Stakeholders’ responses to the TRAI privacy consultation paper (Part V of XII): Technology-enabled audit mechanism

This is the fifth post, in a twelve (12) part series of posts, to map the opinions of all the stakeholders on the basis of their responses to the consultation paper on Privacy, Security, and Ownership of the Data in the Telecom Sector (Consultation Paper) published by the Telecom Regulatory Authority of India (TRAI) on 9th August, 2017.

In order to address key data privacy and security issues, the TRAI framed twelve (12) questions and invited comments to these questions. In total, fifty-three (53) stakeholders submitted detailed responses. Comments of all stakeholders are available here. Our comments to the Consultation Paper are available here.

The mapping of stakeholders’ opinion, and the analysis of such mapping, is based on the interpretation of all the responses to the Consultation Paper. A few details may have been lost during the interpretation of the responses. All suggestions, requests, and comments, to rectify any such omission(s) or error(s) in this exercise, are duly invited.

“Q. 4 Given the fears related to abuse of this data, is it advisable to create a technology enabled architecture to audit the use of personal data, and associated consent? Will an audit-based mechanism provide sufficient visibility for the government or its authorized authority to prevent harm? Can the industry create a sufficiently capable workforce of auditors who can take on these responsibilities?”.

The concerns in relation to the creation of a technology enabled audit mechanism, raised by stakeholders in their responses to abovementioned question 4 of the Consultation Paper, broadly relate to the effects of such a mechanism on innovation and ease of doing business, economic costs and its effectiveness in resolving concerns of abuse of user data.

The following table projects the stance of the stakeholders on whether a technology enabled architecture ought to be created to audit the use of personal data and associated content.

*Industry Associations: IAMAI – Internet & Mobile Association of India, ACTO – Association Of Competitive Telecom Operators, ACT – Association for Competitive Technology, ASSOCHAM – Associated Chambers of Commerce and Industry of India, COAI – Cellular Operators Association of India, GSMA – Groupe Speciale Mobile Association, ISPAI – Internet Service Providers Association of India, NASSCOM-DSCI – National Association of Software and Services Companies – Data Security Council of India, USISPF – U.S. India Strategic Partnership Forum, ITI – Information Technology Industry Council, USIBC – US India Business Council, BSA – Business Software Alliance, EBG – European Business Group Federation, BIF – Broadband India Forum, ISACA – Information Systems Audit and Control Association, iSPIRIT – Indian Software Product Industry Round Table.

**Telecom Service Providers: AT&T Global Network Services India Pvt. Ltd., RJIL – Reliance Jio Infocomm Limited, MTNL – Mahanagar Telephone Nigam Limited, TTL – Tata Teleservices Limited, BSNL – Bharat Sanchar Nigam Limited.

***Civil Society Organisations/ Think Tanks: NLUD – National Law University, Delhi,  IDP – Internet Democracy Project, CIS – The Centre for Internet & Society, ITfC – IT for Change, SFLC – Software Freedom Law Centre, FCSO – Federation of Consumer and Service Organization, CUTS – Consumer Unity and Trust Society, CGS – Consumer Guidance Society, CPA – Consumer Protection Association, IFF – Internet Freedom Foundation.

The following table projects the stance of the stakeholders on whether an audit-based mechanism provides sufficient visibility for the government or its authorized authority to prevent harm.

The following table projects the stance of the stakeholders on whether the industry can create a sufficiently capable workforce of auditors who can participate in technology enabled architecture to audit the use of personal data, and associated consent

INSIGHTS

• Creation of a technology enabled architecture to audit the use of personal data and associated content:
  • 3% of all stakeholders opined that a technology enabled architecture should be created to audit the use of personal data and associated content.
  • 34% of all stakeholders stated that a technology enabled architecture should not be created to audit the use of personal data and associated content.
  • 8% of all stakeholders said that a technology enabled architecture should be created to audit the use of personal data and associated content, but only if it is an industry driven solution and not a government solution.
  • 17% of all stakeholders did not address this issue or failed to do so in a clear manner.
  • 25% of the industry associations, 50% of the TSPs, 33.33% of the companies/firms, 75% of the civil society organisations/think tanks and 66.67% of the individuals agreed that a technology enabled architecture should be created to audit the use of personal data and associated content.
  • 25% of the industry associations, 40% of the TSPs, 25% of the companies/firms and 16.67% of the civil society organisations/think tanks were against the creation of a technology enabled architecture to audit the use of personal data and associated content.

• VIsibility provided to the government or its authorized authority, as a result of the creation of a technology enabled audit mechanism, to prevent harms:
  • 8% of all stakeholders stated that a technology enabled architecture will provide sufficient visibility to the government or its authorized authority to prevent harms.
  • 7% of all stakeholders opined that a technology enabled architecture will fail to provide sufficient visibility to the government or its authorized authority to prevent harms.
  • 6% of all stakeholders did not address this issue or failed to do so in a clear manner.
  • 25% of the industry associations, 20% of the TSPs, 25% of the companies/firms and 41.67% of the civil society organisations/think tanks said that a technology enabled architecture will provide sufficient visibility to the government or its authorized authority to prevent harms.
  • 25% of the industry associations and 16.67% of the companies/firms said that a technology enabled architecture will not provide sufficient visibility to the government or its authorized authority to prevent harms.

• Capacity of the industry to create a sufficiently capable workforce of auditors who can take on these responsibilities:
  • 4% of all stakeholders said that the industry can create a sufficiently capable workforce of auditors who can take on these responsibilities.
  • 8% of all stakeholders opined that the industry cannot create a sufficiently capable workforce of auditors who can take on these responsibilities.
  • 8% of all stakeholders stated that the creation a sufficiently capable workforce of auditors who can take on these responsibilities is unnecessary.
  • 66% of all stakeholders did not address this issue, or failed to do so in a clear manner.
  • 5% of the industry associations, 40% of the TSPs, 25% of the companies/firms, 25% of the civil society organisations/think tanks and 66.67% of the individuals agreed that the industry can create a sufficiently capable workforce of auditors who can take on these responsibilities.
  • Amongst the companies/firms, 8.33% opined that the industry cannot create a sufficiently capable workforce of auditors who can take on these responsibilities and 16.67% said that the creation a sufficiently capable workforce of auditors who can take on these responsibilities is unnecessary.

Detailed Mapping of Responses

A detailed mapping of the responses of all the fifty-three (53) stakeholders, including the stances of the stakeholders, their response to question four (4) of the Consultation Paper and the suggestions they have made to the TRAI in view of the question, is available here.

[This post is authored by Sushma S. Babu, a fourth year undergraduate student of HNLU, Raipur, under the guidance of Pushan Dwivedi (Associate, TRA) during her internship with TRA].