In this write-up, we briefly discuss the recent developments in India on non-personal data (NPD) and highlight certain issues concerning NPD.

Committee on non-personal data

In September 2019, the Ministry of Electronics and Information Technology (MeitY) formed a committee of experts led by the co-founder of Infosys – Kris Gopalakrishnan, to come up with a framework to regulate non-personal data (NPD). Media reports suggest that the committee is likely to issue a white paper setting out the contours of non-personal data.

The Personal Data Protection Bill, 2019

The Personal Data Protection Bill, 2019 (PDP Bill) states that the Central Government can direct a data fiduciary or a data processor to provide anonymised personal data or non-personal data "to enable better targeting of delivery of services or formulation of evidence-based policies by Central Government".

The PDP Bill was recently introduced in the Parliament and has been referred to a joint select committee of the Parliament.

The Terms

Non-personal data

  • does not identify a person or individual
  • carries economic value
  • NPD is any data that is not "personal data"?

Personal data

  • Defined in the PDP Bill
    • definition is broad and vague
    • "inference drawn from personal data for profiling purposes" would also qualify as personal data

Anonymised data

  • PDP Bill exempts anonymised data from obligations under the PDP Bill [exception: sharing anonymized data and NPD with Central Government]
  • should anonymised data be regulated as NPD?

Note: There is no mention of pseudonymised data in the PDP Bill.

Regulating NPD

  • regulation must have an objective
    • privacy and competition concerns?
    • consumer welfare?

Privacy and competition concerns

  • ex ante regulations can adversely affect innovation and growth if based on:
    • presumption that entry barriers are being/ have been created
    • presumption of reduced competitiveness
    • presumption against self-correcting nature of markets
    • presumption of harm to consumers
  • regulation should address actual harm?

Consumer welfare

  • NPD sharing needed for public interest reasons (e.g. policy implementation)
    • legal framework?
    • to be balanced with innovation, growth and commercial considerations
      • commercial actions can increase consumer welfare

Moot Questions

  • Should NPD be regulated?
  • Should pseudonymised data be treated at par with anonymised data?
  • Framework for gaining access to NPD?
    • regulation;
    • voluntary code; or
    • contractual arrangement.
  • How to treat NPD?
    • as a copyright?
      • question of originality to be addressed
      • hot news doctrine
    • as a trade secret?
    • as a database right?
    • as a new form of quasi-property right?
  • Other considerations?
    • trade agreements
    • restrictive covenants entered into by enterprises

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.