Privacy #5: India's Options

In the last part of his book Privacy 3.0, Rahul Matthan presents his view on how the laws on privacy should be framed in India. He points out that the Aadhar horse has been out of the stables for a while now, and has been unifying various databases – from PAN to bank accounts to your mobile number. And it has undoubtedly yielded benefits to all – the UPI system works only because the banks and phone numbers could be connected via your Aadhar ID. The eKYC that Aadhar has enabled cut down the cost of verification from ₹ 1,000 to ₹ 60. In turn, that has reduced the costs of the lending sector, which then opened up the market for low value loans, from ₹ 25,000 onwards to become viable. The potential benefits in the healthcare industry via a system like Aadhar are enormous – one could identify which areas are prone to which diseases; or correlate symptoms to diseases in ways no individual doctor can.

 

That acknowledged, he points out that in the digital age, more and more companies ask for our data. In that context, he says the older model of asking for consent first (which included both seeking permission + declaring the intended use of the data) is proving to be useless. Why? First, they are so long that nobody can possibly read or understand them. Second, if all your contacts are on Facebook or WhatsApp, do you really have any choice but to join in? Third, algorithms can piece info in ways that nobody, not even the company, can imagine when it collects the data.

“We are constantly generating data – through our smart devices, from our interactions with those around us and as a by-product of our participation on the Internet.”

 

What are the options available, if consent has become meaningless? Some people cite the EU’s GDPR (General Data Protection Regulation) as an option, which can impose massive penalties for privacy violations by companies. Matthan is against this idea since data can be hacked; and it isn’t always the fault of the company. How would you prove if it was negligence or a great hacker? Machine learning algorithms aren’t understood by their designers, so is it even fair to penalize the company if those go wrong from time to time?

 

Others propose putting restrictions on what can and cannot be done with the data. But, as Matthan says:

“(Such a move) will ensure privacy but will stunt the growth of the data economy.”

He wants a system where the data controllers can keep innovating, because the benefits of that are all too clear.

 

Matthan suggests a framework for India where the data controllers are given a chance to remediate in a timely manner rather than being penalized immediately. The devil, of course, would be in the details. But that does sound better than a blanket ban/penalty system like the EU’s. Bonds are given AAA, AA ratings etc to signify their risk levels. Perhaps, the government can create equivalent agencies to give ratings to the data controllers – this would give people an idea about which data controllers are more trustworthy than others, he says.

 

It's not an easy topic to solve. Technology does provide huge benefits and:

“It is technology that is its (privacy’s) biggest nemesis.”

Not just in the Internet/Big Data age, as Matthan reminds us, but from the printing press to the camera to the telegraph and the postal system onwards.