INDIA'S PRIVACY CHOWKIDARS: THE ROLE OF CIVIL SOCIETY ORGANIZATIONS IN SHAPING DIGITAL PRIVACY DISCOURSE & DATA PROTECTION POLICYMAKING IN INDIA

Digital privacy concerns and data protection regulations have risen to the top of global policy agendas. In countries around the world, governments, the private sector and civil society are engaged in policy debates that have profound implications for what has become one of the world’s most precious and vulnerable commodities: personal data. While the Cambridge Analytica-Facebook scandal caught the moral and policy outrage of policymakers and citizens in the West, in India, the historic Supreme Court judgment on privacy as a fundamental right on August 24, 2017, based on the privacy violations of the biometric digital ID scheme Aadhaar recaptured the civic imaginations of India's privacy advocates. This study provides new research on the role of civil society organizations (CSOs) in shaping the high-stakes policy debates over digital privacy and data protection in India. The study is driven by a sense of urgency, as the debates are propelled by two significant domestic policy drivers. First, India's national biometric identity scheme, Aadhaar, which is the world's largest, with over 1.2 billion enrolments, linked to large public and private-sector databases. These aggregated linkages have critical implications for user privacy, information security, and state-citizen relations. Second, the formulation of India's Personal Data Protection Bill which has raised questions about the government's commitment to transparency and accountability and to the multistakeholder process of digital policymaking. Besides privacy, both Aadhaar and the Data Protection Bill also encompass a wide-ranging spectrum of national security, economic development, and global trade-related concerns. An underlying contextual layer girding both these policies was the August 2017 India Supreme Court's ruling that privacy was a constitutionally protected fundamental right. This dissertation employed the abovementioned two policies and the privacy judgment as empirical backdrops and used the multistakeholder Internet governance framework and Habermas' theory of the public sphere, to examine the role of one stakeholder group, CSOs, in shaping privacy discourse and influencing data protection policymaking in India. It firstly mapped the space with regard to the CSO actors and the framing of privacy by CSOs. It then examined the diverse range of communication and engagement strategies CSOs use to influence their target publics. The study employed a qualitative research methodology of the extended case method and used ethnographic research methods of in-depth interviews and direct observation to study the CSOs. It also examined representative media articles and reports as secondary sources of data. Over six months of fieldwork in India and the UK, I mapped out and interviewed 84 representatives from CSOs, high-ranking bureaucrats overseeing digital policies, as well as leaders from India's private sector. I also attended several conferences related to digital policies and analyzed relevant policy documents, CSO websites, and media articles about these issues. The research findings revealed some surprising insights. For example, CSOs tend to view digital privacy through the human rights prism rather than Internet governance which they tend to view primarily as the regulation and management of the domain name system and other technical standards. This was surprising because foundational Internet governance scholarship clearly includes privacy as one of the policy issues that it encompasses. The multistakeholder model is largely aspirational about equal participation. In reality, massive power asymmetries between stakeholders and this impacts which voices are heard at the policymaking tables. The power asymmetries are skewed in favor of the state with policy implementing capacity and the private sector who own much of the digital infrastructure and communication platforms. While the data protection policy is highly contested between stakeholders, digital literacy initiatives provide an avenue for collaboration between CSOs, government, and private companies. This too was surprising because increased digital media literacy would lead to increased awareness about digital privacy and data protection violations and would seem to lead to more confrontations. Finally, organizational features of Indian CSOs, the Indian political climate of a narrowing of civil society space, and the geo-political realities of techno-solutionism and surveillance capitalism present massive constraints for privacy advocacy. The need of the hour is to harness innovative and creative solutions through privacy protecting design and technical standards setting combined with effective strategic communication campaigns. This dissertation fills two gaps. First, it provides a non-Western perspective to Internet governance studies from one of the world's largest Internet user populations, India. In doing so, it adds to emerging scholarship from the Global South on Internet governance which has largely been dominated by the West in terms of volume and impact. Second, while the role of civil society has been acknowledged in the pushback against Facebook's Free Basics as a single case study, there have been few studies that examine the role of this growing stakeholder group as a whole globally. There has been no study in India that examines this stakeholder group with regard to digital privacy and data protection policymaking from India. This dissertation provides original and systematic research about privacy advocacy in India.Keywords: Privacy, data protection, civil society organizations, public sphere, multistakeholder model, Internet governance