Digital India 2.0: Digital Transformation for Viksit Bharat @2047

Digital Transformation and Economic Growth

Source: Generated using Meta AI by the author

Viksit Bharat @2047 aims to transform India into a developed nation by 2047. Broadly, the vision of Viksit Bharat can be divided into five key thematic areas: thriving and sustainable economy; empowering citizens; innovation, science and technology; good governance and security; and enhancing India’s global standing. As India has achieved remarkable success in digitalising its economy under the Digital India programme, can this programme be reimagined to leverage digital transformation in these areas to achieve the vision of Viksit Bharat?

Digitalization can significantly contribute to a thriving economy. India’s over $400 billion digital economy in itself is a major contributor to the overall economy and its continued growth is essential for achieving the vision of Viksit Bharat. Digital public infrastructure (DPI) like Aadhaar and UPI have revolutionalised online identity authentication and payments and have empowered individuals and businesses. Similar DPI initiatives, public-private partnerships (PPPs) and leveraging Artificial Intelligence (AI) and other emerging technologies can digitally transform sectors like manufacturing, healthcare, education, agriculture, etc. and enhance economic growth.

Improving access to digital services and infrastructure and digital empowerment through initiatives like BHASHINI can enhance digital inclusion, particularly for disadvantaged communities.

Digital transformation is also essential for fostering innovation and technological advancement. It can also be used to promote green technologies and sustainable practices. Smart cities initiative is already showing how scalable digital transformation and PPPs can address challenges like sustainable urban planning and climate change. Digitalisation can also enhance good governance and improve India’s standing as a global leader in sustainable economic growth.

To achieve the vision of Viksit Bharat and create such an economy and society wide impact over the next two decades, the Digital India programme needs to be reimagined as a cross-sectoral mission based on a whole of government and whole of society framework.

This new mission, Digital India 2.0, needs to be architected on certain key foundations for accelerating digital transformation across various sectors. First, it needs to focus on creating world-class digital infrastructure including AI-ready data centres and high-speed connectivity through fibre and mobile reaching all villages. With AI emerging as a key platform technology that would drive transformation across various sectors in future, the need for making India a global hub for AI-ready data centres with high-performance hardware and robust network infrastructure cannot be overemphasized. Expansion of data centre infrastructure would also address the need to ensure data privacy, security and data storage within the country.

Second, digital government and digital services need to undergo a major transformation through a focus on delivering integrated, pro-active and personalised services using AI. This would require building a unified AI stack as a digital public infrastructure (DPI) comprising AI-ready data centres, access to curated data sets, and AI models and applications to enable the ministries and departments to develop their own use cases quickly.

Third, the growth of the digital economy needs to be accelerated so that its share increases to at least 25% of the overall GDP of $30 trillion by 2047 from its present level of around 11%. This requires sustained growth in electronics and semiconductors, IT-ITES, and emerging technologies, such as AI, 6G, quantum computing, IoT, etc. However, a major contribution to the growth of the digital economy is likely to come from digitalisation of the traditional sectors, e.g., agriculture, health, education, financial services, retail, etc. Building a vibrant start-up ecosystem in these domains is essential for achieving this goal.

Fourth, we need to revamp our legal and regulatory framework to support the rapid growth of the digital economy. The major issues that need to be addressed include concerns on data privacy, cyber security, accountability of online platforms including social media, and fairness and transparency of AI algorithms. Though privacy concerns have been addressed through the new Digital Personal Data Protection (DPDP) Act, a full revamp of the 25 year old IT Act needs to be undertaken to address these issues comprehensively.

Fifth, rapid advancements in strategic and emerging technologies with ownership of intellectual property is a sine qua non for becoming a global leader in digital economy. We need to quickly formulate national strategies in these critical areas and fund the flagship initiatives. The IndiaAI Mission is a step in the right direction. However, we need to build our own foundational models in AI to ensure strategic autonomy in this rapidly advancing technology. Similarly, a national policy on data governance also needs to be formulated to ensure easier access to data by all the ministries, states, industry, start-ups, researchers, etc. This would allow rapid innovations to happen in these technologies.

Last, but not the least, skilling and capacity building in digital technologies at all levels is vital for rapid growth in the digital economy. India should rightly aim at becoming the skill and talent capital of the world.

Digital India 2.0, with its focus on a whole-of-government and whole-of-society approach, can accelerate digital transformation across various sectors to achieve the vision of Viksit Bharat.

(The views expressed are personal.)

Featured

A Holistic Approach to Personal Data Protection

After detailed deliberations, the Joint Committee of Parliament on the Personal Data Protection Bill has made several important recommendations, and a debate is currently raging in the country over some of those proposals.

The Committee’s recommendations need to be understood in the broader context of personal data protection and to support the growth of a robust innovation and data-driven digital economy.

The Committee has proposed to include a new clause to include non-personal data within the ambit of the Bill, since renamed as Data Protection Bill, 2021.

This has been done to take a holistic approach towards processing of data, both personal and non-personal, as with the advent of advanced technologies like artificial intelligence and sophisticated data analytics, it may not be too difficult in future to relate anonymised personal data (a form of non-personal data) to individuals.

