DPI Design Principle #5: Privacy

The last pillar of India’s DPI (Digital Public Infrastructure) is privacy. We take that to mean control over who knows what, whether that info can be shared with others, for how long it can be retained etc. Yes, privacy is all those things.

 

But India’s DEPA takes it a lot further, explains Rahul Matthan in The Third Way. It actively seeks to ensure portability (Unlike those private corporations which deliberately have data is in non-standard formats to prevent interoperability). Even better, DEPA has “been designed to support requests for specific items of data”. An example helps. When we apply for say a visa, the issuing country really only wants to know if we earn enough (salary month on month). But the bank statement exposes every transaction. The DEPA framework allows you to select only salary credits be shown and everything else blacked out.

 

The next issue with privacy is consent, i.e., explicit permission of the individual. In theory, the solution lies in seeking explicit consent for each usage of the data. In practice, companies put a 100 page terms and conditions one-time which users can neither read nor understand but have to sign if they want to use the service. DEPA enforces the usage of consent templates whereby the requestor of the data must declare the intended use of the data. These consent templates are standardized by the regulators, different ones for finance v/s health v/s education etc. The intended use declaration then maps to a specified time period for which the data can be used or stored. After that, it must be deleted. Can companies violate this? Sure. But if caught, they face criminal charges or penalties, so that serves as a deterrent to storing data “just in case”. A lot of these ideas are implemented via the software itself, the protocol, rather than relying on individual actors to do the right thing. And since the government owns those central, base softwares, it can roll out those changes one shot, not needing each individual party to make changes or do upgrades.

 

The system has been designed to keep every actor in the equation “blind” by design, i.e., they can only know and access what they need, not everything else that goes on behind the scenes. This drawing explains that with an example: 

In the above pic, the Consent Manager can connect the various parties (lender, borrower, bank) but cannot view the data shared by the bank to the lender. Conversely, the bank doesn’t know the identity of the potential lender to whom the data was sent. And none of these transactions can happen without explicit authorization (via OTP) by the borrower herself.

“No one of them has complete information about the transaction.”