Data Privacy | Strengthening consent will make India a global leader in individual-centric data economy

Subhashish Bhadra and Tariq Musthafa

In the first week of September, India told a bold leap towards empowering Indians with their data by launching the Account Aggregator (AA) system to help consolidate their financial data in one place. Every Indian can then choose to share this data with other businesses, such as insurers and lenders, thus enabling faster onboarding and more customised products. Eight of India’s largest banks have signed on, which makes the system accessible to most Indians.

The importance of this moment cannot be overstated. While Europe and the United States are struggling to push through laws with the idea of users owning their data, India has gone a step further and made it possible through technology. In future, this system could be extended to areas such as healthcare and telecom, thus unifying large parts of an Indian’s digital footprint in one place — right under their control. The AA system is, therefore, an inflection point in the remarkable journey that the digital Indian has taken in the past few years.

User consent lies at the centre of the system’s effort to empower Indians. Data can be transferred from one business to another only if the user consents to it. When a business initiates a transfer request, the individual receives details about what data is being sought, by whom, from whom, for what duration, at what frequency, and for what purpose. They can then sign the consent electronically — a record is generated in the system and can be revoked later. This also makes the entire system transparent, and auditable.

Since user consent is the fulcrum around which the AA system revolves, it is important to get it right. However, consent is a complex issue, both conceptually and practically.

When the bargaining power between a business and individual is lopsided — for example, if there is only one major bank in an area, or if the user only has a few minutes to decide whether to approve a data transfer request — it calls into question whether the consent given is truly meaningful. Moreover, individuals may not be able to parse through technical, and legal information to truly understand what they are consenting to.

Therefore, we need to test innovative ways to allow individuals to better understand how their data is being handled. Online lab tests conducted by the Centre for Social and Behaviour Change (CSBC) at Ashoka University and the Busara Center for Behavioural Economics with 5,547 Indians provide some insights that can be explored further.

The research found that forcing individuals to stay on the privacy policy for a few minutes had the strongest impact on their understanding of what they are consenting to. Once this happened, people also trusted the business more, and were willing to share more information. Therefore, even though this mandatory ‘cool-down period’ may introduce friction in the AA processes, that may be compensated by greater trust, and participation in the system.

The research also found that a ‘privacy rating’ allowed people to differentiate between businesses, and share more data with those that had a higher rating. In practice, such a rating could be based on factors such as compliance with data privacy laws, incidents of data breaches, and robustness of cybersecurity practices. Sahamati, the self-organised collective of Account Aggregators, could be the custodian of this rating system.

These top-down interventions are necessary, but not sufficient. To create a system where individuals are equal participants, we need individuals to actively manage their data, which requires behavioural change. The aforementioned research has a remedy for this too — it found that Indians spend more time reading a privacy policy when presented with a message such as ‘over 70% of users spend 5 minutes to read our privacy policy’ or ‘80% of Internet users do not read privacy policies, exposing themselves to avoidable risk’. The Account Aggregator system could mandate that any consent be preceded by such a message, so that users spend time to understand what exactly they are consenting to.

These examples show that it is possible to equip and incentivise individuals to exercise greater control over their data. Through the Account Aggregator system, India has already laid the technological foundation for a frictionless, and empowering data economy. With additional focus on meaningful consent, we can push the boundary on inclusivity, and privacy, thereby cementing India’s position as a global leader in an individual-centric data economy.

Subhashish Bhadra (Twitter: @Subhashish30) is Principal, Investments, and Tariq Musthafa, is Associate, Investments at Omidyar Network India. Views are personal and do not represent the stand of this publication.