1. Regulation
India currently does not have any regulation dealing directly or exclusively with AI (Joshi, 2024). But there is in place a National Programme on AI, called the IndiaAI Mission, under the Ministry of Electronics and Information Technology (MeitY) and a National Strategy on AI put forward by the Niti Aayog. Additionally, there are legislations or proposed legislations around IT, data protection and digitalization.
1.1 National Programme on AI/IndiaAI Mission
India's MeitY is implementing the 'National Programme on AI' which encompasses four components: Data Management Office, National Centre for AI, Skilling on AI, and Responsible AI. The 'IndiaAI Mission' initiative is crucial to complement the ongoing 'National Programme on AI' by establishing a focused and comprehensive framework that addresses specific gaps in India’s AI ecosystem. The objective of this exercise is to undertake a comprehensive study of the pillars of IndiaAI and to identify tangible action items that need to be worked on to achieve the Indian government’s goal of "AI for all" (MeitY, 2023).
India's Ministry of Electronics and Information Technology (MeitY 2023) has set up seven working groups to drive the adoption of AI across various sectors. These groups address AI research, infrastructure, policy, and skills development. The detailed reports of each of the Working Groups are available here.
- Working Group 1 focuses on establishing three AI centres that will leverage India's strengths to tackle societal challenges. These CoEs will foster AI research and the development of indigenous technologies, while promoting collaborations between academia, industry, and research entities.
- Working Group 2 aims to build a data-sharing platform with a federal structure, enabling government and non-government organizations to contribute datasets. This initiative will enhance decision-making and AI applications through collaborative data utilization.
- Working Group 3 aligns with the National Data Governance Policy to establish the National Data Management Office (NDMO). This group will institutionalize data governance, oversee data management units, and ensure data-led governance and public service delivery.
- Working Group 4 is centred on fostering AI startups, with a goal of developing 100 AI unicorns. It focuses on empowering startups, building AI infrastructure, and promoting collaboration between stakeholders, both domestically and globally.
- Working Group 5 emphasizes AI education and skill development, recommending an AI-based curriculum from K-12 to postgraduate levels. The working group also encourages upskilling for faculty and promotes AI research collaboration among educational institutions.
- Working Group 6 addresses AI computational resource limitations by establishing AI infrastructure, promoting AI adoption in critical sectors, and facilitating AI innovation hubs.
- Working Group 7 focuses on developing AI-specific semiconductor designs, aiming to support domestic companies and startups in the design and deployment of AI chipsets.
Additionally, MEITY released the Draft National Strategy on Robotics in July 2023.
1.2 Niti Aayog Policy Documents
The Niti Aayog (which describes itself as a state-of-the-art resource centre with the necessary knowledge and skills that will enable it to act with speed, promote research and innovation, provide strategic policy vision for the government, and deal with contingent issues), has prepared the 2018 National Strategy for Artificial Intelligence, which claims that the transformative nature of AI technology, yet the nascent stage of its adoption worldwide, provides India with an opportunity to define its own brand of AI leadership. #AIforAll - the brand proposed for India - implies inclusive technology leadership, where the full potential of AI is realised in pursuance of the country's unique needs and aspirations. Niti Aayog holds that India's strategy should strive to leverage AI for economic growth, social development and inclusive growth, and finally as a "garage" for emerging and developing economies. In order for India to establish a leadership role, Niti Aayog positions its strategy document as a crucial foundational signposting of these goals (Niti Aayog, 2018).
According to Niti Aayog (2018), while AI has the potential to provide large incremental value to a wide range of sectors, adoption till date has been driven primarily from a commercial perspective. Technology disruptions like AI are a once-in-a-generation phenomenon, and hence large-scale adoption strategies, especially national strategies, need to strike a balance between narrow definitions of financial impact and the greater good. NITI Aayog has decided to focus on five sectors that are envisioned to benefit the most from AI in solving societal needs: a) Healthcare: increased access and affordability of quality healthcare, b) Agriculture: enhanced farmers' income, increased farm productivity and reduction of wastage, c) Education: improved access and quality of education, d) Smart Cities and Infrastructure: efficient and connectivity for the burgeoning urban population, and e) Smart Mobility and Transportation: smarter and safer modes of transportation and better traffic and congestion problems.
