"LOW COST SMARTPHONES MAKE MONEY OFF OUR PRIVACY, IT'S TIME WE FIXED THIS", FirstPost, 23 October 2018

Link to Article

The digital economy is receiving a lot of attention of late. The recently approved National Digital Communications Policy 2018, an imminent data protection law, and policy conversations on e-commerce are examples of this. The public interest implications of rapid internet adoption are driving this momentum. Internet adoption displays an S-shaped curve globally – representing initial moderate growth, steep growth in the middle-phases and stable growth towards the end. The plummeting cost of data and devices seem to have catapulted India to the middle of this curve, a path of frenetic activity, and equally of heightened risks.

In many ways, the pace and pattern of internet adoption in India seem to mirror the process of urbanisation which has been equally feverish for longer. The prospects of efficiency, connectivity and progress have driven urban migration, and are the drivers of digital migration as well. A citizen experiencing in-situ urbanisation is similar to a digital native experiencing swift and inexorable technological change. Finding itself amidst such fundamental transitions, the Indian State is trying to discover legitimate levers of regulatory control, balancing consumer aspirations with the security and stability of the digital ecosystem.

This balancing act is going to be particularly hard when it comes to regulating device ecosystems. Smartphones are at the epicentre of consumer aspirations, with low-cost Chinese brands accounting for nearly 60 percent of the Indian smartphone market. These brands manage to offer hardware specifications comparable to higher-end smartphones and remain profitable despite unfavourable customs duties for equipment imports and lack of a localised components base. But there is a trade-off. Specifically, low-cost brands derive their margins by bundling applications, operating systems, and user consent – a combination that facilitates cross-subsidisation at the cost of ecosystem integrity, as explained below.

Firstly, many low-cost smartphone brands pre-bundle third-party applications that range from news aggregators to social media services. Such pre-installed software, also called “bloatware” in technology circles, not only takes up an asymmetric amount of processing memory relative to functionality, it often creates ecosystem vulnerabilities. For instance, according to a Pew Research Center study, the most common permission sought by application providers is to access information related to Wi-Fi connections. Such requests can enable access to device data from an entire network, with only one user’s permission. Digital advertising, unfortunately, thrives on such unethical collection of data. And the companies that make data-collection applications, in turn, cross-subsidise device makers. This grand-bargain of pre-bundling deprives users of any choice in the matter.

A second challenge is the prevalent practice of pre-bundling of older generation operating systems (OS) on low-cost smartphones. Again, owing to their own unit economics, smartphone makers often make important qualitative choices of behalf of unsuspecting users. This is problematic because low-cost devices running old software on cheap chipsets, often form the weakest link in interconnected digital communications ecosystems. This challenge is exacerbated by the fact that a single OS provider accounts for 90 percent of the mobile-OS market in India. Earlier this year, a comprehensive study by German researchers found that low-cost smartphone brands running this OS often failed to update relevant software patches that guarantee user-security.

Additionally, there is little monetary incentive for OS providers to indefinitely support their old products. Low-cost device manufacturers, on the other hand, benefit from installing old systems, which are naturally cheaper as the level of support offered by OS providers is minimal. Indians have already suffered significant financial harm owing to the prevalent use of outdated OS on ATM machines. Consequently, the Reserve Bank of India mandated “immediate action” to control vulnerabilities from unsupported versions of OS running on ATMs, in June this year.

Lastly, some smartphone manufacturers bundle the consent provided by users while first accessing their devices, with blanket permissions given to pre-bundled software, aggravating the aforementioned risks. India’s imminent data protection law is expected to mandate separation of such consent requests from the standard device-level service terms and conditions. Although this is a commendable step, it may not reduce take-it-or-leave-it consent propositions. This is because consumers tend to value convenience over security, expecting established brands to underwrite their security.

It is evident that disallowing pre-bundling practices may lead to higher costs being passed on to consumers. This may not be a politically acceptable outcome. Therefore, India must rely on setting requisite quality standards for smartphones. Several international templates exist for this, such as ISO-approved Common Criteria standards. However, the sheer pace of digital adoption means that enforcement of such standards will remain challenging until the requisite testing infrastructure is developed. In fact, implementation of a comprehensive regime for mandatory certification and testing of smartphones and other devices, envisioned by the Department of Telecom, has been inordinately delayed owing to this infrastructural gap. This is an opportunity for building deeper public-private partnerships for Digital India, much like Smart-Cities, and scaling up testing infrastructure. Industry must participate meaningfully in building such capacity, a process that perhaps remains contingent on the State articulating a multi-stakeholder approach towards digital economy regulation.

