Give the account aggregator system a privacy upgrade

A software fix exists that can enforce India's privacy law on users of this financial data sharing network

- RAHUL MATTHAN

As regular readers ofthis column will know by now, Ihave long advocated the benefits of embedding regulatory principles directly into digital infrastructure. Having worked on different versions of India's digital public infrastructure, I have come to see, first-hand, how well this techno-legal approach addresses the many challenges that will arise in the context ofa rapidly digitizing economy. When I discuss these ideas in public, the example I often give is of India's Account Aggregator framework-the consent-based, data sharing system that has now processed nearly 125 million 'consents, and enabled all manner of financial products. It exemplifies the approach I am talking about by demonstrating how data protection principles can be incorporated directly into the design of digital infrastructure. In order to process the personal data of a data principal, the data fiduciary must first obtain her informed consent. In particular, the data fiduciary must inform the data principal ofthe purposes for which such data will be processed and can only collect as much data as is strictly necessary to fulfil the stated purposes. No data can be retained for longer than is strictly necessary in order to satisfy specified purposes and it cannot be used for any purpose other than those for which consent has been obtained.