Monetising data: For whose good?

Karnataka’s Open Data Policy opens up a Pandora’s box of concerns for public interest and citizen rights

Last week, the Government of Karnataka (GoK) notified its Open Data Policy (ODP) to open up government-held personal and non-personal datasets for “innovation, co-creation and research”. The government’s logic fits very much into the current global norm. Open data thinking is based on the rationale of value-creation through public datasets in a wider context in which data is seen as a strategic asset. The GoK policy toes this line, with provisions on “reasonable” user fees, citizen privacy safeguards and public security.

The data monetisation model classifies all personal and non-personal data through an inter-departmental decision-making process into three categories: ‘shareable’, ‘sensitive’ and ‘restricted’ data. It is only shareable data that can be monetised, and even here, any personal data that is included must be anonymised. Only body-corporates with a registered office in India can buy access rights to these datasets. Further, they can use those datasets only for the original purpose approved and cannot transfer them to third parties.

A closer examination opens up a Pandora’s box of concerns for public interest and citizen rights. Firstly, contrary to what the architects of the policy imagine, anonymisation is no panacea to addressing all risks to privacy. With the Personal Data Protection Bill still languishing in Parliament, the lack of a legally-determined threshold for anonymisation, and the absence of a Data Protection Authority present grave risks to citizen privacy. It is not unlikely that easily reversible pseudonymisation (a simple switching of names in the original data set with an alias or pseudonym) may be passed off as adequate anonymisation by private sector entities, as in the case of the infamous (and now suspended) health data deal between Palantir and the UK’s National Health Service. This also means that any willful or inadvertent re-identification of individuals in data processing cannot be dealt with through legally enforceable penalties.

Secondly, Karnataka’s ODP suffers from the worst of new public management thinking, focused exclusively on revenue-maximisation. Public (interest) innovation in data is not served by a simplistic, pay-to-use yardstick – even with the best privacy and security safeguards. Let us take the case of public transportation data of Bengaluru city that both Uber and a local drivers’ cooperative want to access or have use for. The latter may be unable to pay the user fee set by the government. On the other hand, Uber, with its treasure trove of data about the city’s spatiality and citizens’ movement, will be best positioned to harvest this public dataset for deepening and sharpening its already astute machine learning models. Without a vision of public data as a vital public policy instrument that can incentivise innovation by smaller players, there is a real risk that open public data will end up servicing a few dominant players of the platform economy who have already locked up the social commons of data. The State is not the ‘owner’, but a trustee of the public datasets that it holds. It has a fiduciary duty to leverage the public data commons for socio-economic equity.

The EU’s proposed Data Governance Act clearly highlights that though public sector bodies should be able to charge fees for the re-use of data, it is equally important to make the data available at lower or no cost for certain categories of re-use, such as non-commercial re-use, or re-use by small and medium-sized enterprises. Along the same vein, the EU Open Data Directive 2019 has emphasised that high-value datasets essential for public interest innovation should be made widely accessible.

In a developing country context, the public interest and civic innovation aspects of open data must be taken one step further. Going back to our example, it is vital that any open data policy not only privileges accessibility for the local drivers’ cooperative, but also works to ensure that public data re-use by platform behemoths like Uber does not undermine fair competition. The entire bouquet of data governance policies must be geared towards socio-economic equity. For instance, the value of public datasets can be enriched through rules for compulsory licensing of AI models built on public data – especially by big companies. The economic resource regime for the data commons thus needs fresh thinking about both publicly and privately held data.

India’s MeitY-constituted expert committee on non-personal data also takes the view that government agencies are only custodians of the aggregate data that is owned by the community that generated it. It is this trusteeship approach that could have taken Karnataka’s ODP closer to its purported objective of democratising data for public good. Much preparation is needed for various departments to grasp the governance imperatives for citizen-centred data innovation. The GoK will be well advised to go back to the drawing board and rethink how its ODP can bring sustainable benefits to the local economy and society.

(The writers are with IT for Change, an NGO that works on digital technologies and social justice)