Data anonymisation: Karnataka studying Centre's draft guidelines

Karnataka has been asked by the Union government to send its inputs on draft guidelines on anonymising personal data belonging to citizens, a key prerequisite for data monetisation, an area in which the state government is seeking policy-level clarity.

“The possibilities going forward could be both fascinating and scary,” the draft guidelines say, stressing on the importance of data anonymisation as a “positive-sum action to balance privacy protection and unhindered processing.”

Anonymisation is a technique that removes any attributes in data that can be used to trace the person to whom it belongs. The masking of an Aadhaar number is a simple example.

The draft guidelines, prepared by a working group put together by the Centre for Development of Advanced Computing (C-DAC), are expected to help Karnataka get clarity on data anonymisation, which could prod the government to plan data monetisation.

Read | Is India at risk of Chinese-style surveillance capitalism?

Sitting on a treasure trove of citizen data, Karnataka is in the early stages of exploring data monetisation options. Last year, the government notified the Karnataka Open Data Policy, which states that only anonymised personal data will be monetised.

Recently, while providing inputs on the draft National Data Governance Framework Policy (NDGFP), Karnataka asked the union government to provide legal backing to monetise public data.

“...digital transactions reveal a part of our life that gets digitised and recorded and can be used to build profiles. Such actions include the use of public services, our social media exchanges, shopping patterns, location and movement, fitness pursuits or digital content consumption behaviour,” the draft guidelines say.

The draft also warns of privacy risks. “Unauthorised access, disproportionate surveillance, identity theft, financial frauds, blackmail & extortion using personal information, 360-degree profiling are some of the emerging challenges for society at large. In addition, large scale data breaches are rampant and present a significant challenge...” it says.

The union government’s draft guidelines - currently hosted on egovstandards.gov.in for feedback until September 21 - comes even as data scientists are warring over the effectiveness of data anonymisation.

“Anonymisation of personal data is possible in many circumstances, but it should not be seen as a silver bullet to tackle data privacy risks... It seems practically impossible to conclude that a particular technique will be 100% effective in protecting the identity of data principals (citizens),” the draft says.

According to the draft, anonymisation techniques include: attribute suppression, character masking, pseudonymisation/coding, data swapping, record suppression, generalisation and so on.