Niti Aayog (2018) acknowledges that as AI-based solutions permeate people's lives, questions on ethics, privacy and security will also emerge. Most discussions on ethical considerations of AI are a derivation of the FAT framework (Fairness, Accountability and Transparency). A consortium of Ethics Councils at each Centre of Research Excellence can be set up and it would be expected that all COREs adhere to standard practice while developing AI technology and products. In line with this, since data is one of the primary drivers of AI solutions, the appropriate handling of data, ensuring privacy and security is of prime importance. Challenges include data usage without consent, risk of identification of individuals through data, data selection bias and the resulting discrimination of AI models, and asymmetry in data aggregation. The policy document suggests establishing data protection frameworks and sectorial regulatory frameworks, and promotion of adoption of international standards.
Notwithstanding the articulation of a strategic vision for India, the Niti Aayog (2018) document is seen as actively encouraging experimentation among India's population by the private sector, positioning India as a 'playground' for the globalised data-based technology industry, which relies upon the datafication of people and their environments for commodification. The role of the state is conceived of as a ‘facilitator’ or enabler for private enterprise, explicitly echoing some established tenets of liberal economic policy, including the assertion that government investment in a particular economic field may ‘crowd out’ and disincentivise private spending, and that regulation can disincentivise 'innovation' (Joshi, 2024).
The Niti Aayog's (2018) paper resulted in the establishment of India’s National AI Portal, the central repository for AI resources, research and development in the country, which portrays the IndiaAI Mission (Chauriha, 2024).
1.3 The Information Technology (IT) Act 2000
A legal framework proposed by the Indian Parliament, Information Technology Act 2000, is the primary legislation in India dealing with electronic commerce and cybercrime. It was formulated to ensure the lawful conduct of digital transactions and the reduction of cyber crimes, on the basis of the United Nations Model Law on Electronic Commerce 1996 (UNCITRAL Model). The IT Act 2000 came into effect on 17 October 2000, imposing restrictions on all individuals and companies - regardless of their nationality and country of registration respectively - and regardless of geographic location, including if a computer or computerized system/network or server is located in India (Acharya, 2024; Mackie, n.d.; Toppr, n.d.)
There have been some amendments associated with the IT Act 2000. The 2008 amendment brought modifications to Section 66A of the IT Act 2000. The modifications were made to address cases of cybercrime linked to the advent of technology and the internet. Specifically, it speaks to criminalising sharing offensive messages electronically and indicates penalties for the same. This includes any message or information that incited hatred or compromised the integrity and security of the nation. However, the lack of clarity in defining 'offensive' messages led to unnecessary punishment of several individuals, ultimately resulting in the striking down of the section (Acharya, 2024; Apoorva, 2015). In 2015, another bill was initiated to amend Section 66A of the IT Act 2000, with the aim of safeguarding the fundamental rights guaranteed to citizens by the country's Constitution. This was later accomplished by declaring it as violative of Article 19 of the Constitution (Acharya, 2024).
1.4 Digital Personal Data Protection (DPDP) Act 2023
India's Digital Personal Data Protection Act, 2023 was adopted on 11 August 2023. India's first data protection act, it establishes a framework for personal data processing. Personal data, which is information that relates to an identified or identifiable individual, is used by businesses as well as government entities for the delivery of goods and services. Processing, which involves fully or partially automated (set of) operations performed on digital personal data, includes collection, storage, use and sharing of the data. The Act is expected to have an impact on the majority of organizational areas, including legal, IT, human resources, sales and marketing, procurement, finance, and information security because of the type and volume of personal data that is collected, stored, processed, retained, and disposed of. On the one hand, such data allows for an understanding of the preferences of individuals, which may be useful for customisation, targeted advertising, and developing recommendations. On the other hand, such data may aid law enforcement. Yet, unchecked processing may have adverse implications for the privacy of individuals, which has been recognised as a fundamental right; individuals may be subject to profiling, loss of reputation and financial loss (Kalra, 2023; PRS, 2024).
