80% MSMEs and Startups oppose Non-Personal Data Policy in its current form; Believe permitting large businesses and platforms to sell aggregate data for a price will not help MSMEs and startups
- • Believe large platforms will buy each other’s data at high prices making it unaffordable for MSMEs/Startups to purchase aggregate data; Just 20% believe this policy will help
- • 72% small businesses believe before Government mandates business to share aggregate data it should share its own aggregate data (municipal, health, traffic, enforcement, etc.)
- • Citizens also give a thumbs down to NPDP; Only 30% citizens willing to share their anonymised data with the Government for general purposes
- • Only 14% support businesses selling their anonymised data to other businesses and Government
September 24, 2020, New Delhi: The nine-member committee set up by the Ministry of Electronics and Information Technology, released a draft non-personal data policy in mid-July giving the public two months to provide feedback. Per the policy, any data which does not contain any personally identifiable information of an individual is termed as non-personal data.
For example, while order details collected by an ecommerce platform will have the name, age, address and other contact information of an individual, it will be considered non-personal data if specific identifiers like name, address and contact information are removed. NPD also classified non-personal data into three main categories - public non-personal data, community non-personal data and private non-personal data. Although many experts say that this policy is a forward looking step and will create a culture of data sharing of non-personal data which will bring overall benefits to the country, MSME and startups as well as citizens do not seem to be in favour of the policy in its current form.
LocalCircles decoded the 72-page detailed document and converted it into a simple survey on the key issues so common citizens, MSMEs and startups can participate and share their feedback. The survey received over 17,000 responses from citizens while over 15,000 responses were received from the startups and MSMEs spread across the country.
What the Citizens have to Say
The Government, via its Non-Personal Data Policy draft recommendation is mandating that Indian authorities can seek anonymised aggregate data of citizens from businesses to better understand the industry or for any other reason. Such data could include purchases made, services availed, calls made, health condition, etc. was the first issue discussed with citizens. People were asked if they would be willing to give their consent for this and share their data in anonymised form. In response, 27% said they would never want to share their anonymised data while 35% said they will be willing to do so only in a law-order or an investigation situation. Only 30% citizens said they were willing to share their anonymised data with the Government for general purposes.
Only 30% citizens willing to share their anonymised data with Government for general purposes
The kind of concerns that were raised by people included misuse of data for targeting specific communities or people residing in a particular area. One of the examples cited was targeting around elections in terms of a political party or a candidate being able to find out what people of a particular area were searching on an ecommerce site or on the internet. According to many respondents, the purpose or objective data should be very clear and specific before such information or consent for such information is sought from them. For instance, if the objective is to improve Government’s school education system, the same should be stated beforehand and upfront when the data is sought. Not having to know what the data will be used for in the future creates suspicion according to many citizens.
The Non-Personal Data Policy also proposes that a business that collects user data can sell it to other businesses or a Government body after anonymising it. Citizens were asked if they support such selling of their anonymised data, to which 81% responded in a negative, while only 14% responded in a positive.
Only 14% citizens support businesses selling their anonymised data to other businesses and government
This means that only 14% citizens support businesses selling their anonymised data to other businesses and Government. The big concern here amongst people is that if any organisation especially a business is purchasing aggregate data from another business, there is a high likelihood that it will use it to target communities or groups of individuals with their products and services. This will likely mean unsolicited offers, spam and targeted advertising. Hence, a high majority of the 81% people voted against such a possible move. Even if the purchasing organisation was a Government department, people are still concerned that such data will ultimately be misused and reach businesses.
What MSMEs and Startups have to say
The draft Non-Personal Data policy mandates that a business must sell their customers' anonymised data to other businesses or Government if they are willing to purchase the same. The final question asked how such a clause will impact businesses. 19% said it will help large and heavily funded businesses only, 35% said it will help large and heavily funded businesses and the Government, 20% said it will help businesses of all sizes, while 26% were not sure what would happen.
