Alumni Spotlight: Aparajita Rana on Data Privacy, AI, and Cybersecurity

Aparajita Rana

Mittal Institute: Aparajita, you’ve worked extensively across jurisdictions and legal systems — India, the UK, and the U.S. What unique perspectives has this global legal training brought to your practice, especially in the evolving field of data privacy?

Aparajita Rana: The legal practice area of data privacy, and technology laws as a whole is very global and interdisciplinary in nature. If you advise multinational corporations with global presence, and engage on policy advisory with Governments, which is the kind of work I do, it is helpful to be aware of how similar legal concepts and technology risks are being regulated in other jurisdictions so that you can anticipate local development effectively. Clients and regulators look for both global consistency, and advocacy on how India should respond to similar issues in a different manner, and why.

My time at HLS made me relook at public policy work in this sector in a different manner, as the practice there is very nuanced and technical in nature. It is also common for practitioners to delve into multiple roles in succession, for instance, from regulatory to legal engineering, to product counsel, to enforcement. The market is a lot more open to deliberative outcomes, which is an asset when delving in an evolving practice area. I think validation and utility of an exploratory mindset is what I take back from my global experience and try to implement that in my current role.

At the same time, I believe it is important to choose research questions that have not yet been answered well. If someone has already provided a strong answer, what value are you adding? For example, when I was first introduced to the “standard story” of the origins of mass incarceration, I was skeptical. That skepticism has driven my research.

I believe it is important to choose research questions that have not yet been answered well. If someone has already provided a strong answer, what value are you adding? 

Mittal Institute: As a Chevening Fellow for Cybersecurity and someone who’s advised on the Personal Data Protection Bill, how do you see India balancing innovation and regulation in the digital space over the next few years?

Aparajita Rana: I see the Indian approach on data protection and emerging technologies like AI, as departing from the global approaches like that of the EU, but in a staggered manner which India slowly builds its tech self-reliance. We have seen that while India is keen to understand how more prescriptive jurisdictions like the EU are regulating these sectors, it then follows up with an India-specific lens to every new regulation, which is largely driven by considerations like national security, digital sovereignty, and lesser reliance on globaltech. This approach is disruptive for global tech players, who argue for more consistency with global laws. If, however, a technology is truly innovative and brings in R&D benefits for India, we can expect more openness from Indian regulators, by encouraging the sandbox approach, allowing exceptions under law.

Data collation and monetization is also a prime focus area of the government, as we are seeing more instances of public interest initiatives that demand more data sets and analytics. Public-private innovation in state-use of data for delivering services and efficiency will be an area where regulatory mandates may be more flexible, to aid innovation such as building the India stack, and digital governance for essential services.

India is also building tech reliance by promoting its incumbent tech companies, encouraging sovereign cloud to retain critical datasets within India, and certifying its digital infrastructure. It appears that many of these measures could be a precursor for stricter regulation in the future, when India can rely largely on its domestic talent for its technological demands.

Aparajita with the class of Harvard Negotiation Winter course with Prof Alain.

Mittal Institute: As a tri-qualified lawyer and Harvard alum, how has your legal education — particularly your time at Harvard Law School and Berkman Klein — shaped your thinking and approach to tech law and policy?

Aparajita Rana: My legal training in India, and preparation for being qualified to practice law in the UK, and in the U.S., was expectedly based on the foundational aspects of legal training. Given that India is a common law country amongst many others, similar legal concepts are adopted in private practice and in litigation across these jurisdictions. My learning from this experience therefore was that legal training and professional experience in a particular country continues to be relevant and responsive, regardless of where you practice.

However, my time at Harvard was more clinical and experiential in nature. As someone trained in the Indian system during my formative education, this was a different approach that I was personally drawn towards. As a private practitioner for many years, being able to discuss and draw out ideas over days was also a privilege I didn’t take for granted. The writing and reading groups, and case-based learning classes I attended at Harvard are the learning modules I benefitted the most from. The classes were mostly chaired by former members of the judiciary, global advocacy leaders, and I greatly enjoyed the format of these sessions, the ease with which any idea was dissected, the variety of reading materials available at our disposal, and the reflective and cross-disciplinary approach towards every issue at hand.

One of my favorite courses was ‘Power and Means’ by Prof. Feldman, where we discussed power structures in every global setting but with different stakeholder interests; it was mostly free flowing and sometimes without an outcome. The structure of the course was the perfect example of a non-linear yet intellectually-nuanced methodology towards problem solving, and is a strategy that I try to emulate in my work. My experience and connection with BKC have similar gains; it has globally-placed members who are working on leading issues relating to tech policy across disciplines, including ethics, computer science, governance, C-suite, reading and engaging with their contributions. Sharing the Global South perspective on global technology governance has shaped my legal research and advisory skills considerably. It taught me to thoughtfully diverge from the obvious patterns in a problem statement, with more confidence and intersectionality.

(From left to right): 1. Aparajita at the John Harvard statue; 2. Aparajita in front of the Caspersen Student Center; 3. Aparajita attending the Legal Profession lecture with Prof Okediji.

Mittal Institute: With AI and data governance becoming hot-button issues globally, what areas of Indian tech law do you think need urgent reform or greater clarity?

Aparajita Rana: Delayed implementation of laws, like the data protection act and a specific AI law, is a cause for concern. As technology accelerates, laws always lag behind; however, allowing the time lag to expand over many years without clarity on core principles and lack of an enforcement regulator needs to be addressed. The Digital India mission has led to many essential and elective services moving online, more data collation through emerging technologies by the government and by the private sector, and Indian citizens using adaptive AI technologies without being properly informed of its risks and consequences. Similar risks are being seen with increased adoption of cryptocurrencies by Indian investors, despite absence of a specific law. Lack of a clear legal framework incentivizes some businesses to shy away from properly disclosing the safety measures maintained by them, being driven by shareholder interest, and introduces fragmented compliance standards in the market. Many of these technologies have systematic impact on digital and financial ecosystems, and it is not always practical to prospectively regulate the impact.

India is also a deployer-heavy jurisdiction for AI and is therefore allowing AI monetization to take place across sectors without a clear regulatory framework, which is likely to impact user remedies in the future. The consolidation of Indian user data through the India Stack should ideally be accompanied with a clear law, one that addresses interests of impacted users, content owners, and identifies and restricts high-risk use cases of AI. While the government has come up with policy papers in this area, we hope specific laws emerge soon.

Mittal Institute: For younger professionals and law students interested in emerging areas like cybersecurity and Technology, Media, and Telecommunications (TMT), what skills or perspectives do you believe are crucial to build early on?

Aparajita Rana: Preparation and relevant awareness are crucial. One should be updated on technology developments in India (legal or not) and in other countries, and perspective of different regulators. This helps you anticipate where the regulations are likely to converge or diverge, and the contributory geo-political and policy factors. For younger professionals, it is also important to adopt a generalist lens towards learning in your initial years, as being too specialist could be a disadvantage in the TMT field, which by itself is interdisciplinary and intersects with various practice areas, like enforcement, cybersecurity, ethics, human rights, corporate governance and the like. As you grow in the sector, having a broad awareness helps in issue-spotting and enables you to advise on issues holistically.

☆ This interview has been edited for length and clarity.
☆☆ The views represented herein are those of the interview subjects and do not necessarily reflect the views of the Mittal Institute, its staff, or its steering committee.