Homo Digitalis №11 | Social audits and reflections on the false privacy/transparency dichotomy

Hello,

I am back after a long hiatus with the eleventh issue of this newsletter. It is a break from my usual focus on elections and AI, and focuses instead on recent reflections on the privacy/transparency dichotomy in the welfare disbursal sector in India.

Two months back, I spoke at Internet Freedom Foundation’s well-curated annual #PrivacySupreme event. Unlike their usual format, this was held in an unPanel structure with unmoderated short 15 minute speeches from all panelists, with two sets of Q&A punctuating them. The highlight of course was the keynote address by Justice Muralidhar who took us on a historical journey of the Puttaswamy case which eventually led to a clear and emphatic reading a fundamental right to privacy by the Indian Supreme Court. This newsletter is inspired by a specific intervention made by Nikhil Dey in his excellent and grounded presentation on privacy and welfare.

Public disclosure of Aadhaar Numbers

In 2017, while at the Centre for Internet and Society, India, I worked with Srinivas Kodali, one of the most tireless digital rights activists in India to document the state of unethical and illegal public disclosure of Aadhaar Identity numbers and related financial information such as bank account numbers by four central and state government websites. The staggering scale of these disclosures, which we estimated to be corresponding to about 130 million people in India, took everyone, including us by surprise.

The report coincided with hearings in the Supreme Court in the Puttaswamy matter, at the time dealing with the limited question of mandatory linking of Aadhaar number with PAN, India’s tax identification number for annual income tax filings. The report was covered widely in the media, and led to the immediate introduction of new regulations on encryption and other safeguards for Aadhaar numbers. It was also alluded to in arguments before the Supreme Court of India and later Delhi High Court and in deliberations in the Parliament.

A direct result of this report was the long engagement it led Srinivas and me into with RTI and Right to Food activists, like Nikhil Dey, on the virtues of publishing or removing personal details of government officers and beneficiaries from public domain.

Social Audits of Benefits Disbursal

One of the most significant victories of the Indian civil society in this century has been the enactment of the Right to Information Act, a culmination of efforts of the transparency movement during the Manmohan Singh led UPA government. Much is made of the populist digital welfarism of the Modi government. However, significant strides towards rights to food and employment were made during the UPA era.

The on-the-ground movement led by organizations like Mazdoor Kisan Shakti Sangathan (MKSS) has long fought for minimum wage in Rajasthan. From the mid-1990s, the MKSS-led demand for entitlements took the form not on issues of food, water and shelter, but was framed as a demand for information. The selfless leaders of MKSS like Nikhil Dey, Aruna Roy and Shankar Singh saw the opacity which enabled systemic corruption as the lever which needed to be moved. As we moved towards an increasingly digitized country, the idea of the right to information as pre-condition to other rights and entitlements made perfect sense.

The transparency obligations under the RTI Act mandated the publication of department and ministry level information, which included the details of entitlements of beneficiaries, the officers responsible at different stages of the lifecycle for disbursal of rations and wages. The periodic reports published under this transparency obligations had become the basis for rigorous social audits conducted by the civil society activists to identify, highlight and seek redress for instances of non-disbursal.

When Srinivas and I reviewed the public available spreadsheets with Aadhaar Numbers and other sensitive financial information, it were precisely these reports published under the transparency obligations which emerged as primary subject of our study. Given our backgrounds as a privacy research and digital security specialist, we were not adequately aware of the intrinsic role that these reports played in enabling the social audits so necessary to ensure entitlement justice. Our research was primarily a documentation of the state of disclose of sensitive personal data, with some recommendations on the need for masking of sensitive details and uniform data security protocols.

This narrow understanding of the problem may have prevented us from imagining and articulating a more holistic policy solution that would protect privacy without impairing the necessary process of social audit. When our report came out, the immediate response from UIDAI and other government stakeholders was that the publication of Aadhaar Numbers was inadvertent and a result of transparency obligations under the RTI Act. Naturally, as our report garnered wide media attention and some regulatory attention, the Right to Food Activists were concerned about knee-jerk policy response that would cut the legs of the transparency mechanisms that they so relied upon.

