This policy paper is the result of a workshop organised jointly by the Tilburg Institute of Law, Technology and Society, Netherlands, the Centre for Communication Governance at the National Law University Delhi, India and the Centre for Internet & Society, India in January, 2023. The workshop brought together a number of academics, researchers, and industry representatives in Delhi to discuss a range of issues at the core of data governance theory and practice.

---

Click here to download the report

Executive Summary: Making Data Governance Work for Data Justice and Empowerment in India and the European Union

DATA IS NOT (ONLY) PROPERTY

• Data possesses multiple forms of value, each relevant to business, government and society in a different way. However, the governance efforts getting traction nationally are largely driven by the private sector to promote market-centric models of governance where there is emphasis placed on data as an economic commodity
• The data protection framework and the right to privacy have been co-opted to resolve market related concerns, which effectively excludes the agency of individuals and groups.
• As well as an economic good, data also embodies users’ labour, and relations between individuals, groups and institutions. However, the legal regimes seek to give it a definite structure without accounting for competing interests in data regarding representation and justice. This impacts access to justice, and allows capture by powerful stakeholders.
• The lack of a specific non-personal data framework in India allows it to observe the enforcement experience in the EU: particularly the value of thinking in personal/nonpersonal data binaries, and GDPR’s data collection and consent frameworks, where these do not work to protect people, grant access to justice or promote a fair and equitable datafied society (i.e. data justice).

DATA MUST BE GOVERNED FOR BOTH ECONOMIC AND COMMUNITY INTERESTS

• Procedural safeguards for the rights of individuals and groups will never be enough by themselves given the power asymmetries in the digital economy: community centric and community-driven mechanisms beyond the institutional perimeter are essential to remedy and challenge injustice in the global digital economy.
• However, institutions and procedural frameworks can definitely be a part of a composite solution if deployed effectively. Multi-dimensional justice and accountability mechanisms that include top-down and centralised institutional action as well as diffused, participatory approaches are required.

GOVERN FOR CONTESTABILITY AT ALL LEVELS

• Building an efficient data economy must be balanced by contestability so that data serves the broader public: good governance requires fair and equitable access to justice for every individual to pursue legal remedies. Ensuring this access to justice requires both strengthening legal institutions and meaningfully empowering people by ensuring that they are able to actively participate in problem-solving.
• Access to justice dispensation mechanisms should be made accessible to all individuals regardless of their socio-economic status and identity. An effective enforcement framework is one that works with affected communities to identify problems and craft appropriate measures for harm prevention and redress.
• Enabling people to identify harms and safely navigate the digital space is essential to preventing harms and minimising risks.

DESIGNING FIT-FOR-PURPOSE GOVERNANCE INSTITUTIONS IN INDIA

• The formal enforcement system is slow, complex, and expensive, leading to preference for informal dispute resolution mechanisms. Lok Adalats and Gram Nyayalayas have been under utilised and should be leveraged to support and strengthen formal institutions, because they can help to build trust and confidence and thus make engagement with formal mechanisms less of a hurdle.
• Data protection legislation and enforcement are necessary but insufficient: local-level access points for grievance redressal are essential.
• Establishing the Data Protection Board of India as a quasi-judicial body is insufficient without an accompanying independent regulator. An independent regulator would typically undertake functions such as monitoring, awareness generation and standardsetting, and have a mandate to protect people’s interests through investigations and suo-moto actions.
• The current structuring, limited functions, and lack of independence of the DPBI may reinforce reliance on approaching traditional appeals courts through writ jurisdiction.This will be inefficient and ineffective because High Court judges often lack the technical expertise to effectively adjudicate data protection issues.
• For accessible and affordable enforcement, the DPBI must build a regional presence through both online and physical offices, and must communicate and collaborate with local-level access points if vulnerable individuals are to have access to grievance redressal and resources for addressing digital harms.