Vivan Sharan is a Partner at Koan Advisory Group, New Delhi. The views expressed here are personal.

" Reimagining fiduciaries in the digital economy", Vivan Sharan and Sidharth Deb, Live Mint, 15 August 2018

The making of techno-commercial laws in India is often devoid of strong conceptual underpinnings. This is partly because the starting point for all legal drafting in the country is similar—we want to get the best of all worlds without any hint of compromise. Consequently, we end up with muddled outcomes that serve niche interest groups and confuse the rest. Additionally, as lawmakers pretend to be acutely attuned to local market realities, they also tend to characterize unclear outcomes as necessary instances of Indian exceptionalism. An aspirational India, with all its structural infirmities, often forgives them. However, the digital economy is less forgiving. Bad laws will be put to test and found wanting in much shorter feedback cycles.

In this context, much has been written about the draft Personal Data Protection Bill, 2018, and the accompanying explanatory report authored by the Justice Srikrishna Committee. To its credit, the committee has, prima facie, adopted a strong conceptual lens in both documents that seems to follow from the Supreme Court’s directions to ensure that individuals enjoy their informational privacy online. It has, therefore, proposed that the relationship between companies and individuals on the internet is akin to a fiduciary relationship. Users or consumers of internet services are called “data principals”, and data controllers or online businesses that provide such services have been deemed “data fiduciaries”. Although this seems like a robust point of departure for a framework determined to overcome the pitfalls of nebulous privacy policies, the conceptualization is riddled with several challenges which indicate that past mistakes are being repeated.

First, the framing of this intimate relationship between users and service providers was not part of wider stakeholder consultations. Unfortunately, this characterization of the relationship has a distinct irreversibility attached to it. Subsequent consultations, if any, are unlikely to revisit this central premise.

Second, the framing is also applied incorrectly. The committee borrows the concept from US constitutional scholar Jack Balkin’s work on “information fiduciaries”. According to this original theory, not all data controllers can be characterized as information fiduciaries. Only businesses with a wide scope of impact on society like social media companies, search engines and online transport aggregators, are classified as fiduciaries. Such a distinction feels intuitively correct, as common law equates fiduciary obligations with the highest standards of care. In contrast, the implication of the committee’s overbroad interpretation is that any business looking to scale digitally must invariably attract heightened fiduciary obligations.

Even if a reinterpretation of this concept is warranted under the premise of Indian exceptionalism, it should be explained. Instead, the Bill conveniently uses “data fiduciaries” as an umbrella term that has led to absurd outcomes. For instance, the Bill classifies all financial data as “sensitive personal data”. Sensitive personal data is the most intimate class of data associated with individuals in data protection laws globally. This is why 67 out of 68 countries studied by the Data Security Council of India do not categorize their financial data as “sensitive”. This is partly because such an interpretation can stymie innovation by restricting usage. In India’s case, financial innovation such as credit-scoring based on financial data can enhance key objectives like financial inclusion. Clearly, an overbroad conceptual underpinning has skewed important provisions.

In the committee’s defence, Balkin has himself proposed that countries can leverage his information fiduciary theory for law-making. The committee has taken this recommendation very seriously, at the expense of other recommendations. For instance, Balkin recommends a system wherein self-identified “information fiduciaries” can voluntarily accept greater responsibilities in exchange for economic incentives or legal benefits. For this, he proposes an approach akin to “safe-harbour” frameworks, which afford digital intermediaries fewer liabilities on complying with prescribed safeguards. India must begin to adopt similar nuance and flexibility in all techno-commercial frameworks, to provide an enabling environment for investments and growth.

Third, even if the fiduciary framework is conceptualized incorrectly, it stands to reason that the re-imagined concept must at least be applied consistently. In this connection, the committee’s normative push towards “data localization” warrants scrutiny. A natural corollary of the fiduciary obligation would be the expectation that businesses handle personal data in a manner which upholds basic security principles of confidentiality, integrity and availability. Towards this end, digital businesses tend to distribute data in disparate locations. This reduces concentration of risks in a single geography. However, with localization restrictions, cross-border data flows are artificially restricted, hampering such hedging operations. Therefore, in this case, the committee inadvertently undermines the fiduciary relationship and increases risk.

The committee also mandates exclusive localization of “critical personal data”, a class of data that is so strategic that the committee has left it to government to define. In a strange twist, this important data will in effect be made the most vulnerable to “single point of failure” risks that arise from concentration of data.

