India stands at the crossroads of innovation and regulation in the implementation of DPIs.
During its G20 presidency, India positioned digital public infrastructure (DPI) as a technology-enabled instrument for inclusive and sustainable development. DPI’s distinguishing characteristics of openness, interoperability, and scalability underscore its criticality beyond technology to the larger goals of public and private service delivery. DPIs can be broadly grouped into two categories: Foundational and sectoral.
Typically, foundational DPIs such as Aadhaar, UPI, and Data Empowerment and Protection Architecture (DEPA) are developed to create robust digital rails and span the domains of digital identity systems and payment infrastructure, and data exchange platforms. Sectoral DPIs provide specialised services tailored to the needs of specific sectors. Examples include the Ayushman Bharat Digital Mission, which is the rails for the provision of universal health coverage. A notable DPI success story is the CoWIN platform, which utilised Aadhaar-based authentication to facilitate the administration of more than 2.2 billion Covid-19 vaccines.
The transformative impact of India’s DPI initiatives is so pervasive that it is taken for granted. India has achieved over 1.3 billion Aadhaar enrolments and carries out over 10 billion UPI transactions monthly. Its continuing endeavours in this area were highlighted in the Finance Minister’s budget speech, which proposed the development of DPI applications in the areas of “credit, e-commerce, education, health, law and justice, logistics, MSME, services delivery and urban governance”. Despite their success and expansion to newer sectors, there are some issues that need to be examined.
DPIs serve a platform-like role, that is, they provide a network or gateway that enables other entities to “plug and play” by building digital applications or services on these rails. They enable rapid innovation and value creation at scale through public-private partnerships. DPIs are essentially multi-sided platforms, where the value of the platform on one side increases with the increase in the number of participants on the other side. These inherent network effects of DPIs can lead to winner-takes-all outcomes, resulting in the creation of monopolies or oligopolies. For instance, the UPI payment system has resulted in the creation of a virtual duopoly of service providers. Participants captured these zero-price markets while harvesting vast amounts of user data over time. Data is a shareable modular input that may allow these firms to expand into adjacent markets, such as retail lending, by leveraging their position in the DPI market and creating digital ecosystems. Such private ecosystems may pose a number of competition issues typical of platform-centric markets.
Given that the emergence of DPIs is a policy response intended to create meaningful competition, the risk of DPIs causing market concentration needs to be mitigated. India’s G20 Task Force on Digital Public Infrastructure also discussed several key aspects of competition and regulation of DPIs. The report emphasises the importance of creating a level playing field for all participants in the digital ecosystem to ensure that no single entity has undue control or influence over the digital infrastructure. The task force highlighted the need for regulatory frameworks that can adapt to the evolving digital landscape in order to address issues such as data privacy, security, and interoperability and competition.
There are other significant concerns related to data usage, innovation, and indeterminate risk-reward sharing frameworks. Concerns regarding the privatisation of public data, data security, and data privacy arise due to the operation of private entities in the absence of a contractual or regulatory framework. An examination of the innovation trajectories encouraged by these DPIs is also essential to understand whether these government-supported initiatives are inadvertently entrenching private entities without any guardrails. In such PPPs, the delineation of the obligations of both public and private entities is essential due to their scale, complexity, and public interest. The government can draw on its extensive experience with PPPs to create appropriate governance frameworks, similar to Model Concession Agreements that are used in the development of highways and ports.
India stands at the crossroads of innovation and regulation in the implementation of DPIs. Private firms bring innovation and speed of execution due to their autonomy, but they may be operating in a regulatory vacuum. A robust framework of checks and balances, which protects public interest without hampering private innovation, is essential. This demands an effective techno-legal governance framework through a coordinated effort between technology developers and policymakers.
Digital infrastructure should be seen as basic infrastructure, where the state has a critical role to play, and an instrument of industrial policy akin to roads, airports, and electricity. Given DPIs are a recent development and that their full potential has not been realised, controlling them fully through a rigid legal framework might hamper their growth. Soft law instruments which involve guidelines encouraging industry best practices and rely on broad principles rather than prescriptive rules would be better suited. Some of the key guardrails contained in soft law, such as data encryption, access restrictions, and mandating user consent for data usage, can safeguard the interests of the public.
The unbridled operation of such a crucial pillar of the digital economy outside the limits of sovereign control may have undesirable economic and social consequences. One approach would be segregating the key aspects of DPIs into those that are best governed through statutory or contractual frameworks and those governable through soft law. A more considered and clearly defined approach to govern the private actors riding on the infrastructure component of DPIs would significantly aid in fully realising their transformative potential without creating disruptive risks to society.
Malik is visiting professor and Jagadeesh, is fellow (consultant), ICRIER
