The government has received inputs from stakeholders on the digital personal data protection bill. What’s the government’s view now?

I have now done almost 11 consultations. I’ve met everybody—lawyers, students, consumer groups, industry, large companies, smaller players, MPs… Except for a group of people—and I’m not dismissing their views—whose interpretation of privacy and data protection is very absolutist, largely stakeholders have welcomed the draft. Some are too influenced by models of GDPR (the European Union’s general data protection regulation) that exists there. Except for the criticism from there, the framework is an absolutely perfect one that does three things.

One, it ensures and codifies the right to data protection of an individual. Second, whatever we do, we must not create a framework that creates additional compliance layers or stifles innovation and the startup ecosystem. Third, for legitimate purposes, where the government has to have access to personal data for security, pandemics, emergencies, etc., the carve out of that is clear, very well defined. There is no regulator. There’s a Data Protection Board, whose job is to adjudicate on the financial penalties that will be imposed on platforms that violates the obligations. The appellate authority will be the high courts and the judicial system, which will have continuing oversight.

There’s criticism that the penalties aren’t harsh and that it allows the government unfettered data access, among others.

Number one, the bill provides for the table (of penalties) to be revised from time to time. Second, it is silent on whether it’s ₹500 crore per person or per instance. Let the Data Protection Board evolve the jurisprudence. So, I can assure you that the penalty section is supposed to be punitive and a deterrent. The idea of creating civil, financial penalties is that we want to create discipline and behavioural changes in the way the data fiduciaries approach data principals. Second, there’s no unfettered access for government. It meets the Puttaswamy judgement criterion of proportionality and legality. The exceptions are only in cases of law and order, pandemics and natural disasters. The other exception is deemed consent, that if you have given a consent to the government for one service, it is deemed that you are given consent for all. That’s all. Now, if the government violates the terms of the law, it will also be penalized, which was not there in the previous bill. On child-gating, there is a school of thought children should be given more liberty and independence and the age limit should be lower than 18. While different countries have taken different approaches to this, India is a traditional society and community and as of now we feel 18 is appropriate.

What about issues around data localization? Are free-trade agreements one of the elements for the data localization norms under the bill?

We have created a framework that is absolutely modern, far reaching and forward looking. We’ve said that whitelisting will be done. That means the areas where a data platform can store the data of an Indian citizen will be notified by the government. We are basically creating a framework of corridors of trust. India and country X—if we agree to build a digital corridor of trust, it means that the rights of the Indian citizens for having his or her data protected even if the data is in your country must be recognised by that country’s law and jurisprudence, and vice versa.

What would be the criteria by which the government will notify a country as a trusted storage source?

Simply this—that my rights as an Indian citizen today under the digital personal data protection law should be intact, regardless of whether you store it in country X or not. It means if it breaches from there, you’re still liable. In every FTA today there’s a component of digital trade and a very important element of digital trade is this corridor of trust. There will absolutely be an architectural framework of corridors of trust that the government of India will architect and build, along with other countries that respect the same.

Some telcos have expressed their views against permitting data to be stored in other countries, even if they are part of this corridors of trust framework.

Stakeholders, including telcos will have multiple opinions. But the digital ecosystem consists of a lot more than telecom companies. Our primary objective is that citizens’ rights should be protected. They must get on open internet, they must not be gate-kept by anybody. Net neutrality is something that the Prime Minister in 2015 had ruled that India will lead the world in. So, we don’t want anybody to be gatekeepers—not Facebook, not a telco, nobody. So that is our view of the internet.

Are you aiming to present the bill during the Budget session?

We will place it in the public domain after all the inputs come in. There’ll be a draft, there’ll be no additional rounds of consultation. After we put this out in public, we’ll take it to the Cabinet and Parliament.

Is there any thinking around diluting the safe harbour provisions available to intermediaries? (These provisions waive liabilities of platforms arising from content posted by third parties or users)

That is part of our Digital India Act (DIA), the second corresponding piece of what we call the global standard cyber laws, under which the cyber security regulations will also come. The safe harbour concept in India and the US was done at a time when there was a clear difference between publishers and platforms. This is now getting blurred. The debate on whether safe harbour should be there anymore is a legitimate debate going forward into the DIA. There are many people who say there’s no need for it. With the IT rules, we have placed major due diligence obligations on platforms, and now there is 100% compliance so far. It’s a good debate to have. If you ask me my view, both sides of this argument have merit. Some—very few—intermediaries, still may deserve some sort of a one-notch-below-publisher status. But a large part of the intermediaries who are directly publishing things, they are responsible for the content. During the consultation, clearly, this is going to be one of the issues. And I think a large part of the conventional media platforms that are subject to regulation will push for Section 79 type safe harbours to be a very, very narrow exception rather than the general rule for intermediaries. Currently, it’s a general rule.