India’s new economy is hostage to old mindsets. The architects of our laws still value convenience over conviction and discretion over transparency. Some of this will change as consultations become more inclusive. But real change will only come with a fearless embrace of the future. For now, domestic consultations are reminiscent of global governance conversations, where India is often called in to complain once the conceptual basis for international rules are already established. It seems for the state, there is no irony in bringing this hypocrisy home.

Vivan Sharan and Sidharth Deb are technology policy experts based in New Delhi.

"Local Barriers to Global Ambition", by Vivan Sharan and Mohit Kalawatia, for CreativeFirst, 13 July 2018

Link to Article

Recently, India celebrated the first anniversary of its Goods and Services Tax (GST) regime. The GST was introduced with the intention of eradicating a bevy of taxes, to achieve a ‘one nation, one market, one tax’ framework. However, as an exception, local bodies such as municipal corporations and panchayats were afforded the ability to impose additional taxes to harness local revenue streams. At the outset, this carve out seems fair, particularly since India’s local bodies struggle to remain solvent despite corporatisation. Public services are rarely charged at rates that can sustain their effective delivery – for instance, citizens pay negligible amounts for waste collection in most municipalities. Conversely, indirect taxes make for better optics in populist politics.

Coterminous with the implementation of the GST, states such as Tamil Nadu, Kerala, Maharashtra, and Punjab, had passed legislations authorising their local bodies to levy such taxes. Perhaps the most egregious departure from the intended outcome of a unified tax regime is Tamil Nadu’s Local Authorities Entertainment Tax Act, 2017.

First, it is a well-settled principle in Indian jurisprudence, that any legislative action must first pass the test of Article 14 under the Constitution, which mandates ‘equality before law’. One facet of such an obligation on legislative authorities is the responsibility to act in a manner that is not arbitrary. While state legislatures can implement “class legislations”, these should be based on reasonable classifications. This means that although a state can treat different set of people differently, such treatment should be based on intelligible differentia and not on artificial or whimsical grounds. That is, such classification must be based on clear constitutional principles like those relating to social welfare.

Conversely, classification solely on the basis of language, having no nexus with defined social welfare outcomes backed by empirical data, violate the spirit of Article 14. Classification on the basis of language has also been recognised as discriminatory by the Supreme Court in Aashirwad Films vs Union Of India & Ors (2007).

Second, whether intended or not, the imposition of differential tax rates on films is reminiscent of industrial policy rather than an optimal process of tax administration. Perhaps without intending to, the local body is indulging in picking winners. Lower taxes on Tamil films may lead to viewership that is based on acute price sensitivity of Indian consumers, rather than quality cinema. This in turn, may reduce the competitiveness of Tamil films in the long run by creating an artificial demand.

Such protections also tend to underprepare local industries to respond to technological change and shifts in consumer preferences. For instance, broadcasters across European countries with strong “cultural protections” such as in France are struggling to adapt to digital markets.

Luckily, Indian broadcasters, which do not have to adhere to analogous local content quotas, have had no trouble anticipating and responding to digital realities. Millions of Indians of all ages now subscribe to Video on Demand platforms, created or supported by local broadcasters.

Third, the notion of “competitive federalism” for the tax administrator has always been inconsistent with the academic imagination of the term. In the early days of e-retail many state governments and local bodies copied each other, presumed a loss in revenue from the changes in local supply chains, and imposed additional taxes as offsets. With the GST, many of these actions were rationalised, but outliers like Tamil Nadu can always perpetuate another race to the bottom. This form of federalism is also antithetical to the imperative of promoting cultural diversity. Why should residents of Tamil Nadu, including minority groups from other parts of the country, have differential access to films from other states? What if other states follow suit?

Fourth, discriminatory taxation on films based on language could have several unintended consequences for India’s political interests abroad. From Afghanistan to Canada, and even in remote areas such as Mongolia, Indian cinema has helped the country punch above its weight in geopolitics. This is a core element of India’s “soft power”, often described as the ability to co-opt rather than coerce. But, the quality of Indian cinema must keep pace with global demand in the 21st century – which is witnessing shifts owing to digitalisation. India’s coercive defence sector capabilities are often unable to keep pace with its global ambition. Therefore, it is even more important than ready avenues for enhancing soft power are not throttled by regressive incentives.

But local bodies, which often struggle to address more mundane challenges such as double entry bookkeeping, cannot be expected to act strategically in the larger national interest. The Union Government should therefore issue appropriate guidance, and conduct trainings for legislators on the construction of rational tax regimes. While doing so, it should also call for lower taxes on production and co-production of local content, to enable greater supply of quality Indian cinema to all markets – local, regional and global.