However, the revised Bill only contains a provision for formulating rules regarding non-personal data at a later stage. Currently, it does not have any substantive provisions in this regard.

A key provision in the Bill to allow certain exemptions to the government data fiduciaries has generated a lot of discussion.

The exemptions under Section 35 of the Bill need to be on a case-to-case basis and only on the grounds of sovereignty and integrity of India, security, etc. which are within the ambit of reasonable restrictions under Article 19(2) of the Constitution.

Further, the reasons for exemptions have to be just, fair, reasonable and proportionate which are as per norms laid down by the Supreme Court in its 2017 privacy judgement in the Puttaswamy case.

The exemptions under Section 12 are narrower and more specific for facilitating better delivery of government services, disaster management, dealing with epidemics and medical emergencies, etc.

Government entities are not exempted from their obligations as data fiduciaries and complying with the rights of data principals in general. There are adequate safeguards in the Bill to prevent any misuse of such exemptions, including oversight by the Data Protection Authority (DPA).

Another recommendation that has generated much debate relates to making social media platforms liable for content hosted on their platforms from unverified accounts and making verification of accounts mandatory.

However, this is only for those platforms that do not act as intermediaries eligible for safe harbour as per Section 79 of the Information Technology Act, 2000. This is only a recommendation that needs to be examined by the government later and is not part of the revised Bill.

Concerns have also been raised over the compliance burden on startups and its impact on innovation.

To address this concern, the Bill places much greater emphasis on compliance by the significant data fiduciaries with additional obligations, such as periodic audits, appointment of data protection officers, etc. Startups and small businesses do not need to comply with these additional obligations as they would not be classified as significant data fiduciaries.

The Bill also provides for the creation of a sandbox to encourage innovation. Processing of personal data of foreign nationals is also exempted under the Bill.

Another key concern is regarding the provisions for data localisation.

Section 33 of the Bill makes it clear that sensitive personal data shall continue to be stored in India, while Section 34 allows its transfer outside India under certain conditions.

The EU GDPR places similar conditions on data transfer to only those countries which fulfil the ‘data adequacy’ norms.

These provisions will make it easier for Indian entities to attract more outsourcing business from abroad as India would fulfil these norms. Storage of sensitive personal data within India would support the growth of hyperscale data centres and an innovative data-driven economy.

Concerns have also been raised over another recommendation relating to norms for testing the integrity of hardware and software on devices.

This has been done to prevent any unauthorised data breaches through insertion of any untrusted hardware. This provision has been added within the scope of functions of the DPA under Section 49 and can be implemented only after the DPA formulates an appropriate code of practice in consultation with the relevant stakeholders.

The concept of privacy has evolved from the Aristotelian concept of idios, meaning “one’s own” or “private”, in ancient times to its modern-day focus on informational privacy.

The Data Protection Bill, 2021 provides a holistic framework for addressing informational privacy that will also help greatly in the growth of a robust digital economy in India.

(The above article appeared in The Economic Times on January 9, 2022 and is available at: https://economictimes.indiatimes.com/tech/catalysts/ettech-opinion-a-holistic-approach-to-personal-data-protection/articleshow/88775228.cms?from=mdr. The views are personal.)

Featured

Traceability vs Privacy: The Real Issue is of Collective Security

Societies have long realised the need to provide collective security for all to ensure sustainable development and prosperity. Providing collective security involved imposing some form of social control to regulate individual and group behaviour through gathering information about individuals. In the modern information age, a good government can ensure collective security through efficient use of information for law enforcement without necessarily encroaching upon individual privacy.

Countries around the world have enacted laws to ensure that such information could be collected easily through various sources to help in achieving the wider societal goal of collective security. The US enacted the Stored Communications Act (SCA) in 1986 to require the internet service providers (ISPs) to provide content and metadata on stored emails to the government agencies under certain conditions. As this law soon became outdated due to rapid technological advances, the US passed the Communication Assistance for Law Enforcement Act (CALEA) that required the telecom companies to redesign their networks to facilitate wiretapping by the government agencies. Later, in 2005, it was expanded to cover ISPs and services like Skype, etc.

UK and Australia have gone even further in enacting laws that require device makers and software developers to provide access to encrypted data. The Investigative Powers Act 2016 and the Investigatory Powers Regulations 2018 in the UK provide sweeping powers to the intelligence and law enforcement agencies to carry out both targeted and bulk interception of internet communications and hack into devices to access data. The Telecommunications Assistance and Access Act 2018 of Australia gives broad powers to the government agencies to require communication service providers (CSPs) to decrypt any communication.

The raging debate in India over the ‘traceability’ provision in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 must be understood in the context of the need for ensuring collective security as a social good. The rules require the significant social media intermediaries to identify the first originator of a message in India for investigation of grave offences relating to the sovereignty and integrity of the country, crimes against women and children, etc. that are punishable with a minimum prison term of 5 years.

