Data protection by design: Building the foundations of trustworthy data sharing

Abstract

Data trusts have been conceived as a mechanism to enable the sharing of data across entities where other formats, such as open data or commercial agreements, are not appropriate, and make data sharing both easier and more scalable. By our definition, a data trust is a legal, technical, and organizational structure for enabling the sharing of data for a variety of purposes. The concept of the “data trust” requires further disambiguation from other facilitating structures such as data collaboratives. Irrespective of the terminology used, attempting to create trust in order to facilitate data sharing, and create benefit to individuals, groups of individuals, or society at large, requires at a minimum a process-based mechanism, that is, a workflow that should have a trustworthiness-by-design approach at its core. Data protection by design should be a key component of such an approach.

Fostering trustworthy data sharing: Establishing data foundations in practice

“…Data trusts 3 are one form of data institution (Hardinges and Tennison, 2020) that have received considerable attention as conceptual framework for good data governance (Hall and Pesenti, 2017; where other mechanisms would be unsuitable (e.g., open data, commercial agreements) (Stalla-Bourdillon et al, 2020). Citizen representation is also recognized as a crucial aspect of designing decision-making processes for data trusts (Bunting and Lansdell, 2019).…”

“…• All data are relevant-personal as well as nonpersonal data. This is because personal data and nonpersonal data are not binary concepts 10 -data shared, used, and reused as part of data sharing initiatives are likely to be personal data or become personal data, for example through purpose of use, data linkage, result of use (Stalla-Bourdillon et al, 2020). • Data stewards are independent-the guardian generates necessary tensions in order to ensure legal and ethical compliance.…”

“…In our recent Web Science Institute (WSI) White Paper (Stalla-Bourdillon et al, 2019), we introduced data foundations as a good data governance model that could be used to create independent entities that foster responsible and sustainable data usage, management, and sharing, in a manner that will hopefully help incentivize organizations to share (more) data. We therefore define the term “data foundation” as follows: “An entity incorporated under the Channel Islands’ foundation laws, which supports responsible and sustainable non-personal and personal data usage, sharing, and re-usage by means of independent data stewardship.” (Stalla-Bourdillon et al, 2019)…”

“…We approach this issue through the design and development of data foundations inspired by Channel Islands’ foundations laws 1 . Data foundations provide a robust data governance model that“supports responsible and sustainable non-personal and personal data usage, sharing, and re-usage by means of independent data stewardship.”(Stalla-Bourdillon et al, 2019)…”

Trusts, co-ops, and crowd workers: Could we include crowd data workers as stakeholders in data trust design?

“…The motives and structure of data trusts are similar to “data co-ops” in so much as they create a pooled data resource that can be exploited for the benefit of members, although the legal arrangements for trusts and co-operatives may be different, and—unlike a co-op—a trust might be operated for the benefit of beneficiaries who are themselves not directly involved in the governance process. Although data trusts have similarities with the concept of Trusts that exist in some legal jurisdictions, authors such as O’Hara (O’Hara, 2019) point out that those legal trust structures may not be the most appropriate legal vehicle for creating data trusts, and others such as Stalla-Bourdillon et al (2019) suggest other legal vehicles such as the Channel Islands’ “Foundation” entities. Given the range of potential legal arrangements that could be used to implement data trusts, they are now referred to by many authors using the umbrella term “Data Institutions.”…”