Data by People, for People

Source details

India’s approach to data governance neither favors excessive state intervention nor is exclusively laissez-faire; it combines public design and control with private implementation to encourage innovation.
Digital public infrastructure can democratize data and return control to individuals, enabling data-driven access to finance and broader public services.

Strategic design as rails, each addressing a specific need, forming an integrated stack (India Stack) that can scale to serve over a billion people in 29 states and 22 languages.
Publicly designed and controlled but privately implemented model:
- Public sector focuses on regulatory framework.
- Private sector handles consumer interface and service delivery.
Outcomes:
- Reduced inclusion gaps.
- Public sector moves away from end-to-end delivery responsibility in payment, education, and health sectors.

In 2008, only 1 in 8 Indians had a verifiable identity.
In 2009, India rolled out Aadhaar, reaching over a billion people, including those who could not read or write.
Financial inclusion impact:
- Share of adults with a bank account rose from 25 percent to more than 80 percent in less than 10 years.
- One rough estimate suggests it would have taken nearly 50 years to achieve the same rise in inclusion under traditional growth processes.

Unified Payments Interface (UPI) run by the nonprofit National Payments Corporation of India; interoperable with PhonePe, Paytm, Google Pay.
Characteristics:
- Voluntary digital public infrastructure run jointly by regulator and regulated entities.
- Cost of running the payments rail borne by participating commercial banks.
- Network benefits (instant transfers, near-zero charges) without monopolistic disadvantages.
Usage statistics:
- At the end of 2022, UPI was processing nearly 8 billion transactions a month, about 70 percent more than the previous year.
Economic role:
- Reduced need for cash economy and supported higher economic growth.
- Helped blunt the worst effects of COVID-19 lockdowns.

Health: digital rails enable data sharing across hospitals, diagnostic laboratories, and research institutions (with patient consent) to improve diagnosis and treatment via comprehensive patient records.
Skills: digital rails enable exchange and certification of skill credentials, empowering mobile workers.
Education: digital rails complement existing practices to deliver personalized learning outcomes at national scale.
Pandemic lessons: vaccine development/distribution, e-commerce, and digital education demonstrated system-wide benefits.

DEPA: a techno-legal, consent-based data-sharing system integrated into digital public infrastructure and private-market innovation.
Features:
- High level of security and low transaction costs (at about $0.07 a data pull), costs borne by consumers seeking the service.
- Consent specifies which data are requested, retention period, and processors; allows revocation, auditing of transactions, and data security requirements.
- Consent manager architecture separates consent flows from data flows:
- Consent manager knows identities but is blind to data content.
- Data users/providers know data content but are blind to provider identity.
- Example: a bank may share spending history for a credit application without knowing the request’s purpose or recipient identity.
Impact:
- Since going live in India’s financial sector last year, some 1.1 billion individual accounts on the system can now reap benefits from the value of their data.
- Individual experiences show credit access time reduced from months to days (example: small business avoided bankruptcy by raising financing using readily shareable financial data).

Absence of a national data protection law led to development of the consent framework under central bank supervision rather than a data protection regulator.
India’s new draft law references the technical and regulatory mandate of the consent manager and, when enacted, will shape DEPA’s regulatory and supervisory foundations.

Key principles suggested for other countries:
- Citizens should have the right to access and use their data, wherever it resides, for their own benefit.
- Rules for access and use should be practical, clear, permit consent-based sharing at reasonable cost, and respect privacy and security.
- Systems must be digital with data protection principles integrated into technology to handle large data volumes securely and with low transaction costs.
International developments:
- Policymakers from Australia, France, India, Japan, Rwanda, the Bank for International Settlements, and the European Commission have deliberated data empowerment approaches and emphasized privacy plus data-driven innovation via open, interoperable technical protocols.
- Data governance appears in new regional trade initiatives: the Digital Economy Partnership Agreement (Chile, New Zealand, Singapore) and the Indo-Pacific Economic Framework for Prosperity.
Global needs:
- Digital public infrastructure and data empowerment will be central themes of India’s G20 presidency in 2023.
- A global governance mechanism is needed to support open technology standards, regulatory coordination, interoperable accreditation, and satisfactory governance of cross-border transactions.
- It is too early for common standards, but conversations about broad parameters have begun and should be promoted.

Design digital public infrastructure as interoperable rails with privacy integrated into technical design.
Enable consent-based data-sharing architectures with clear, practical rules for access and use at reasonable cost.
Develop regulatory frameworks that balance public oversight and private implementation to foster innovation and inclusion.
Pursue international coordination on open technology standards, regulatory cooperation, and accreditation for cross-border data governance.

Source: Data by People, for People — F&D Magazine, IMF

F&D March 2023: DATA BY PEOPLE, for People
- F&D March 2023: DATA BY PEOPLE, for People (Markdown version)
- F&D March 2023: DATA BY PEOPLE, for People (PDF)