The draft Non-Personal Data (“NPD”) governance framework envisages three key roles in the ecosystem i.e. data principal (to whom the data relates to), data custodian (undertakes collection, storage, processing and use of NPD) and data trustees (through which data principal/community will exercise its rights). Data trustees have been constituted for the purpose of exercising rights and control by the community against any collective harm that may arise. However, the concept of data trustee in the digital ecosystem seems misplaced.
First of all, the committee of experts has not been able to clarify as to how these trustees will be identified or the eligibility criteria for such trustees. The framework only mentions that the closest and most appropriate representative body for the community should ideally be performing the role of data trustee. It fails to take into consideration that due to this, there can be multiple data trustees having the rights over the same NPD. Secondly, the framework does not provide the rights and liabilities of the data trustee which creates ambiguities as to its accountability and its role in the ecosystem. The report has assumed that data trust and data trustee will always function in the best interest of the community which is not the case. There is a need for creating walls within which the data trustee should perform their function. There is a need for accountability mechanisms and transparency requirements for the players in the NPD ecosystem.
Further, the report also suggests that the government can assume the role of data trustee as well as data custodian, however, it is pertinent to note here that both are expected to perform different functions and the trustee has an obligation of collective bargaining function which shows clear conflict of interest. How can the government exercise its right against the data custodian if they themselves are performing the role of data custodian.
Therefore, it is important to clarify the roles and responsibilities of the data trustee as well as data trust within this framework and not leave it up to the legislation to decide. The data trustee will play a crucial part in the ecosystem and it must be transparent and accountable for the community data it collects.
Ayush Tripathi is a Project Associate with The Dialogue and can be reached at ayush.tripathi@thedialogue.co.
