Data is the new soil; dignity must be its first crop

In May 2017, The Economist ran a cover story under the headline 'The world's most valuable resource is no longer oil, but data.' The metaphor became canonical; it was also wrong. Oil burns once, leaves a residue, and is gone. Data, by contrast, multiplies, replicates, persists beyond the person it describes, and can be replayed against her, repeatedly, decades after the moment of capture. A better image is therefore that data is the new soil. From the same soil one can grow either food or feudalism. The choice of crop is not technical; it is political. In the Anthropocene of algorithms, India's distinctive contribution to the world must be a data civilisation rooted in dignity, not extraction.

The constitutional grounding for that civilisation was laid by a nine-judge bench of the Supreme Court on 24 August 2017. In K. S. Puttaswamy v Union of India, the Court held unanimously that the right to privacy is a fundamental right under Article 21, woven inseparably into the right to life and personal liberty. The Aadhaar judgment of 26 September 2018 followed, limiting Aadhaar use to subsidies, benefits, and services and striking down its mandatory linking with bank accounts and mobile numbers. The journey to a comprehensive data-protection statute began with the B. N. Srikrishna Committee, constituted in 2017 and reporting in July 2018. The Personal Data Protection Bill of 2019 was withdrawn after a Joint Parliamentary Committee report in 2021; the Digital Personal Data Protection Act of 2023, India's first comprehensive privacy statute, was finally enacted on 11 August 2023. It establishes consent as the lawful basis of processing, recognises rights of access, correction, erasure, and nomination, creates a Consent Manager intermediary, and establishes a Data Protection Board with adjudicatory powers.

The architecture on which DPDP must rest is the most ambitious public-digital infrastructure built in any country. Aadhaar, with 138 crore enrolments, is the world's largest biometric ID system. UPI (Unified Payments Interface), launched in April 2016, crossed 14 billion transactions a month by mid-2024 and handles roughly half of the world's real-time payment volume. DigiLocker, the cloud-based document repository, has 21 crore users storing over 600 crore documents. The Account Aggregator framework, operationalised by RBI in 2021, enables consent-based sharing of financial data across 1.4 lakh financial institutions. ONDC (Open Network for Digital Commerce), launched in beta in April 2022, completed its 100 millionth transaction by mid-2024, with a network of 5 lakh sellers and 12 lakh active products. Ayushman Bharat Digital Mission, rolled out from September 2021, has issued 67 crore ABHA (Ayushman Bharat Health Account) IDs and is the operational backbone of the National Digital Health Mission.

This is, by any measure, the world's most populous data-citizen civilisation. The question is whether it will also be the most dignified one. The dignity test has produced mixed results. The Aadhaar-linked PDS exclusion documented by Jean Dreze and Reetika Khera in 2019 in Jharkhand and Rajasthan, where biometric authentication failed for worn fingerprints or absent connectivity, denied food to people who needed it most. The Pegasus revelations of 2021, in which Israeli NSO Group's spyware was found on the phones of journalists, activists, judges, and politicians, exposed a surveillance gap that the IT Act of 2000 does not adequately address. Deepfake non-consensual imagery of women has surged; the Rashmika Mandanna controversy of November 2023 is a symptom of a deeper architectural problem.

The DPDP Act makes a substantial start. Section 8 mandates security safeguards. Section 9 protects children's data. Section 12 establishes the right to erasure. Section 27 creates the Data Protection Board with civil penalties up to Rs 250 crore. Section 17 carves out State exemptions on grounds of national security and public order, wider than EU GDPR analogues, drawing both criticism and operational realism. The EU GDPR is the floor; India's task is to design a richer ceiling, not a lower floor.

A serious counter-argument is that strict data laws strangle innovation. Nasscom estimated in 2023 that DPDP compliance would cost Indian startups Rs 3,000-10,000 crore. The argument has force; small firms find data-protection officers, breach-notification protocols, and audit obligations expensive. But trust is also a market. The European Commission's 2024 review estimated a 'USD 200 billion data-trade premium' from GDPR-trusted status. Indian IT services exports, crossing USD 250 billion in FY24, depend on trust as much as technical skill. Dignity and growth are co-investors, not enemies.

The deeper question is whether data, as the new soil, is held in common or enclosed. Aadhaar, UPI, DigiLocker, ABHA were built as Digital Public Infrastructure, public rails on which private firms compete fairly. Compare the United States, where the equivalent is privately owned: Google for identity, Visa-Mastercard for payments. The DPI model has been adopted by 100-plus countries through MOSIP and the Global DPI framework, articulated at the G20 Delhi Declaration of September 2023. The challenge is to ensure DPI does not become coercive; opt-out must be real, alternatives credible.

What might full implementation look like? The DPDP Rules must operationalise the Consent Manager framework, the Data Protection Board's procedures, and cross-border data transfer rules. The proposed Digital India Act should consolidate IT Act, IT Rules 2021, and the Telecommunications Act 2023. The Personality Rights Bill should address deepfake harms. The DPDP Act's national-security exemption must be narrowed in line with the Puttaswamy proportionality test. Mission Karmayogi should add a data-protection module for civil servants.

Tagore wrote, in The Religion of Man, that 'you cannot cross the sea merely by standing and staring at the water.' India must cross the data sea; the alternative is to be left at its shore while others trade across it. But the crossing must be by a vessel called dignity. A republic which protects its citizens' faces, voices, fingerprints, and futures is not slowing innovation; it is qualifying it. The Indian data civilisation will be measured not by how many ABHA IDs are issued or how many UPI transactions clear per second, but by whether the rickshaw-driver in Patna feels his face on a surveillance feed is as protected as the CEO's in Bandra. Data is the new soil; the first crop India must grow on it is dignity, because every other crop, growth, inclusion, exports, depends on the same root system. The work of the next decade is to lay that root system deep. The Constitution gave us the ground. The DPDP Act has tilled the first furrow. The harvest will be measured in the trust of 1.4 billion citizens, and in the kind of republic that emerges when each of them owns the data that describes her.