Regulating Non-Personal Data: At A Glance

In this write-up, we briefly discuss the recent developments in India on non-personal data (NPD) and highlight certain issues concerning NPD.

Committee on non-personal data

In September 2019, the Ministry of Electronics and Information Technology (MeitY) formed a committee of experts led by the co-founder of Infosys – Kris Gopalakrishnan, to come up with a framework to regulate non-personal data (NPD). Media reports suggest that the committee is likely to issue a white paper setting out the contours of non-personal data.

The Personal Data Protection Bill, 2019

The Personal Data Protection Bill, 2019 (PDP Bill) states that the Central Government can direct a data fiduciary or a data processor to provide anonymised personal data or non-personal data "to enable better targeting of delivery of services or formulation of evidence-based policies by Central Government".

The PDP Bill was recently introduced in the Parliament and has been referred to a joint select committee of the Parliament.

The Terms

Non-personal data

• does not identify a person or individual
• carries economic value
• NPD is any data that is not "personal data"?

Personal data

• Defined in the PDP Bill
• • definition is broad and vague
  • "inference drawn from personal data for profiling purposes" would also qualify as personal data

Anonymised data

• PDP Bill exempts anonymised data from obligations under the PDP Bill [exception: sharing anonymized data and NPD with Central Government]
• should anonymised data be regulated as NPD?

Note: There is no mention of pseudonymised data in the PDP Bill.

Regulating NPD

• regulation must have an objective
• • privacy and competition concerns?
  • consumer welfare?

Privacy and competition concerns

• ex ante regulations can adversely affect innovation and growth if based on:
• • presumption that entry barriers are being/ have been created
  • presumption of reduced competitiveness
  • presumption against self-correcting nature of markets
  • presumption of harm to consumers
• regulation should address actual harm?

Consumer welfare

• NPD sharing needed for public interest reasons (e.g. policy implementation)
• • legal framework?
  • to be balanced with innovation, growth and commercial considerations
  • • commercial actions can increase consumer welfare

Moot Questions

• Should NPD be regulated?
• Should pseudonymised data be treated at par with anonymised data?
• Framework for gaining access to NPD?
• • regulation;
  • voluntary code; or
  • contractual arrangement.
• How to treat NPD?
• • as a copyright?
  • • question of originality to be addressed
    • hot news doctrine
  • as a trade secret?
  • as a database right?
  • as a new form of quasi-property right?
• Other considerations?
• • trade agreements
  • restrictive covenants entered into by enterprises

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.