What will be the key pillars of the Digital India bill?

First of all, the internet has become a lot more complex than it was in 2000. What we saw then was one type of intermediary. Now there are multiple types of intermediaries—ecommerce, digital media, social media, AI, payments, gaming et al—which are different in terms of their nature and characteristics of what they represent to the consumer. Second, in the past, the prism of harm on the internet was very narrow—it was about criminality, cybercrime, cyber security, hacking, etc. Today, harm on the internet is a huge industry. Whether it is abuse, doxxing, gaslighting, misinformation, phishing, drugs, exploitation or trafficking—there’s a whole series of things. Some of these can be addressed by the Criminal Code while others are unique to the cyberspace. Firstly, we want openness. The internet should never be controlled by anybody. That means no state, no government, no platform, no telco should be able to distort the free and open nature of the internet. The second is safety and trust, which is very critical for India where 80 crore Indians—including women, children and pensioners—use the internet for the daily lives. It has to be a safe and trusted space. And the corollary of that, therefore is, user harm should be identified, blocked and prosecuted. The third is accountability. Regardless of where you are, how big a platform you are, the Indian consumer must find it easy to hold you accountable. So these three principles will find mention in the DIA. It will certainly address issues like emerging technologies, like you’re seeing ChatGPT and AI emerging in a big way recently. We want to approach the listing of unique cyber harm type of phenomenon, and see how to address it.

Isn’t there a fine line between cyber attacks and…

There’s a fine line between freedom of speech and trolling. Our position in the government is that freedom of speech is not a license to cause harm and especially because youngsters and children are so dominantly on the internet. There is enough evidence that psychological harm is being caused to children through this kind of phenomenon. Therefore, should we be just mute spectators to it, or should we talk about it at least?

What’s the government’s thinking on ad-tech platforms and the demand from publishers for the kind of legislation we are seeing in other countries, mandating platforms to share revenues?

Currently we are uncomfortable with the dominance and the control and the imbalance in the relationship between content creators and the monetisers, whether they’re ad tech or whether they’re just monetizing content, and that balance is today skewed in favour of these dominant platforms. There’s a lot of arbitrariness there. We want to rebalance that and frame rules for that. So, this law and DPDP will be the global standard for the India Techade.

Do you have the provision to keep on expanding the definition of intermediaries?

Under the DIA, we will create these various classes of intermediaries. Originally, there used to be one intermediary, and everything could be put into one class of intermediaries. We should treat each intermediary as belonging to a distinct class of intermediaries with different levels and thresholds of accountability and punishment.

What is the timeline for the DIA?

I don’t see any reason why by the end of this month, we should not be able to put it out there for discussion.

So, before the end of 2023, this could be a law?

100%.

The government has received proposals for setting up semiconductor manufacturing in India. But it’s been a year and we’re yet to see any movement on those?

On the design part, which is as critical in today’s semiconductor world as manufacturing, we are encouraging startups to design next-generation chips and the program is being run out of IIT Chennai. The first batch of about five startups will be approved this month. There will be 12 more, so our target is to have by March about 16 to 20 design startups (approved and funded), which will be all over the country. Conventionally, semiconductor design is limited to Intel, AMD, Qualcomm, NXP, Infineon et al, but we have in India 45,000 semiconductor design engineers who work for them, who may want to do something on their own. We’re encouraging that, and we’re encouraging foreign companies based in India to do joint-chip development, where they can co-own the design. Two, our focus is on computing and cloud, mobile devices and automotive. In these three areas we want our startups to really concentrate and create real world beating capability. So, the design part we have progress.

Then there’s chip packaging. On this also we have got proposals and you’ll soon see our announcements and approvals on those.