Only 20% small businesses believe that the proposed Non Personal Data policy permitting selling of aggregate data by large companies will help their business
This is one of the most important inputs from startups and MSMEs where they believe that while such a policy may have a stated objective of helping small businesses, it will likely do the opposite if the aggregate data of businesses is requested to or sold by the business as a revenue stream for a price. Many startups and MSMEs believe that this will lead to one large company buying aggregate data of another large company while small businesses struggle to make ends meet. Most small businesses, be it an Indian startup or an MSME will find it extremely difficult in majority of the cases to pay high prices for such data.
Large companies also in some cases are likely to resist selling their data if its core to their business model, leading to rejection of the data request or going to court.
In the next question, businesses were asked that before the Government mandates businesses to share their aggregate anonymised data, should the Government mandatorily share its aggregate anonymised data like municipal, health, traffic, water, environment, court pendencies, etc., so innovators can build new value added services upon them. 72% answered in a ‘yes’, while 16% said the businesses should do it first. 12% were unsure.
72% small businesses believe that before Government mandates businesses to share their aggregate data, it should start sharing its own data (municipal, health, traffic, environment etc.) so entrepreneurs and innovators can build useful products and services
Most of the real challenges of India today are all social in nature ranging from bad water quality to polluted air and from bad traffic to long time taken for justice. The Government can kick off entrepreneurship in these areas by bringing together its disparate local and state level databases and make them available for startups to build innovative high impact business models.
56% small businesses believe that the Government should enable a program where businesses above 500 crores annual revenues have to mandatorily share some aggregate data that they feel will drive innovation or public good
In the next question, small businesses were asked if the Government should enable a program where all large businesses, say above INR 500 crores of annual revenue, must mandatorily share 10 aggregate data elements/trends of their choice about their industry/business which can help startups/MSMEs develop more useful and targeted products and services. In response, 30% said yes as this will be immensely helpful, while 26% said yes as it may be useful. 5% said no, let them sell their aggregate data and those who want it can buy, while 18% said no, sharing any aggregate data by a business cannot be mandated by Government. 21% were unsure about it.
The startups and SMEs of the country believe that the data sharing program should be made voluntary to start with and could be made mandatory later for companies with annual revenue above Rs. 500 crores. Companies above a certain threshold should be allowed to decide what data they want to share as long as they share a predefined number of data points for the good of industry, small business or public. Many opportunities will emerge where large companies could make public the unfulfilled demand for a new or a particular product or service in their industry to develop supply chain capacities by developing startups and MSMEs as suppliers.
According to many MSMEs and startups, market sizing is a difficult exercise for them. Because resources are generally limited or stretched, it is very hard for them to figure out from which city they should launch their business or which market is the best market for what they have to offer. Aggregate data from large industry players can come in handy for small businesses to get their product, market, location fit right faster.
In summary, while the Non-Personal Data draft policy has gotten the dialogue started amongst citizens and businesses, it needs to be revisited considering the findings of this survey. From a citizen standpoint, there is very little to gain and the risk is of increased targeting, surveillance and data misuse. Citizen databases in India tend to sell for low prices and if one combines 2-3 of the commonly available databases along with say aggregate data from a large company, an individual can almost be fully profiled. On the small business front, making the data available for a price is a non-starter and most believe they will be spectators to a data purchase war between large businesses. The best approach at this point is for the Government to embark on a massive data aggregation and eventually sharing exercise of the various central, state and local databases which can then be used by startups and MSMEs to build innovative products and services on. As far as data sharing by businesses go, a voluntary to mandatory aggregate data sharing program say over 3 years for businesses above 500 crores annual turnover where businesses decide what data they share would be a good starting point. The COVID-19 pandemic has pushed most businesses behind by 2 years or more as far as their turnover and profitability is concerned. Another disruption in form of a mandatory aggregate data sharing program where hundreds of requests for data are coming is something that large businesses are bound to shy away from for the next few years. So let us ask again, who are we trying to really help and then redraft this policy.
A total of over 31,000 responses were received across 280 districts of India. This included 17,000+ responses from citizens while 15,000+ responses from businesses. 54% respondents were from tier 1, 28% from tier 2 and 18% respondents were from tier 3, 4 and rural districts. They survey was conducted via LocalCircles platform and all participants are validated citizens who had to be registered with LocalCircles to participate in this survey.