Context: To achieve data sovereignty number of countries have been looking to extend their existing data protection frameworks to ensure that users have more effective control over their data.

• These new measures will make it easier for data to flow from the entity that currently holds it to any other data business that might want to use it with the permission of the data subject.
• One such framework is Data Empowerment and Protection Architecture (DEPA).
• It promises to be the techno-legal solution that can unlock value in data sharing by giving users more control over their data. This control not only results in increased competition but also fosters innovation. 

Background

• At a high-level ministerial meeting recently, seven countries came together to endorse a techno-legal approach to data regulation.
• The participating delegates committed to exploring how technical frameworks such as Data Empowerment and Protection Architecture (DEPA) could be incorporated into the EU’s Data Act and Australia’s Consumer Data Rights policy to enable more effective outcomes.

How a revolution is going on in data regulation?

Free flow of data: In Australia, Consumer Data Right, is shaping up. It will allow consumers in Australia to require any business with which they have a commercial relationship to transfer that data to any other business of their choice.

• The European Union (EU) has begun to put in place a series of legislative proposals that allow users more efficiently transfer data from one data business to another.

Data Governance: The EU’s proposed Data Act is intended to implement measures that will create a fairer data economy by ensuring better access to and use of data.

• The EU has also drafted a Data Governance Act, which when enacted will govern the data exchanges and platforms that will form the infrastructure through which data holders will be connected to data users.

Significance

• These new regulations will thus both enable and regulate new data sharing arrangements that will intermediate the transfer of data from data businesses which currently hold it to those that have been permitted to use it.
• They also suggest that it is not enough to protect data if you cannot also ensure that this data is effectively utilized—either for the benefit of the person to whom it pertains or society as a whole.

Challenges

• Catching up with technology: Modern data businesses are powered by technology. Technology determines how data is collected, processed and used, and, by extension, the manner in which it is transferred. 
• Laws and regulation simply cannot keep pace with changes in technology. New consumer-centric measures are likely to fail if they are to be implemented solely through legislation.

India’ case

• Sector Wise approach: India has adopted a slightly different approach to data transfers. It is being implemented sector-wise through a set of open, interoperable protocols. 
• This framework is known as the Data Empowerment and Protection Architecture (DEPA), offers a technology-based solution for consent-based data flows, allowing users to transfer their data from data businesses that currently hold them to those that want to use them. 
• DEPA is a joint public-private effort for an improved data governance approach. 
• It creates a digital framework that allows users to share their data on their own terms through a third-party entity, Consent Managers.
• DEPA is being tested in the health sector, as well as others.Recently, the country’s Account Aggregator framework—the first implementation of DEPA—went live in the financial sector.

Solutions 
Techno-legal approach

• Use techno-legal approach to regulate: Technology businesses are most effectively regulated through a judicious mix of law and technology—strong, principle-based laws to provide the regulatory foundation, with protocol-based guardrails to ensure compliance.
• Seven countries came together to endorse a techno-legal approach to data regulation. If successful, this would be the first global attempt to adopt a techno-legal solution for data-transfer regulation.