Critics have claimed that this provision would seriously undermine privacy and force the intermediaries to break the end-to-end encryption. However, the rules make it very clear that what is required to be provided by the intermediaries is only the metadata about the first originator of the offending message, and not its contents. The message itself needs to be provided by the law enforcement agencies to the intermediaries. There is no attempt to make them break any encryption. With such safeguards built into the rules, the provision cannot be termed as harming privacy. In fact, the rules place much less onerous obligations on the intermediaries for sharing information compared to what several other countries have mandated, as noted earlier.

The law and the evolving jurisprudence in this domain in India have provided strong safeguards for ensuring freedom of expression and privacy. The upcoming Personal Data Protection Bill aims to further enhance this legal framework for protection of personal data and online privacy subject to reasonable checks in the interest of collective and national security. John Locke, a famous 17^th century philosopher and the “Father of Liberalism”, argued in his Second Treatise of Civil Government that individuals needed a strong government to be able to exercise their individual rights and liberties.

There need not necessarily be a trade-off between privacy and collective security. Collective security is just as essential to make people feel safe and allow them to enjoy their privacy protections to function effectively as individuals. The new IT Rules seek to achieve that larger social good.

(The above article appeared in The Economic Times on 10th October 2021. It is available at: https://economictimes.indiatimes.com/tech/catalysts/traceability-vs-privacy-the-real-issue-is-of-collective-security/articleshow/86721078.cms?from=mdr. The views are personal.)

Featured

Unduly Worried Over New Information Technology Rules

In a communication dated June 11, three UN Special Rapporteurs raised serious concerns over provisions of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. They claim that these provisions do not meet the standards of rights to privacy and to freedom of expression as per the Articles 17 and 19 of the International Covenant on Civil and Political Rights (ICCPR) and that some of the due diligence obligations of intermediaries may infringe upon a ‘’wide range of human rights”.

They claim that the terms such as “ethnically or racially objectionable”, “harmful to child”, “impersonates another person”, etc. are broad and lack clear definitions and may lead to arbitrary application. Nothing could be further from truth. These terms have been very well defined and understood in both Indian and international law and jurisprudence. The Rule 3(1)(b) of the IT Rules specifies these terms clearly as part of a user agreement that the intermediaries must publish. They are aimed at bringing more transparency in how intermediaries deal with the user content and are not violative of the UN’s Joint Declaration on Freedom of Expression and “Fake News”, Disinformation and Propaganda.

It must also be mentioned that the Rule 3(1)(d) allows for removal of an unlawful content relating to sovereignty and integrity of India, security of the state, friendly relations with foreign states, public order, etc. only upon an order by a competent court or by the Appropriate Government. This is as per the due process specified by the Supreme Court in the Shreya Singhal Vs Union of India case in 2015. Given the potential of immense harm that can be caused by such unlawful content being freely available online, the time limit of 36 hours for their removal after due process is reasonable. Similarly, the time limit of 72 hours for providing information for investigation in response to lawful requests in writing from government agencies is entirely reasonable. The Rule 3(2) also provides for establishing a grievance redressal mechanism by the intermediaries and resolution of user complaints within 15 days. However, content in the nature of ‘revenge porn’ must be removed within 24 hours. Again, given the potential of immense personal damage that such acts can cause to the dignity of women and children, this time limit is reasonable.

The liability of the Chief Compliance Officer under Rule 4(1) of a significant social media intermediary is not arbitrary. He or she can be held liable in any proceeding only after a due process of law. This has been clearly specified in the rule itself.

The apprehensions about the Rules harming privacy are also misplaced. The Rule 4(2) requires the significant social media intermediaries to provide only the metadata about the first originator of a viral message that may be required for investigation of a serious crime relating to sovereignty and integrity of India, public order, rape, child sexual abuse, etc. that are punishable with a minimum term of five years. This again is after a lawful order is passed by a court or a competent authority and where there is no other less intrusive means of obtaining such information. There is no provision to ask the intermediary to break any encryption to obtain the contents of the message. In fact, the content is provided by the law enforcement agencies to the intermediary. Lawful investigation of crimes cannot be termed as harmful to privacy. Several countries, such as the US, UK and Australia have enacted laws that allow for far more intrusive interception of encrypted messages, including their decryption.

The concerns with regard to media freedom are also misplaced. The section 5 of the UN’s Joint Declaration on Freedom of Expression and “Fake News”, specifically enjoins upon the media outlets to provide for self-regulation at the individual media outlet level and/or at the media sector level. The IT Rules provide for a three-tier system of regulation, in which the government oversight mechanism comes in at the third level only after the first two tiers of self-regulation have failed to produce a resolution. The rules clearly specify the due process for the government oversight mechanism.

India is a vibrant democracy with a long tradition of rule of law and respect for freedom of expression and privacy. The IT Rules aim at empowering the users to enable them to exercise their right to freedom of expression responsibly and prevent the misuse of these platforms for unlawful purposes. The selective interpretation of the provisions of the IT Rules by the UN Rapporteurs is, at best, disingenuous.

(The above article appeared in The Economic Times on July 11, 2021 and is available at https://economictimes.indiatimes.com/opinion/et-commentary/unduly-worried-over-new-rules/articleshow/84323812.cms?from=mdr. The views expressed by the author are personal.)