## DATA BY PEOPLE, for People

## Source details

**Canonical URL:** [DATA BY PEOPLE, for People](https://www.imf.org/-/media/files/publications/fandd/article/2023/march/tiwari-data-people.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/fandd/article/2023/march/tiwari-data-people.pdf.md)
- [Structured JSON version](/-/media/files/publications/fandd/article/2023/march/tiwari-data-people.pdf.json)

---

### Overview and context
- Innovations in India’s digital public infrastructure have provided a pathway to democratize data and return to people control over their own data.
- Digital infrastructure replaces people- and paper-based processes with code, operating around the clock at low cost and scalable to serve large populations, including marginalized communities.
- A handful of global service providers control large amounts of consumer data, creating asymmetric access that makes it hard for people to leverage their personal data for their own benefit.
- Public digital infrastructure can generate “information capital” from everyday online activities, reducing transaction costs and information asymmetry between borrowers and lenders and lowering reliance on physical collateral.

### India’s digital public infrastructure: design and outcomes
- Strategic design: digital public infrastructure built as rails, each addressing a specific need, integrated into a stack often referred to as the India Stack.
- Publicly designed and controlled, privately implemented model allows the public sector to focus on regulation while private sector handles consumer interfaces and service delivery.
- Key achievements:
  - Verifiable identity (Aadhaar): In 2008, only 1 in 8 Indians had a verifiable identity. By 2009 India rolled out Aadhaar, which eventually reached over a billion people. In less than 10 years, the share of adults with a bank account rose from 25 percent to more than 80 percent.
  - Fast payment system (Unified Payments Interface, UPI): UPI is run by the nonprofit National Payments Corporation of India and is interoperable with online payment services such as PhonePe, Paytm, and Google Pay. At the end of 2022, UPI was processing nearly 8 billion transactions a month, about 70 percent more than the previous year.
  - Broad sector applicability: digital rails used for vaccine distribution, e-commerce, education, health care (real-time data exchange with patient consent), and skills credentialing and verification.

### Data Empowerment and Protection Architecture (DEPA)
- DEPA is a techno-legal, consent-based data-sharing system that operationalizes data rights for individuals.
- Transaction costs and security:
  - Low transaction cost: about $0.07 a data pull, borne by the consumers that seek the service.
  - High level of security; protocols specify which data are requested, retention period, and processors, and allow revocation and auditing of consent.
- Consent-manager architecture:
  - Consent manager knows identities of data users and providers but is blind to data content.
  - Data users (providers) know content but are blind to identity of the counterparty.
  - Separation of consent flows and data flows ensures efficient transfer while respecting privacy.
- Operational impact:
  - Since the system went live in India’s financial sector last year, some 1.1 billion individual accounts on the system can now reap benefits from their data.
  - Individual experiences show significant reduction in time to access credit—from months to days.

### Challenges and legal foundations
- Absence of a national data protection law initially led to development of the consent framework under the central bank’s regulatory supervision rather than a data-protection specialist.
- India’s new draft law specifically references the technical and regulatory mandate of the consent manager and will play a critical role when enacted in shaping DEPA’s regulatory and supervisory foundations.

### Data governance lessons and policy recommendations
- Core principles drawn from India’s experience:
  - Citizens should have the right to access and use their data, wherever it resides, for their own benefit.
  - Rules for access and use of data should be practical and clear and allow users to access and share their data with consent, at reasonable cost, and in a manner that respects privacy and security.
  - The system must be digital and data protection principles integrated into the technology, given the large quantity of data and the need to keep it safe with low transaction costs.
- International coordination and standards:
  - Senior policymakers from multiple jurisdictions have affirmed reinforcing privacy and data-driven innovation through open, interoperable technical protocols.
  - Regional trade initiatives (Digital Economy Partnership Agreement; Indo-Pacific Economic Framework for Prosperity) have begun integrating data governance elements.
  - Global governance mechanisms are needed to support open technology standards, regulatory coordination across stakeholders, interoperable accreditation, and satisfactory governance of cross-border transactions.
  - It is too early for common global standards, but informal and institutional conversations have begun and should be promoted to expand best practices in data governance.

*Source: Tiwari, S., S. Sharma, S. Shetty, and F. Packer. 2022. "The Design of a Data Governance System." BIS Paper 124, Bank for International Settlements, Basel.*

---


_Source: https://www.imf.org/-/media/files/publications/fandd/article/2023/march/tiwari-data-people.pdf_