The government's 'DEPA for AI Training' framework, designed to accelerate AI development, is facing backlash for potentially sidelining individual data rights. Critics warn the policy shifts control to institutional fiduciaries, creating uncertainty for data privacy and corporate governance in the AI space.
The Ministry of Electronics and Information Technology (MeitY) recently introduced the 'Data Empowerment and Protection Architecture (DEPA) for AI Training,' a framework intended to unlock large volumes of data for artificial intelligence development. The government aims to leverage this architecture to support its target of contributing $500 billion in AI-driven value to India's GDP by 2030. However, the policy has encountered significant pushback from legal experts and privacy advocates who argue it may compromise the foundational principles of user autonomy.
The Shift in Decision-Making
At the core of the controversy is a concern regarding who controls user data. Under the traditional DEPA model, data principals—the individuals whose information is being used—were supposed to maintain direct control over data usage. The new AI training framework, however, appears to centralize decision-making authority within 'institutional fiduciaries,' such as banking and healthcare organizations. Critics argue that this transition effectively replaces individual consent with institutional mandates, a move they claim is not feasible for AI training at scale.
While the government suggests that 'secure data environments' will act as a safeguard by allowing AI models to travel to the data rather than extracting raw information, the effectiveness of these tools is being debated. Observers are questioning whether these technical safeguards are being used to bypass the necessity of genuine user consent rather than to protect it.
Implications for Institutional Fiduciaries
For companies operating in sectors like banking, finance, and healthcare, this framework introduces a new layer of complexity. If these institutions are tasked with curating and preparing datasets for AI training, they may face heightened regulatory scrutiny and the need for robust AI governance. This includes managing risks related to data privacy, such as the potential for 're-identification'—where anonymous data is reverse-engineered to identify individuals—and ensuring compliance with evolving standards like the RBI’s FREE-AI framework.
There is also a broader question of how these institutions will balance their role as data fiduciaries with the operational demands of AI development. For investors, the long-term impact on companies in these sectors will depend on how clearly the government defines liabilities and whether it can effectively address concerns regarding data ownership and benefits sharing. Currently, there is little provision in the framework to ensure that individual data owners receive tangible benefits, such as royalties, which may lead to future friction if public trust erodes.
Monitoring the Regulatory Landscape
Moving forward, the primary monitorable for the market is how the government responds to these criticisms and whether it introduces clarifications that reconcile the 'user control' narrative with the 'institutional fiduciary' reality. Companies adopting this framework will need to navigate potential reputation risks and ensure their AI governance policies can withstand both regulatory and public scrutiny. Investors may watch for further updates on implementation timelines and any specific compliance requirements that arise for large data-holding institutions.