tl;dr

We have provided our comments on the Draft Approach Paper for creating a Digital Address Code. In our comments, we have tried to highlight the governance issues around geospatial data, data protection issues around the use of geospatial data, and potential surveillance and function creep challenges which will arise from DAC. Finally, we recommend that a comprehensive grievance redressal mechanism be provided for complaints against geospatial mapping, that robust security standards and user rights be specified for the DAC database, and that the principle of purpose limitation be followed.

Introduction

The Department of Posts, under the Ministry of Communications released the “Draft Approach Paper for creating a Digital Address Code” on October 18, 2021, which details the plan for the creation of Digital Address Code (“DAC”) for all addresses pan-India. The approach paper lays out the DAC as being unique to each address, which would be linked to geospatial coordinates of the building or establishment, and which would be usable by all stakeholders to be captured in a QR code or mapped digitally.

It has been ascertained that the lack of planning in several Tier 2 and Tier 3 cities makes it difficult to locate the addresses, thereby making it difficult to target social sector benefits. In November 2020, a Group of Ministers headed by the Social Justice and Empowerment Minister submitted a report to the Prime Minister recommending a unique code to replace the address identifiers in the country.

The GoM recommended an alphanumeric code for all addresses which would also resolve a lot of issues like responding quickly in the event of any natural calamity or a disaster like fire, ease of reach by ambulance for any medical patient and also formalise revenue issues like property and water tax for municipal corporations.

The Draft Approach Paper envisages that each address would be assigned a DAC, irrespective of its size. Even for an apartment building, each individual apartment would be allotted a DAC. The DAC for the addresses will also be permanent, and therefore, it will not be tied to the state the address is located in. Similarly, fluid parameters like street numbers/ names, colony names will not be a part of the DAC.

The Digital Address Code

The Draft Approach Paper lists two ways of assigning the DAC digits: the first one being absolute randomly generated 10 digits that would be appended to the grid numbers chosen from between 0 to 9; the second one is to follow a geospatial workflow.

The latter approach is rather detailed and includes using an algorithm which would allocate the subsequent digits on the basis of habitation density after assessing the population density and designing a geospatial workflow. The DAC would be allotted based on the division of areas into a grid, each of which will comprise of around 300 addresses. Out of the 12 digits, the last digit would be a ‘check digit’ and the immediately preceding four would be identifiers within the neighbourhood. Upto the neighbourhood level, the DAC would be automated but for the final four identifier digits at the neighbourhood level, a ‘system driven consent process’ is proposed.

Geospatial data and governance issues

Geospatial data is an emerging field with tremendous applications, with address-based geospatial applications offering tremendous potential for improving both governance and economic outcomes. However, there exist certain issues that necessitate the need for caution and patience when implementing such systems.

The use of satellite and drone imagery in tandem with geospatial data to allocate land records has faced significant issues in India. For example, under the Swamitva Yojana, private drone operators would use drones to map rural areas, after which they would process this data and hand it over to the government. Subsequently, the State and Union government together would release a draft map of the areas with all properties demarcated, after which residents could then raise complaints about the mapping should they face any issues. In the course of such a process, many disputes would arise, including multiple instances of errors in the boundaries of properties.

However, not only were such errors frequent, the lack of a proper grievance redressal mechanism has also resulted in several long-standing disputes. This is not surprising, since the NITI Aayog has estimated **** that “on an average it takes twenty years for a real estate or land dispute to be resolved”. Similar issues have been faced with the Digital India Land Records Modernisation and Programme (DILRMP), with experts saying that the use of technology may not solve fundamental issues about land record digitisation that require a comprehensive policy response. A GRAIN report titled ‘Digital fences: the financial enclosure of farmlands in South America’ has already brought to attention how digitalisation has enabled the land grabs by large scale agribusinesses in Latin America, while the requirement of digital land records for access to government schemes has resulted in large scale exclusion.

Geospatial data protection

In addition to this, the data regime with respect to geospatial data is unclear. The Guidelines for acquiring and producing Geospatial Data and Geospatial Data Services including Maps, notified on 15th February, 2021, emphasise a liberalised regime for the sharing and processing of geospatial data in which public and private entities would not require any license for collecting, generating, processing, or analysing geospatial data.

