2022 brought back the wonder years of internet – with curiosity led innovation

2022 brought back the wonder years of internet – with curiosity led innovation

Three key tech-policy reforms in 2023 offer a rare opportunity to create an innovation-friendly regulatory environment.

The year 2022 witnessed a renaissance of curiosity-led innovation in digital markets. Most notably, ChatGPT, a “generative Artificial Intelligence” chatbot powered by Microsoft-backed research laboratory OpenAI, went viral. Many analysts say ChatGPT has the potential to upend the search-engine market, which was previously thought to be near impossible given Google’s two decades of dominance.

It may be tempting to view such developments as aberrations.

However, as we enter 2023, the sudden rise of generative AI serves as a useful reminder that technological innovation will always disrupt the status quo and outpace incumbents.

India’s policymakers should take a cue from the unbounded potential of innovation and seek to enable it via three key tech-policy reforms already slated for 2023. These include the draft Indian Telecommunication Bill, the draft Digital Personal Data Protection (DPDP) Bill, and the forthcoming Digital India Bill.

Future-proof data protection

First, the new telecom Bill is intended to bring telecom regulation into the digital era. However, the Bill’s expansive mandate may create hurdles to innovation. It specifically opens the grim prospect of a licensing regime for over-the-top (OTT) communication apps such as WhatsApp and Signal. In doing so, the Bill conflates different classes of services (those distributing spectrum and those distributing internet-based services) and potentially brings them under the same licensing scheme.

The difference between traditional telecom services and OTT services is that, unlike spectrum – a rivalrous resource that can be distributed by only a limited number of players – the internet is not scarce. Therefore, there is little justification to bring applications that run atop it under licensing that can throttle innovation by creating barriers to entry for new players. In fact, the Telecom Regulatory Authority of India (TRAI) echoed this view as recently as 2020.

Second, the DPDP Bill is ostensibly a principles-based compliance framework for data fiduciaries (i.e businesses that collect and process data), which also seeks to enable cross-border data flows. The internet is borderless in its conceptualisation, and access to global markets is imperative for innovation to flourish. Thus, cross-border data flows play a crucial role in driving more innovation.

However, the government exercises discretion to whitelist trusted jurisdictions, which will only allow such flows from some jurisdictions. This whitelist is based on as yet unpublished criteria. For comparison, even imperfect data protection frameworks such as the European Union’s General Data Protection Regulation lay down definite principles that permit cross-border data flows. India must also specify some objective principles to whitelist other jurisdictions to enable businesses to plan prospectively.

India also requires a future-proof data protection architecture that considers the evolutionary nature of internet apps. For instance, the centrality of a “notice and consent”-based framework to process personal data, as outlined in the DPDP, is outmoded. This concept originated in the 1990s with the enactment of “informed consent” in healthcare.

It is insufficient for an immersive internet powered by cloud computing, AI, and extended reality because it burdens users with obligations to understand how their data is used. Even technologists find it hard to imagine the end-use of all personal data collected in future metaverses. India should instead prioritise concepts like privacy-by-design that nudge businesses to truly empower users rather than issue notices for the data they collect at every turn.

Finally, India is all set to replace the Information Technology (IT) Act, a 22-year-old legislation that currently anchors the country’s internet regulation, with the Digital India Bill. All indications are that the new regime will prioritise concepts like “accountability” through tighter compliances for intermediary services such as social media and video-on-demand.

Moreover, reports suggest that the Digital India Bill may pave the way for category-based rules for intermediary services. But, if such rules are too prescriptive or narrow, they may inadvertently create category-wise lock-ins. For instance, gaming companies may prefer not to introduce product innovations such as social media within their games, for fear of additional compliance. The point is, large incumbents across different intermediary service categories may be well placed to respond but new entrants will find it difficult to comply as their business models evolve continuously and occupy different categories.

India should instead seek to foster innovation on the bedrock of a new kind of “safe harbour” for intermediaries. Safe harbour in internet regulation guarantees legal immunity for businesses that act as conduits of information and content in exchange for good design practices such as the removal of illegal content. This regulatory concept originated in the US in the mid-1990s and is credited with giving rise to the modern internet as we know it.

This concept requires reimagination in the face of previously unimagined scale of online intermediation, as well as novel complexities that follow from the rise of decentralised applications of ‘Web 3.0’. India should foster risk-based and activity-based triggers for intermediaries’ liabilities in exchange for safe harbour.

A legal-regulatory environment that prioritises and fosters innovation can catalyse a billion users’ participation in India’s ‘techade’. The three upcoming Bills discussed here offer a once-in-a-decade chance to enable this. Policymakers would do well to recognise this opportunity and embrace the innovation potential of technology, which continues to surprise even tech sceptics.