As with much else, the data protection law will have to create a balance between the conflicting interests (vested in some cases) of several groups, including government, big tech, startups, individuals and civil society. In the case of personal data, positions are polarised. While one group evocatively characterises data as the new oil, another thinks of it as the new toxin. The government is not a neutral bystander either in this discussion, having access to 1.3 billion fingerprints, iris scans and other sensitive personal information. The truth, as ever, lies in between.

So how do we begin to create a framework? As a child, I remember travelling long distances in slow-speed trains, where unknown families came together in the same compartment and exchanged food, gossip, and much personal data. Things were different then. There were no mobile devices, picture and information storage possibilities, and Artificial Intelligence (AI), while around, did not have the feedstock (data) to become intrusive and pervasive. Since the 2000s, India’s digital transformation has been extraordinary, led by the explosion of mobile services. As of end October 2022, India had nearly 1.14 billion mobile phone users and 26.8 million fixed-line users. At an average cost of ₹11 per GB, India is one of the cheapest data markets and among the highest consumers, at 14 GB per user per month. India has witnessed the launch of over 77,000 startups to date, with 85 unicorns.

And this is only the beginning. India needs to continue investing in digital infrastructure, especially in underserved rural areas. Easing regulations is necessary to incentivise foreign and domestic investment in network capacity and new technology such as 5G. Accordingly, the regulatory framework must be strengthened and widened to include reasonable data protection.

To classify data as a national asset while appealing as political rhetoric is not good for commerce. What makes a company Indian? Hundred per cent equity or 10% equity with management control? In an interconnected world, Make in India should not further privilege Indian ownership. Consider the self-serving argument of American big tech that the United States (US) was in danger of losing the AI race to China because the latter had unfettered access to data. It was a futile exercise to dilute data protection in the US. Raising the China bogey sometimes works in the US, just as appealing to nationalism sometimes works in India.

Fortunately, the new Personal Data Protection Bill (this is its second avatar) decouples nationalism and data localisation. Localisation in case of critical information, including for national security, is understandable, but forced localisation to create entry barriers for foreign companies and to boost India’s data storage industry is burdened with dirigisme and destined to fail. The new bill sidesteps the emphasis on localisation, instead adopting a trust-based approach to sharing data with countries identified by the government as reliable. This is a welcome change in mindset, reflecting delayed support for the “data free flow with trust” initiative spearheaded by Japan in 2019 as part of its G20 presidency. Significantly, India has now assumed the G20 presidency, which means this new approach could catapult us to push global data conversations during the year.

Consent and unencumbered government access remain problematic parts of the new bill. Obtaining consent in letter by getting users to sign a few pages of dense legal text without their having the foggiest idea of what they are accepting violates the tenets of informed choice, and is not consent in spirit. For consent to be remotely pro-citizen and pro-privacy, big tech that profits from big data will need to develop a new conscience and look beyond narrow self-interests. Or the regulator will have to impose hefty penalties that act as deterrents. Or both.

Reigning in government temptation for surveillance is equally hard. Government access to data can be justified on several grounds of national interest that can encompass sovereignty, integrity, security, maintenance of public order, and the like. The reasons could be many and to unpick genuine ones from the ones that could violate the fundamental rights of citizens might be next to impossible. However, vague and all-encompassing provisions cause significant harm to human rights. Two years ago, the US imposed import tariffs on steel, citing national security reasons, virtually making a mockery of the World Trade Organization rules. Thus, exceptions must be as specific as possible to temper the government’s immense power.

Finally, attempting to distinguish anonymised and non-anonymised personal data is a Sisyphean task and best avoided. The power of AI puts paid to such theoretical niceties. As we conduct the G20 presidential consultations, our success in creating a citizen-centric digital economy that serves as a beacon for the Global South will depend on a sound personal data protection law. It is advisable not to rush into it.

Rajat Kathuria is dean, School of Humanities and Social Sciences at Shiv Nadar Institute of Eminence and professor of Economics

The views expressed are personal