India’s DPI #3: Empowerment

Empowerment via DPI (Digital Public Infrastructure), that is the next benefit described in Rahul Matthan’s The Third Way. That refers to empowerment of the individual over the data collected about him and what it can be used for. On this front, India has created DEPA (Data Empowerment and Protection Architecture). What is that?

“A consented (consent based) data-sharing framework capable of being applied across various sectors.”

 

An example helps understand it. Matthan takes a vegetable vendor, Rajini. Say, she goes to the wholesale market early every morning, buys ₹25,000 worth of vegetables. Then she brings it to the neighbourhood, and sells it for ₹28,000 per day, netting a profit of ₹3,000 per day. That’s a lakh a month. Thanks to digitization and UPI, there is a digital trail of these transactions. With which she could prove her credibility and success to seek a loan at better terms.

 

The problem though is that her bank transaction record will show many, many transactions of tiny amounts. Not easy to show daily sales volumes of ₹28,000 that way to a potential lender like this. Enter DEPA. It allows users “granular access to the data”, for the bank to then collate those selected entries, digitally sign them and make them available to the potential lender. But such sharing of data can only be done if Rajani authorizes it. DPI (via UPI in this case) allows for folks like Rajani to develop a credit history and the attendant benefits.

 

Sure, many countries can (and do) support such a system. But they are either not fully interoperable or would take forever to become interoperable. DEPA solves this by adding a Consent Manager in between.

The Consent Manager is “blind by design”, i.e., all data requests and flows are encrypted, so they can’t be read by other actors (other than the one for whom it was intended). The first area to have a Consent Manager was the financial sector. Standardized formats, non-banking lenders easily added, and yes, consent based.

 

Such a design also addresses the fear of top-down surveillance (by one large corporation or the government). Because no one entity has all the info. While interoperable, they need user’s consent for data to be shared. And what does get shared is context specific (finance, healthcare, education etc). Decentralizing where different pieces of information are stored makes it impractical and hard for any one entity to get hold of everything. This is the opposite of the centralized US model where Google and Facebook have almost all the data. India’s approach, on the other hand, was designed with privacy and Big Brother concerns in mind.

“This means that instead of looking to impose obligations through the enforcement of laws, compliance can be achieved by getting participants to use those ecosystems.”

The rules are baked into the software stack aka India Stack. Anyone using the stack ends up adhering to the rules just because they have to use the same base layers of the system and its software.

We will go deeper into the design principles of the India Stack next.