Making Consent Count for Data Protection: Read our article published by Live Mint.

Learn about our workshop on ‘Privacy in Financial Services’, hosted in collaboration with CGAP and Dvara Research

There is a growing consensus on the need for a Data Protection bill for India.

With the rise in smartphone adoption, ubiquity of internet, proliferation of digital services and the introduction of Aadhaar, a unique identity for all Indians, data trails are being generated everywhere. While there is substantial documentation of benefits of capturing real time data to help businesses and government, there is little research on consumer perceptions around data protection and privacy.

Between September and November 2017, a multidisciplinary team of strategists, lawyers, designers and researchers from Dalberg, Future of Finance Initiative at Dvara Research and CGAP set out to understand ‘how do ordinary citizens of India think and act on their privacy and data protection?’ Some of the key questions we wanted to understand were – How aware are people about data usage? What types of data do they value? Does consent matter? What risks and harms do they perceive? How do they make trade-offs and decisions? What are their expectations from the government and service providers?

The report is a collection of insights, design principles and stories from face-to-face interviews with close to 50 people and experts spread across 4 regions of India (Maharashtra, Delhi, Tamil Nadu and Uttarakhand). The study used Human Centred Design (HCD) research methods that helped to understand not just what people say, but how they think, act and feel. The methods helped uncover what factors drive people’s decision-making and how they might make trade-offs under different data giving contexts.

Our conclusion is that people strongly favour a rights-based approach to data protection. In addition to rights and safeguards, they want to know how their data will be used and to give consent for collection as a means to exercise their agency. There was a strong expectation from people that the government should create laws that automatically safeguard their privacy and their data whenever it is used. Finally, they want a humanized redressal system to be in place that is affordable, trustworthy, responsive, and effective.