The Ministry of Electronics and Information Technology (MeitY) has released a plan to unlock vast data pools for AI development. It’s a major move to fuel India's AI ambitions, but it does so via guidance, not a rigid new law.
What is This New Guidance?
MeitY has launched the 'Handbook
on Data Empowerment and Protection Architecture (DEPA) for AI Training'. This isn't a new piece of legislation but a detailed techno-legal framework. It provides a structured pathway for institutions like hospitals, banks, and government agencies to share their valuable datasets with AI developers, startups, and researchers. The goal is to solve the critical problem of data scarcity that often holds back AI innovation, doing so in a way that respects privacy and security. The framework was developed with support from the iSPIRT Foundation and unveiled at a roundtable in Bengaluru.
Why Guidance and Not a Law?
Choosing to release a handbook instead of pushing for a new law is a strategic decision. The world of AI is evolving at a breakneck pace, and rigid laws can quickly become outdated, potentially stifling innovation. This guidance-based approach offers flexibility, allowing the ecosystem to adapt. It combines contractual permissions with technological safeguards to create a trusted environment for collaboration. By proposing best practices and technical standards rather than hard legal mandates, MeitY is encouraging voluntary adoption. This 'soft-law' approach aims to build a culture of responsible data sharing, fostering trust among data providers and users without the delays and rigidity of the legislative process.
How Does It Propose Sharing Data?
The core idea of the DEPA for AI Training is revolutionary: the 'model travels to the data, not the other way around'. This means instead of data holders like hospitals sending sensitive patient records to a tech company, the AI developer's model is brought into a secure, controlled computing environment where the data resides. The framework relies on several key technologies. Data is first de-identified or pseudonymised, stripping it of personal identifiers. Techniques like 'Differential Privacy' are used, which involves adding statistical noise to datasets to prevent the re-identification of any single individual. The entire process is governed by machine-readable electronic contracts, creating an auditable trail for how data is used.
Who Are the Key Players?
The framework outlines three main roles. First are the 'Training Data Providers' (TDPs), which are the institutions like banks and public agencies that hold the data. Second are the 'Training Data Consumers' (TDCs), such as AI startups and academic researchers who need the data to build and train their models. To facilitate the process, the framework introduces a new type of intermediary called 'Data Collabs'. These entities will be responsible for pooling sector-specific datasets from multiple providers, standardising them, and managing the secure environments for AI training.
What About Consent and Privacy?
This is where the framework makes a significant, and potentially controversial, point. The handbook acknowledges that obtaining individual consent for every piece of data used in large-scale AI model training is often 'impractical'. This marks a departure from traditional consent-based models. Instead of relying on user consent, the DEPA framework puts its faith in robust technical safeguards like anonymisation and secure computing environments to protect privacy. This approach is designed to align with exemptions in India's Digital Personal Data Protection (DPDP) Act, which allows for data processing for research and statistical purposes under certain conditions. However, this has raised some debate, with privacy advocates concerned about the risk of re-identification and the interpretation of the DPDP Act's exemptions.
