The US is a fractious nation, where all 52 states rarely agree on anything, and the two major political parties agree on nothing at all. However, there is one piece of legislation making its way through the political system, where the Democrats, Republicans, Senate and Congress seem to be concurring with each other. This is the ADPPA, or the American Data Privacy and Protection Act, which promises to radically transform the US data privacy and protection landscape. When made into law, a ‘covered entity may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate to” achieve one of the 17 allowed purposes. It will also ban use of ‘sensitive’ data like health information and geolocation, ban targeting minors and even not allow the ‘Accept All’ buttons that the European GDPR has made ubiquitous. The US is not alone; while the GDPR set the trend, UNCTAD reports that 80% of all countries in the world have a data protection and privacy legislation or are putting one into effect. Not all of these laws are as strong as the US, Europe or Australia – the one in China and Brazil are considered ‘moderate’, while, interestingly, the one in India and South Asia are fairly ‘limited’ in their scope (https://bit.ly/3G1dZAS). Most of them, including the US and Indian one, have been legislated quite recently.

There is a reason that countries are falling over themselves to control and manage data – it is only lately that data has been thought of as a valuable resource as well as a potent weapon, and governments like to own and control resources and weapons. Historically, the greatest wealth has been created by harnessing and exploiting natural resources. The first barons and lords were those who owned and controlled land, and had serfs extract agricultural value out of them. Timber was the next logical resource to be exploited. Railroads built on virtually free land built the next generation of barons, who were followed by mining magnates scooping out minerals from earth. Huge wealth was amassed by colonial resource exploitation. Then came oil; wars were fought, borders redrawn, fortunes built, and oceans overrun over oil. Now, data has been pronounced the new oil, and future world powers will be created on the back of data. China brought itself into contention with manufacturing, now it is separating itself from the pack leveraging Data and AI. Putin has famously remarked that “the nation that leads in AI (and so data) will lead the world”. The US is waging war by choking off chips and technologies that enable AI from their geopolitical foes. The countries are late to the party though, Big Tech discovered the value of data much earlier and the Googles, Facebooks and Tencents have built trillion-dollar companies exploiting it. But much like oil, data has been used as a weapon too – influencing elections, defrauding investors, faking news.

In this entire scenario, the Indian situation is particularly interesting. India and China are perhaps the only two large countries where digitization and data has happened at ‘population scale’. The big difference in India is that it has happened with large government intervention – the digital stories of the West, and even China, are largely private enterprise led. The Indian digitization story has been breath-taking in its scope of scale: Digital Public Infrastructure like identity (Aadhar), payments (UPI) and the upcoming National Health Stack and the Open Network for Digital Commerce (ONDC), built on the India stack have begun to transform its society and economy. India as a country and the Indian consumer are leapfrogging the world in digitization and digital technology, with the government treating these as Digital Public Goods. The scale and richness of consumption, demographic and even personal data being generated is massive, and there is an immense scope to leverage this. Nandan Nilekani, the architect of this initiative, talks of Indians “becoming data-rich, before they become economically rich”, pointing out an opportunity for individuals to harness and monetize their own data, rather than intermediary Big Tech platforms doing so – as happened in the rest of the world. Take for example, the ONDC initiative, which if successful can democratise ecommerce rather than it being in the hands of an Amazon-Flipkart duopoly.

The Indian approach to regulate data is three pronged: the much-amended Data Protection Bill which has been considerably watered-down, the forthcoming Telecoms Bill and a Digital India Act to replace its IT Act. No law, not even the much-lauded ADPPA is perfect, and not everyone will be happy with the set of data laws in India. Whatever form and shape it takes, a few outcomes are definite. One, the era of ‘free data’ is over, and Big Tech companies which built trillion-dollar businesses out of it will have to tweak their business models (take the case of Facebook, which has suffered a multi-billion dollar hit due to Apple rewriting its privacy code). Two, there will be a patchwork of laws across the globe, and multinational companies dealing with data will find it very cumbersome to work across all of them. Therefore, irrespective of what a country’s law is, it is very likely that the strictest will be applied to all of them, and GDPR might become that. Three, some law is better than no law, and we hope to have more consumer protection, transparency and privacy protection than before. However, it will continue to be an arms race, with governments playing whack-a-mole with data entities, trying to stamp out new ways to beat new regulation, as newer AI-driven technologies like ChatGPT come in with their own data conundrums.