this month.