Manufacturing of chips is a very complex process and there are many questions and due diligence that are to be done by the Technical Advisory Committee on technology, process, capital cost, that is very thoroughly being done. We have our advisory group comprising some of the most talented semiconductor professionals. I had earlier projected November or December (for approvals). But these are independent people. The Indian Semiconductor Mission is independent; the government is not deciding. ISM has this group of very experienced people who are examining the proposals. When they are ready they will tell us. It’s important to understand this is not about lethargy or slow processes. It’s a function of the deep due diligence that they are doing.

Are there concerns about the proposals? Are you confident that some of them will make it through?

I have to be concerned till I’m not concerned. That is the job of the government. So we will be concerned and we will ask all the right questions. Whatever decision is taken will be taken after serious scrutiny and assessment. For us, semiconductor is not just about manufacturing, nor is it only just about deepening the electronics ecosystem. All of that it does, but it’s also about semiconductor security, technology, resilience—all of those areas, especially in an era when digitization is only accelerating and moving more forward. But the government is not in a tearing rush. Semiconductor manufacturing is a long game. If we have to play the waiting game before you get more and more proposals, it’s fine, because the silicon curve which went into a shortage-driven cycle has now reversed. Because of the impending recession in the Western world, demand has slowed. There might still be some supply chain issues but stocking at the fab is now at a peak.

China and US have lined up massive financial incentives in semiconductor manufacturing. Are the incentives we’re giving to attract global players adequate?

India’s proposition today, in the scheme of things globally, is not that we are competing with the US on subsidies. The biggest thing about India today makes it attractive for investment is that we are one of the fastest growing markets for all things digital. And we are one of the fastest growing innovation ecosystems that support all things digital. This is the framework under which everybody is looking at India. So, therefore, a fab in India and investment of a fab in India has nothing to do with what happens in the US. People will have to be here whether you are Intel whether you are Global Foundries or whether you are Samsung. In my humble opinion, India is not a place you can ignore.

Do we need another PLI (production-linked incentive scheme) for semiconductors, or components in the value chain?

Our ambition on electronics is to broaden and deepen the electronics manufacturing ecosystem. It is the biggest category of commodities in the world after petroleum. In electronics, the fastest growing segment is mobile phone and we’re the second largest manufacturer. In 2014, 90% of the mobile phones consumed in India were imported and in 2022, 97% of mobile phones consumed in India are manufactured in India. In 2014, exports of mobile phones were zero, exports of mobile phones are doubling every year and this year we will do ₹85,000 crore and next year we will do ₹1 lakh crore of exports, which will make it one of the top 10 exported products from India. So, in the mobile phone category, we are doing well and we will continue to boost that.

Now, there are other categories that are doing this China plus one strategy. Dell and HP make servers—100% manufacturing is in China. They have an imperative to move their manufacturing out. So in making servers, laptops, tablets, we are going to be competitive, we are going to seek to be a bigger player in that shifting supply chains of IT hardware. The domestic demand for servers, the domestic digitization of our economy, digitization of segments, like education and health, will all drive demand for servers. The server manufacturers are looking to shift the value chain and in the middle of all that we will drop the IT hardware PLI, creating the market incentives for them to move. The idea is to bring them here and give them a promise of not just the PLI, but also the fact that we have a Data Centre policy coming out, which will make India the fastest growing market for cloud, which is the biggest consumer of servers.

Apple is reducing the production in China in every category that is growing. That means they’re going somewhere like Vietnam, Thailand or India. Now, India, in my opinion, is the best place for them because we have a sizeable domestic market. As post-Covid there are changes in the global value chains of electronics, India wants to be a trusted partner to the world’s consumers and enterprises. And so, PLI is one element of it, but there are a whole bunch of other things that we are doing, including making sure all state governments work together with Centre, which has so far worked well. This year, target is $75 billion (worth of electronics manufacturing), but in 2025-26, we want to do $300 billion. Electronics export target for next year is ₹1 lakh crore, making it the top 10 exported products from India, and we will hit it. By 2025-26, exports will hit $120 billion. Our strategy is that we will get scaled through domestic market as well as exports, which is an advantage and scale that no other country can bring to the table.

What impact does this have on employment?

It’s tremendous. In the last one year, 14 lakh new jobs have been created in manufacturing and IT. The other interesting thing here to know is that the GST revenues from mobile phones are already more than the entire PLI scheme commitment amount over the five-year period.