Over the next few weeks, Srinivas and I had multiple conversations with RTI activists to get a better understanding of their concerns so that in our public communications, we could pre-emptively highlight the folly of any policy responses which the compromised the transparency needed to conduct the much-needed social audits. Shortly after that, Srinivas and I (and the senior staff at CIS) received show cause notices from UIDAI asking us to explain our research methodologies, and we had little time to pay attention to this thread of the conversation.

The false privacy/transparency dichotomy

However, this false dichotomy between privacy and transparency continued to bother me. Ann Florini provides a simple definition where transparency is the act of deliberately revealing your actions. This element of deliberateness or volition is critical, particularly in a networked and quantified world which necessitates a resigned surrender to intrusive technologies. Therefore, when Mark Zuckerberg describes an inevitable transparency that we, as people are to be subject to as a result of slew of new online services, including Facebook, it is disingenuous and fashions as ‘transparency’ that which is, in fact, intrusion. Yet Florini’s definition and her overall article, which also often erroneously juxtaposes transparency against privacy, is perhaps too simple.

If we believed that transparency was an instrumental value designed to achieve public participation and accountability from the powerful, we would see no real value in making more visible the private lives of individuals not wielding any special power. Therefore, this brings us to the second element of power. Transparency initiatives must illuminate or make accessible the particulars which enable the exercise of public or private power, particularly the power exercised by institutions.

One of the most comprehensive definitions of transparency is provided by Fisher which has four parts, one of which follows. What is being made visible by a transparency initiative is a resource that those within an institution are drawing on for their power. Such resources are often frameworks (legal, organisational, technical), the information or expertise, or the normative values on which the decisions are based. Often it may be required to create new resources to achieve transparency. The linking of transparency to resources or information from which institutions derive power is critical.

Therefore, in the context of a social audit, details about subsidies, flow of resources, blockages, and the institutions and their representative responsible for them, including reasonable personal details about the individual representatives are required to be disclosed to achieve accountability. For public servants to claim individual privacy protections where reasonable disclosures about their roles and responsibilities are necessary to hold them accountable is disingenuous. The bigger issue, that Srinivas and I sought to highlight was that personal details including sensitive personal data of beneficiaries is also being shared.

At its core, the privacy/transparency dichotomy is down to a failure of CMS systems. The system design veers dramatically between complete transparency where all information is published online without even basic hygiene protections like masking of sensitive financial data, and Aadhaar Number, and a feared state where all relevant information to undertake audits becomes inaccessible. Rather than design solutions which enable masking of sensitive information to protect beneficiaries and hold institutional representatives accountable, the authorities trade in an all-or-nothing approach.

Conversations with RTI activists also made me more sensitive to the lopsided nature of this engagement, where NGOs like MKSS effectively discharged public functions of organising drives to enfranchise beneficiaries, conduct audits to find leakages and other burdens ti ensure food security. Every single transparency measure was a hard-fought victory to aid in the act of audits. In this environment, their suspicion of any privacy protections that could be used as an excuse to undo this transparency was more than understandable.

It was has been over seven years since Srinivas and I published our report, and I have struggled to articulate a workable, practical policy solution to this complex problem which would not blow back on the Right to Food movement. While the technological solution, possibly one involving access control, some de-identification and real-time data updates is straightforward to design, the complex web of limited digital literacy, infrastructure failures and bad faith actors makes any changes to this hard-won and delicate status quo, fraught with risks.

What the RTI and RTF activists have not paid sufficient attention to is that the state of the welfare information ecosystem has irreversibly changed in India. The 360 degree profiling of Indian citizens that the design of India’s digital welfare strategy would eventually enable, calls for an update to the way social audits are done safely. That requires an alternative solution that privacy activists and transparency activists formulate and advocate for together.

That is all for this issue. Until, next time.

Amber