- Vivan Sharan is a Partner at Koan Advisory Group, where he steers advocacy efforts. He is also a Visiting Fellow at the Observer Research Foundation, and a Member of the National Committee on Media & Entertainment, constituted by the Confederation of Indian Industry.

- Mohit Kalawatia is an Associate at Koan Advisory Group. He is a legal professional, looking at digital payments, financial markets, and corporate governance issues for the firm.

"Towards an India e-commerce policy", Live Mint, 26 June 2018

Link to article

The ministry of commerce is undertaking several rounds of consultations on an e-commerce policy framework for India. This is being done through a think tank constituted of “Indian” tech companies, relevant government bodies, industry associations, civil society and research institutions. The decision to constitute this think tank follows from both domestic and international compulsions. The domestic trigger is largely a fear of ceding the fast-growing e-commerce market to foreign interests, as exemplified by the rhetoric around the recent sale of Flipkart to Walmart. Simultaneously, India is under intense pressure to negotiate international rules on e-commerce under the World Trade Organization (WTO). Naturally, this think tank must carefully evaluate intersections between future domestic and international policy frameworks.

While the e-commerce think tank is ostensibly supposed to be of a multi-stakeholder format, some voices are louder and more prominently represented than others. Accompanied by the facts that the history of the Indian private sector’s policy demands from government is chequered with short-termism, and that policy research on the exigencies of the “new economy” is still in its infancy, the government has its task cut out.

To be fair, many within the government recognize that a sober and holistic assessment is required to balance domestic and international concerns, particularly since e-commerce is already shaping the new contours of international trade. For instance, e-commerce has featured in high-level discussions on each of the mega-free trade agreements, including the Regional Comprehensive Economic Partnership (RCEP) of which India is a part. India has resisted the inclusion of e-commerce in RCEP, a position backed by domestic mercantile lobbies. More importantly, the WTO also anticipated a high degree of global attention to e-commerce and established a related “work programme” in 1998. Despite its high stakes in the multilateral system and now also in digital markets, India has maintained a reticent stance even in this forum.

The WTO work programme covers different aspects of e-commerce not limited to e-retail. It examines issues arising from “the production, distribution, marketing, sale or delivery of goods and services by electronic means”, which is the de facto multilateral definition of e-commerce. India has only played a nominal role in the work programme, even though the discussions are consultative in nature. Perhaps limited engagement is a function of the lack of specialist capacity within government, which may partly be overcome through lateral entries. But this capacity building will take time. Meanwhile, Indian negotiators were caught completely off-guard at the 11th WTO ministerial conference last year. Over 70 countries advocated for formal introduction of e-commerce related issues into the Doha Round of negotiations, in a marked departure from disaggregated advocacy through the US and EU-led interest groups in the past.

In days when globalization worked in the favour of advanced countries, they favoured this system over all others. Today, countries such as the US are virtually abandoning multilateralism in favour of a reversion to exceptionalism and mercantilism. It is up to large developing economies such as India to sense and respond to the winds of change. The country must become a propositional leader in the multilateral sphere, rather than embracing inertia or negativity. This transition will require internal clarity on economic and political goals, with well-defined milestones to achieve them.

To begin with, the think tank should adopt an appropriate definitional framework for accommodating a broad vision of e-commerce. India’s operating definition of e-commerce derives from foreign direct investment policy, according to which: “e-commerce means buying and selling of goods and services, including digital products over digital and electronic network(s)”. This is a very narrow point of departure, envisioned only for e-retail through a “marketplace-based” model. And marketplaces are disallowed from influencing the price of goods or services. Consequently, it is possible to interpret that several services-driven e-commerce companies, such as those operating taxi-aggregation services, currently function in violation of policy. The extant definition also excludes data-driven internet companies which do not engage in front end transactions. A broader approach will help establish greater policy certainty which can drive economic growth.

The recommendations of the think tank should also uphold WTO principles such as “national treatment”, to preserve the larger multilateral ethos. Most bilateral investment treaties inked by India also include national treatment clauses, which prevent discrimination between foreign and domestic investments. The think tank could easily seek support for Indian companies, which no foreign entity could call out as discriminatory, such as asking for fiscal farsightedness within an accommodative tax policy or scientific research grants for the tech sector. Earlier in May, the Delhi high court refused to restrain international arbitration initiated by Vodafone and underlined that India should not invoke domestic law for its failure to perform international obligations. The think tank must therefore suggest ways that will insulate India from future international proceedings, and help the government signal that the country is open for business on fair and equitable terms.

Vivan Sharan is partner at Koan Advisory Group, New Delhi. These are his personal views.