Emerging technologies need a Digital India Act that balances the ends of innovation and regulation

As one of the fastest-growing markets for digital consumers, with over 692 million internet users, India is well positioned to become a trillion-dollar digital economy. To achieve this, the DIA must carefully regulate emerging technologies.

Emerging technologies are creating new markets, giving rise to the concept of “the unknown”. The coming of ChatGPT threatened traditional tech companies like Google and Microsoft to quickly embrace LLMs and add a “Bard” and a newer version of ChatGPT to their respective search engines, Google and Bing. Most new and emerging technologies undergo a significant period of trial-and-error, adapting before discovering the risks they pose.

Locating Liability

Traditional liability laws such as Section 66 and its sub-sections in the Information Technology Act, 2000 list a series of penalties for different scenarios. However, they are vastly inadequate for regulating emerging technology. For instance, if a 3D printed house collapses, it is challenging to determine who should be held responsible — the supplier, the manufacturer of the house parts, or the manufacturer of the 3D printer. Similarly, with decentralised and anonymous technologies like blockchains, determining liability in case of a breach becomes difficult.

AI poses another set of liability questions.

While AI systems act autonomously, the objectives of AI models are typically set by humans. If a healthcare worker relies on an AI-based tool to treat a patient and an injury occurs, it raises the question of who should bear the liability for the treatment injury. The use of AI-powered tools such as ChatGPT and Bard in workplaces can create liability.

Consider an employee accidentally leaking confidential data to these tools. Current legal frameworks are unclear whether the breach is due to the employee’s action or due to the company’s choice of the tool.

Regulatory Sandboxes

A regulatory sandbox is a controlled environment established by regulatory authorities to enable testing and experimentation of innovative technologies, products, services, or business models. It strikes a balance between enabling innovation and managing potential risks.

Due to the complex nature of new and emerging technologies, implementing a regulatory sandbox model can address the questions of "what to regulate," "when to regulate," and "how to regulate" through the application of adaptive and outcome-based, risk-weighted, and collaborative regulatory principles.

In 2019, the Reserve Bank of India (RBI) enabled a sandbox framework to regulate FinTechs. It enables regulators to develop innovation-enabling regulations and helps users test product viability before a mass launch. It also brings financial inclusion, reduces costs, and improves access to financial services.

It is an inclusive model since the threshold to enter is Rs 5 million. The RBI has also set up a FinTech Unit(FTU), an empowered committee that oversees the sandbox process and facilitates collaboration. The Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Authority of India (IRDAI), and Telecom Regulatory Authority of India (TRAI) have also embraced the concept.

Learning From Other Jurisdictions

Since sandbox models are at a nascent stage, some lessons can be drawn from Germany and Singapore. Singapore's Land Transport Authority established a sandbox for autonomous vehicles. All test Automotive Vehicles (AVs) in Singapore were required to log travel data.

This data collection enables thorough accident investigations and supports liability claims. It provides authorities with information about AV operations, ensuring accountability and building trust, leading to public acceptance and positive outcomes.

On the other hand, Germany faced challenges due to poor infrastructure and public perception, highlighting the need for adequate funding and addressing safety and privacy concerns.  While testing its autonomously driven cars, German authorities also roped in the insurance sector to understand the impact of driverless cars in future claims.

To build an effective regulatory sandbox model in the DIA, it must be inclusive and cater to startups. It should offer clear regulatory guidance tailored to each product or service, and not exclude small and emerging tech businesses. Stakeholder feedback, including consumers, regulators, and industry experts, should be gathered. The sandbox should undergo evaluation to ensure its effectiveness in fostering innovation and managing risks. The framework should also identify which sectors of emerging technologies are being used the most.

A regulatory sandbox ensures emerging technologies can grow with lesser restrictions and compliance burdens. The DIA is a landmark piece of legislation that has the potential to change the face of the Indian tech industry and become a global leader in the tech sector.

Oleina Bhattacharya is a Programme Associate with DeepStrat, a New-Delhi based Think Tank and strategic consultancy. This is the fourth in a series of articles on the proposed Digital India Act. Views are personal, and do not represent the stand of the publication.