However, there is still a lack of clarity with regards to the categorisation of geospatial data as personal or non-personal data. Now while the DAC in and of itself may not be personal data, when used in conjunction with land records or Aadhaar data or even census data (as may be contemplated by the government), the DAC may result in the identification of individuals, and thus may need to be classified as personal data. This is in line with the World Geospatial Council’s recommendations:

“[W]hen the map is used in conjunction with GPS data to show the real-time movement of individuals, the geospatial information should be considered personal data. This means that the concrete use case for geospatial information is of critical importance in determining whether or not data protection legislation applies, and if so, what rules apply.”

Use of DAC data beyond digital addresses

The danger of the previous two issues is exacerbated by the Government’s behaviour with respect to other public databases: the Vahan and Sarathi databases for vehicle registrations and license registrations respectively. Responses to parliamentary questions and RTIs revealed that the government had sold access to these databases to private companies in exchange for revenues to the tune of Rs 111.38 crore without citizen’s consent (this revenue was also not shared with state governments). Thus, even though the DAC is supposed to be a “system driven consent process”, data collected in the DAC database may be sold without consent.

Besides issues of data exploitation, the deleterious effects of the sale of such databases can be seen by media reports which reported that data from the Vahan database was used by persons during the North East Delhi Riots of 2020 to target minority communities.

Furthermore, the Parliamentary Standing Committee on Home Affairs, in its two hundred and thirty-first report, laid on the table of Lok Sabha on March 15, 2021 proposed the idea of updating the National Population Register during the first phase of the Census exercise. The Committee recommended that during the update, each member of a household be linked to a family structure, which can then be linked to a house ID.

Further, owing to the legal provisions in the Aadhaar Act, 2016 and the Supreme Court’s judgment in Puttaswamy (Aadhaar), the Aadhaar database may not be made available to this office. Deciding on S7 of the Aadhaar Act, the Hon’ble Court held that “the government’s constitutional obligation to provide for subsidies, benefits and services to individuals and other provisions are only incidental provisions to the main provision”, thus allowing the Aadhaar database to be used to target social sector benefits. Therefore, the Standing Committee recommended linking all members to a household identity, but that would also mean that indirectly all members of the household would be linked to each other. Thus, if the government, at a later date, plans to link Aadhaar details of the members with the DAC, then it would be a violation of the Supreme Court’s Judgment in Puttaswamy (Aadhaar), in spirit.

The Draft Approach Paper also mentions how the DAC would help in reducing logistical and last mile challenges in delivering consignments. However, given that sharing addresses is an indispensable part of the process, we fear that this makes DAC prone to be collected en masse, and in the event of a data breach from a private data fiduciary, lead to function creep.Therefore, we recommend that like Virtual Aadhaar, citizens be given an option to mask their DAC and instead share their virtual DAC. Given that even the virtual DAC would point to a physical location, we further recommend that such masked DACs should have an expiration limit - either automatic or controlled by the user.

Our suggestions

The ideation of a digital address code to bring uniformity to the addresses is a welcome move. However, in order to rectify anticipated challenges to digital and fundamental rights of citizens, we recommend the following:

  1. Comprehensive grievance redressal mechanism: Given past experiences with geospatial mapping, should satellite or drone imagery be used to allocate addresses to DACs, a comprehensive grievance redressal mechanism must be implemented that would reduce pendency of land disputes and allow disputes of demarcation to be resolved in an equitable manner.
  2. Introduce robust security standards for DAC: Given the permanence principle of DAC, and the potential function creep bundled with sharing one’s DAC with private entities, there will be a persistent fear of breach of such data. In absence of a data protection law, citizens would be left vulnerable to exploitation. Therefore, it is pertinent that the technical architecture of the DAC provides strict control over their data to the users as well as safeguards to prevent unauthorised access.
  3. Need for consultation and purpose limitation: The government must ensure that a public consultation is held to define specific use cases for the use and processing of data collected under the DAC database. This would include a ban on unregulated use of DAC data by both private actors and government bodies.

Important documents

  1. The Department of Posts’ Draft Approach Paper for creating a Digital Address Code (link)
  2. IFF’s comments on the draft approach paper (link)