23/72 111972/2020/CL&ES
5. Ownership of data The Committee discussed the ownership of Non-Personal Data and articulated a legal basis for establishing rights over it.
Legal basis for establishing rights over Non-Personal Data 5.1. The Committee developed certain guiding principles for establishing legal rights over data.
i. Data sovereignty: The ownership of the Non-Personal Data collected about people in India and collected in India should be defined. The laws, regulations and rules of the Indian State apply to all the data collected in/from India or by Indian entities.
ii. The term “ownership” holds full meaning only in terms of physical assets. Regarding intangible assets like knowledge and data, the term ‘ownership’ is relatively loosely employed to meana set of primary economic and other statutory rights. For such intangible assets, many actors may have simultaneous overlapping rights and privileges. At times, such rights and privilege of different actors may not even interfere with one another, but this is not always so. It is therefore important that such rights and privileges related to Non-Personal Data are clearly defined and ascribed. Accordingly, the notion of “beneficial ownership/interest” has been adopted by the Committee, in ensuring that a Community’s interests are safeguarded regarding non-personal data over which there is an expectation of benefits being accrued to itself.
iii. Accordingly, the Committee recommends that: o
o
In case of Non-Personal Data derived from personal data of an individual, the data principal for personal data will continue to be the data principal for the Non-Personal Data, which should be utilized inthe best interest ofthat individual. The rights over community Non-Personal Data collected in India should vest with the trustee of that community, with the community being the beneficial owner, and such data should be utilized in the best interest of that community.
iv. Benefits accrue to relevant Indian communities: The Committee agreed that the benefits accruing from the processing of community Non-Personal Data, should accrue not only to the organizations that collects such data, but also equally to the community that typically produces the raw / factual data that is being captured. Accordingly, such data may be shared in instances where there are defined grounds or purposes for sharing of Non-Personal Data (refer to Recommendation 5)with citizens, Indian start-ups, Indian companies, Indian 23