1.5 The Proposed Digital India Act (DI Act) 2023
The Proposed Digital India Act, 2023, currently the Digital India Bill 2023, is set to replace India's existing Information Technology Act (IT Act) 2000, with a view to reflecting contemporary developments in the digital landscape (which are not reflected in the IT Act) and addressing the ever-changing digital landscape (Anand, 2023, Drishti, 2023). In other words, it is expected to serve as a modern regulatory framework for the Internet and AI age (Sur, 2023). This proposed new legislation is being designed to establish comprehensive oversight over India's digital ecosystem, seeking to facilitate fair trade practices, regulate tech giants, safeguard innovation, promote digital governance, ensure online safety and accountability and protect citizen/digital user rights in the open internet and AI context and expedite cyber offence adjudication. This move is expected to have significant implications for businesses operating in India's digital space. Aligned with India’s goal of achieving a US$1 trillion digital economy by 2025-26, the Digital India Bill aims to foster global innovation, entrepreneurship, and establish India as a trusted player in the global digital value chains. Recent reports suggest that the draft of the Digital India Bill will soon be released for public consultation by the central government (Anand, 2023, Behura, 2023; Drishti, 2023).
The Digital India Bill will work in conjunction with other notable legislation and policies, such as the Digital Personal Data Protection Act, the National Data Governance Policy, and the Indian Penal Code amendments for cybercrime. Together, these laws and policies are set to establish a comprehensive framework aimed at governing different facets of the digital sphere in India, aligning with the Digital India initiative (Anand, 2023, Drishti, 2023).
The success of the proposed Act hinges on various considerations. First, balancing the interests of various stakeholders, including tech giants and citizens' rights, ensuring that all voices are heard and taken into account in the drafting and implementation process. Second, substantial but adequate investment in resources, expertise, and infrastructure to ensure effective enforcement. Third, building up public awareness to educate citizens about their rights and responsibilities in the digital realm (Drishti, 2023).
The central government in India plans to have extensive consultations with various stakeholders (experts, industry, academia, media, general public) before finalising the Bill and presenting it to Parliament. This means that progressing the Bill to Parliament is expected to be undertaken after the 2024 general elections in India (Behura, 2023; NDTV, 2023). Experts feel that the delay will further prolong the much-needed regulation of the internet, which the current IT Act 2000 does not address effectively enough (Behura, 2023). Specifically, the delay stifles the growth of India’s digital economy (deters investments, inhibits expansion and affects global competitiveness), prolongs the supremacy of big tech, undermines online safety, hinders public policies pertaining to digital governance, data privacy and cybersecurity, and risks potential breaches of international agreements like the WTO agreement (Behura, 2023).
The Draft National Data Governance Framework (NDGF) Policy
Background
India, being the second most populated country in the world, has a large data market which is relatively unregulated. The lack of appropriate legislation has encouraged crimes such as data theft, data misappropriation, cybersquatting, etc. The increased usage of smartphones coupled with the easy availability of the internet has made it necessary to have a robust system of data governance (Balasubramanian, 2021). There has been a gradual demonstrated interest by the government in non-personal data (NPD) in recent times. This new focus on regulating non personal data can be owed to the economic incentive it provides (Chaudhary and Kundu, 2022). After focusing on the Digital Personal Data Protection Act 2023, India’s Ministry of Electronics and Information Technology is furthering its commitment to regulate the processing of data in India by addressing the issues associated with NPD (Balasubramanian, 2021). In 2020, the Ministry of Electronics and Information Technology ('MEITY') constituted an expert committee under prominent industrialist Kris Gopalakrishnan to study various issues relating to NPD and to make suggestions on the regulation of non-personal data (Chaudhary and Kundu, 2022). The expert committee report, released in July 2020 (Balasubramanian, 2021) differentiated NPD into human and non-human NPD, based on the data’s origin. Human NPD would include all information that has been stripped of any personally identifiable information and non-human NPD meant any information that did not contain any personally identifiable information in the first place (eg. weather data) (Chaudhary and Kundu, 2022). The Committee also proposed the creation of a National Data Protection Authority (NPDA) as it felt this is a new and emerging area of regulation (Chaudhary and Kundu, 2022).
On 21 February 2022, the Ministry of Electronics and Information Technology (MEITY) came out with the Draft India Data Accessibility and Use Policy 2022 (also called the Draft Policy). The Draft Policy was strongly criticised mainly due to its aims to monetise data through its sale and licensing to corporate bodies. The Draft Policy had stated that anonymised and non-personal data collected by the State that has "undergone value addition" could be sold for an "appropriate price". During the Draft Policy’s consultation process, it had been withdrawn several times and then was finally removed from the website (Chaudhary and Kundu, 2022).
