The State as India’s Largest Data Fiduciary

Introduction

The Digital Personal Data Protection (DPDP) framework is being presented primarily as a compliance challenge for organisations that collect and process personal data. Businesses are already reviewing privacy notices, consent mechanisms, retention policies, contracts and security practices in anticipation of the enforcement.

However, there is one data fiduciary that deserves considerably more attention: the State.

Today, and especially with the expansion of Digital India, huge amount of personal data of citizens is collected and processed across all levels of government. In many cases, there is a tendency towards data maximisation, where information beyond what may be necessary for the stated purpose is also collected. For citizens, consent in such situations can be largely formal: provide the information requested, or risk being unable to access the service.

As the government looks towards private entities to comply with the DPDP framework, it also has an opportunity to look inward. The State, as a Data Fiduciary across its many institutions, can lead by example by demonstrating what responsible collection, processing, sharing, retention and protection of personal data should look like.

But before that, who exactly is this Data Fiduciary? And why is the State the largest one?

Ecosystem of Data Fiduciaries

Under the DPDP framework, a Data Fiduciary is the person or organisation that determines the purpose and means of processing personal data. In simple terms, it is the entity that decides why personal data is being collected or processed and how it will be used. The DPDP Framework places the primary responsibility for complying with the obligations under the framework on the Data Fiduciary, even where some of the processing is carried out by another entity (called Data Processors) on its behalf.

The State in itself, as a whole, is arguably the largest ecosystem of data fiduciaries. From Electoral Rolls to Public Distribution System, to FASTag data to health & vaccination records, government institutions across central, state, and local level, collect and process personal data for a wide range of purposes. These datasets are not necessarily held in one place. They are distributed across departments, agencies, platforms and local bodies, with different purposes, systems, and data practices.

The challenge, therefore, is not merely the volume of data, but equally its fragmentation and movement across systems. An average Indian who moves between places can have his personal data scattered across regions and levels of government. Fragmentation also makes it difficult (nearly impossible) for citizens to keep track of what and where their data resides, why it was collected, who has access to it, and whether it is being shared or reused for purposes beyond the original transaction.

Therefore, the state has an exemplary opportunity to demonstrate what responsible data stewardship looks like, and to set a benchmark for private entities to follow.

Data Stewardship

Take the Election Commission for instance, it is supposed to publish draft electoral rolls containing personal data (which in most cases, is now collected digitally) for inspection and scrutiny. This is mandated by laws and specifically by the Registration of Electors Rules. This may fall under legitimate uses defined in section 7(c) of the DPDP Act. However, the question arises: Does the mere existence of a law mandating disclosure justify the extent of personal data exposed, or should the principles and spirit of DPDP guide the state? The more immediate question is whether government departments have sufficiently clear rules governing the lifecycle of the personal data they hold?

Similar to Citizen Charters adopted by departments, departments could also put out Personal Data Charters, clearly outlining all the personal data they collect and outlining purpose, access, sharing, retention, etc for all of them. On its part, Central Government could develop a Government Data Fiduciary Standard (GDFS) which could act as a common baseline for departments and public authorities at the Union, State and local levels to identify, classify, process, share, retain, secure and delete personal data.

Government Standard

By establishing Government Data Fiduciary Standard (GDFS), the state could translate DPDP obligations into a common operational standard for the entire government setup. The below proposed GDFS would be intended to support government departments in this.

The GDFS could potentially cover:

1. Data Inventory: A clear inventory of all personal data collected, processed and stored by the department, along with the purpose for which it is being used.
2. Data Classification: The data inventory must be mapped to a clear classification of personal data based on sensitivity, risk and potential harm to the individual if misused or disclosed.
3. Purpose: The purpose for which each category of personal data is collected and used, including any permitted secondary use.
4. Data Minimisation: A clear explanation of why the data collected is the minimum required for the stated purpose.
5. Access Control: Clear policies on who has access to personal data, under what circumstances, and what technical and organisational measures are in place to enforce such access.
6. Sharing: A clear record of the circumstances in which personal data may be shared across public institutions. Each use case should, where practicable, identify the purpose, the data being shared, the institution with which it is shared, and the basis for such sharing. The department should similarly document what personal data it requests from other departments and for what purpose.
7. Data Lineage: A complete record of how personal data moves across departments and systems, including its origin, purpose, destination, recipient, subsequent sharing and eventual deletion. For example, where data collected by Department A is shared with Department B, the movement and subsequent lifecycle of that data should be traceable.
8. Data Processors: A clear record of entities processing personal data on behalf of the Data Fiduciary, along with their obligations, contractual commitments and data-security practices.
9. Retention: The period for which each category of personal data is retained, the justification for that period, and the circumstances under which it may be retained beyond the prescribed period.
10. Deletion: How and when personal data is deleted, including automated deletion mechanisms, applicable exceptions, and mechanisms through which a citizen may request deletion where such a right is applicable.
11. Public Disclosure: What personal data may be disclosed publicly, the purpose and justification for such disclosure, and what measures are used to prevent unnecessary disclosure.
12. Consent Management: How consent is obtained where consent is the applicable basis for processing, what information is provided to the citizen, how consent may be withdrawn, and what mechanisms exist for giving, refusing and withdrawing consent.
13. Breach Management: Technical and organisational measures used to protect personal data, including incident detection, breach response, containment, notification, remediation and post-incident review.

A model Digital Personal Data Charter could be appended to GDFS for departments and authorities to adopt and adapt to their specific context. This charter could be made available on the department’s website, and should be easily accessible to citizens.

However, these standards and charters will only be effective if they are implemented, monitored and enforced. Therefore, a clear Compliance & Audit Matrix (CAM) should be developed to ensure that departments are adhering to the GDFS and DPDP obligations.

Compliance & Audit Matrix (CAM)

Compliance with DPDP obligations is a continuous monitoring exercise. In terms of public authorities, it also includes public auditing and reporting. A well-defined Compliance & Audit Matrix (CAM) should be developed to ensure that departments are adhering to the GDFS and DPDP obligations.

A score-card matrix (similar to what we have for Proactive Public Disclosure for RTI) could be developed for a clear and well defined compliance framework. This could later be used by the public and private auditors to assess, audit, and report.

Way Forward

Government-Wide Data Readiness Assessment

All government departments and public authorities should undertake a pre-DPDP readiness assessment before the enforcement provisions come into effect. This could initially be undertaken as a self-assessment, followed by peer review or independent audit for high-risk departments and systems.

Identify High-Risk Government Data Systems

The first phase should prioritise systems involving large-scale or high-impact personal data, including electoral, health, welfare, financial, education, identity and law-enforcement databases. These systems should undergo enhanced assessment before lower-risk systems.

Establish a Common Government Data Governance Function

The Central Government could designate an appropriate nodal authority to develop, maintain and periodically update the GDFS, issue implementation guidance, coordinate with States and local governments, and publish sector-specific guidance where required.

Create a Government Data Governance Community

Given the scale and diversity of government data systems, implementation should not be entirely centralised. A structured network of Union, State and local government data-governance officials could facilitate sharing of practices, templates, audit methodologies and lessons from implementation.

Pilot Before Scaling

The GDFS and CAM could first be piloted across a representative set of Union, State and local departments. The lessons from these pilots could then be incorporated before the framework is adopted government-wide.

Publish an Annual Report

For effective implementation of the DPDP framework, a composite Government Personal Data Protection Audit Report should be placed before Parliament and the respective State Legislative Assemblies. This would enable lawmakers, civil society and citizens to actively assess government data practices, identify systemic gaps and intervene where necessary.