40/72 111972/2020/CL&ES
8. Non-Personal Data Regulatory Authority The Committee discussed a set of policies, regulations, rules and systems that needs to be put in place to govern Data Businesses and data sharing. It also studied the emerging rules and regulations in other countries governing Non-Personal Data and data sharing. For the latter, refer to Appendix 6. The Government of India has tabled in Parliament the PDP Bill. In as much as the regulation of personal data is driven by the need to protect data principals who provide their information from a violation of their personal privacy, the regulation of Non-Personal Data would be driven by the need to unlock the value inherent in this form of data, as well as to protect from collective harms.The regulation of Non-Personal Data should also be driven by the need to ensure that its permitted use does not result in the unauthorised reidentification of the individuals contributing to that aggregate data.
Non-Personal Data Authority– Roles and Responsibilities Recommendation 7: Establishinga Non-Personal Data Authority 8.1. The Committee discussed the creation of a Non-Personal Data Authority in considerable detail. It considered options like
i. Can the sharing of Non-Personal Data be self-regulated by business and other stakeholders?
ii. Can various sectoral regulators address issues that are related to Non-Personal Data?
iii. Can the Data Protection Authority(DPA), proposed in the PDP Bill, address NonPersonal Data too in coordination with the Competition Commission of India (CCI) and other sectoral regulators?
iv. Can a department within the Government coordinate the roles of various regulators such as the DPA, the CCI, and other sector regulators to regulate NonPersonal Data? 8.2. Ultimately, the Committee felt that the best option is to create a separate NonPersonal Data Authority.
i. This is a new and emerging area of regulation. The regulatory authority will need specialized knowledge (of data governance, technology, latest research and innovation in the space of Non-Personal Data, etc.) and will have to keep pace with the rapidly evolving technological landscape.
40
