Data protection for the common good: Developing a framework for a data protection-focused data commons

Abstract

In our data-driven society, personal data affecting individuals as data subjects are increasingly being collected and processed by sizeable and international companies. While data protection laws and privacy technologies attempt to limit the impact of data breaches and privacy scandals, they rely on individuals having a detailed understanding of the available recourse, resulting in the responsibilization of data protection. Existing data stewardship frameworks incorporate data-protection-by-design principles but may not include data subjects in the data protection process itself, relying on supplementary legal doctrines to better enforce data protection regulations. To better protect individual autonomy over personal data, this paper proposes a data protection-focused data commons to encourage co-creation of data protection solutions and rebalance power between data subjects and data controllers. We conduct interviews with commons experts to identify the institutional barriers to creating a commons and challenges of incorporating data protection principles into a commons, encouraging participatory innovation in data governance. We find that working with stakeholders of different backgrounds can support a commons’ implementation by openly recognizing data protection limitations in laws, technologies, and policies when applied independently. We propose requirements for deploying a data protection-focused data commons by applying our findings and data protection principles such as purpose limitation and exercising data subject rights to the Institutional Analysis and Development (IAD) framework. Finally, we map the IAD framework into a commons checklist for policy-makers to accommodate co-creation and participation for all stakeholders, balancing the data protection of data subjects with opportunities for seeking value from personal data.

Unleashing collective intelligence for public decision-making: the Data for Policy community

“…Laws and regulations related to technologies such as AI and Blockchain are increasingly established through both reinterpretation of existing laws and introduction of new laws and regulations (e.g., EU AI Act—2021). Data intermediaries in the form of trusts or collaboratives, or concepts such as data banking or “trust-less” peer-to-peer data infrastructures (e.g., distributed ledger) are important areas in development as potential solutions to a range of problems associated with sensitive/personal data sharing and public–private collaborations (Boniface et al, 2022; Wong et al, 2022). From a management perspective, data supply chains, ownership and provenance, sharing and linkage, and curation and expiration are of primary concern.…”

“…Closely overlapping with this, effective data and technology governance requires high-quality meta-data to be made openly available with common standards to ensure interoperability at all scales. An example that fits this area is the work by Wong et al (2022) on a data protection-focused data commons to encourage policymakers to reconsider balances of power between data subjects, data controllers, and data protection stakeholders.…”

“We are the makers of manners”: A grounded approach to data ethics for the built environment

“…Data stewardship mechanisms and institutions [61] such as data trusts [62], data cooperatives [63], and data commons [64] have also been considered to establish bottom-up (as opposed to top-down) approaches to ensuring that equity is being considered in public communal physical spaces and digital environments. However, data stewardship and governance frameworks remain difficult to implement in practice, requiring policy development and infrastructure considerations beyond data protection alone [65].…”

Key challenges for the participatory governance of AI in public administration

“…As part of data governance, participatory methods are increasingly seen as crucial for ensuring that data is properly collected, processed, managed, and protected. For example, in consideration of participatory data governance or participatory methods as part of data management, numerous organisations have incorporated stakeholder engagement practices (Wong et al, 2022), such as the Ada Lovelace Institute's 'Participatory data stewardship' report (2021b) that establishes a framework for involving people in the use of data to operationalise practices that empower people to help inform, shape, and govern their own data. Meanwhile, Waag, in their Urbanite project (2021), has also assessed people's experiences with disruptive technology through a participatory lens.…”