Focus
The Draft National Data Governance Framework Policy (NDGF Policy) is a successor to this Draft India Data Accessibility and Use Policy. There is a change in the language put forth in the Draft NDGF Policy from the earlier Draft Policy, where the latter mainly focused on monetary growth. The new Draft NDGF Policy aims to regulate anonymised NPD kept with governmental authorities and make it accessible for research and improving governance. It wishes to create an 'India Datasets Programme' which will consist of the aforementioned datasets. MEITY opened the new Draft NDGF Policy for public comments in May 2022 (Chaudhary and Kundu, 2022). As per the government’s implementation document for Budget 2023-2024, the Draft NDGF Policy is under finalization (Sarkar, 2024).
Presently in India, NPD is stored in a variety of governmental departments and bodies. It is difficult to access and use this stored data for governmental functions without modernising collection and management of governmental data. Through the Draft NDGF Policy, the government aims to build an Indian data storehouse of anonymised NPD datasets and make them accessible for both improving governance and encouraging research. It proposes the establishment of an Indian Data Management Office (IDMO; Chaudhary and Kundu, 2022) to be set up under the MEITY’s Digital India Corporation (DIC). The IDMO will design and manage the India Datasets Programme and be responsible for the NDGF policy (see NDGF Policy document). The Draft NDGF Policy is expected to address a major hurdle in the adoption of AI in India, namely, the lack of datasets (Sarkar, 2024).
Caveats
Several caveats around the Draft NDGF Policy have been highlighted. While Mathi (2022) cautions that anonymised datasets can be de-anonymised, Singh (n.d.) points out that whereas the draft NDGF Policy primarily concerns itself with making the government bodies better equipped at handling data, it does not expressly keep private entities out of the purview of the policy. The policy aims to include NPD datasets housed with ministries and private companies into the India Datasets Programme, encouraging private entities to share such data with the IDMO for further use by other requesting entities. The Draft NDGF Policy also does not expand on the technicalities involved in how such data shall be stored and the measures that may be undertaken to ensure the safety of such data. As pointed out by the Joint Parliamentary Committee Report reviewing the Data Protection Bill 2021, it is possible for anonymised data to be re-anonymised. This may have potential data protection and privacy related issues since NPD, though stripped of any identifiable characteristics may be business confidential information or may have information that may be proprietary to private entities. Therefore, as was the concern with the Draft India Data Accessibility and Use Policy 2022, there is a need for a proper legislation for NPD instead of only a policy (Singh n.d.).
Ajaykumar et al (2022) point out that the Draft NDGF Policy does not specify the composition and functioning of the IDMO; indicating this is believed to be important in the interests of accountability and transparency. Further, detailing how the Draft NDGF Policy and IDMO will interact with the provisions of the Data Protection Act 2023 is relevant. Moreover, while the role of the IDMO is envisaged as formulation of rules, standards, and guidelines for data, datasets, and metadata, the IDMO’s consultation to this end is limited to ministries, state governments, and industry. Ajaykumar et al (2022) hold that the scope of consultation should be widened and other stakeholders such as civil society organisations and educational institutions should be involved; inclusive consultations are considered necessary to minimise inadvertent harm to specific stakeholders. They also caution that the IDMO needs to define standards for anonymisation, avoiding conflation with other methods such as pseudonymisation which replaces personal identifiers with artificial ones. Anonymisation requirements must reduce the risk of data being de-anonymised and create countermeasures in those cases. Standards for anonymisation need to be periodically updated to move in tandem with the changing requirements of dynamic data and data use cases. Apart from adhering to global standards on this matter, the IDMO must create mechanisms to hold suppliers of data accountable for appropriate levels of anonymisation of said data before the data is transferred to the IDMO and any sub-authorities. Ajaykumar et al (2022) highlight that given the powers vested in the IDMO by the Draft NDGF Policy, it is important that the IDMO's decision-making process is transparent and the criteria for denial of requests clearly elucidated; these checks would help enhance access and citizen engagement with the Indian Datasets Programme. The Intellectual Property Rights (IPR) ownership of datasets must be recognised and elaborated on in the Draft NDGF Policy. Besides, the Draft NDGF Policy indicates the possibility of user charges, which can be seen as running contrary to its intended use as a public platform to catalyse India's "research and start-up ecosystem" (Sec. 2.2) and promote greater citizen participation and engagement (Ajaykumar et al, 2022).