Who should control our data?

Gurumurthy, A., Chami, N. (2022). Controlling the processing of data: for what purpose and for what?, Data Governance Network Working Paper 23.

When the Internet was just about to begin, techno-enthusiasts were hoping for a world where knowledge and information would be abundant and free from the hands of the elite. The Internet will be democratic, providing open and equal access to all.

Yet nearly two decades later, that dream is barely alive. The Internet and its data are, almost exclusively, in the hands of very large tech companies. Data ownership has become the currency of the future. Many governments and inter-regional entities are attempting to undo this indiscriminate accumulation of data as well as protect data privacy by conceptualizing different forms of data governance systems. The authors of the paper, “Controlling the processing of data: to what end and to what?”, analyze different approaches to data governance. They argue that data fundamentally needs to be understood as a social commons and that there should be a complete re-structuring of the data economy. They propose a semi-generic approach as the most practical way to control data to foster innovation and ensure equitable access.

platform capitalist

A handful of ‘platform capitalists’ now control the Internet. Platform capitalists are those who take advantage of their first mover privileges by rapidly expanding into the digital landscape. They then present themselves as a platform for third party players for one price (Meta, Amazon, Microsoft, etc.). These companies maintain and expand their control through data accumulation and extraction.

The importance of data accumulation in the digital economy cannot be underestimated. With the advent of the Internet of Things (IoT), ‘smart’ devices and related technologies, data likely goes beyond the virtual to the physical and social as well. Control over such data can also predict behavior patterns. Platform capitalists have unbridled control over the data economy, leading to exclusion and under-optimization of data for the common good. This stifles the prospects of small businesses and data communities. Additionally, since most of these companies are based in the West, it leaves developing countries to fend for themselves, leaving behind the immense potential and uses of their own data.

The revision of the data has given rise to an explorer-keeper argument that undermines human rights, encourages illegal data mining and profiling.

State regulators are trying to find a solution for better redistribution and governance of data structures. One approach that is currently prevalent is the EU’s individualistic policy where individuals have ownership rights to their personal data (for concerns over privacy), but not their non-personal data (data that does not contain a personal identifier). is seen as. Property of the data processor/collector. There are several issues within this approach. First, assuming that there is no privacy risk with non-personal data is flawed. To quote the authors’ example, the data collected by smart energy systems, temperature and motion sensors, seems harmless. But as those data move up the value chain, they have the potential for smart home manufacturers to infer a lot of socio-behavioral insights that can profile individual households when combined with other data sets. Again, giving data collectors ownership rights over non-personal data keeps the data within the bounds of the finder-keeper logic. It also doesn’t answer how the data can be redistributed equitably.

Another approach is that of data management. Data stewardship refers to “any institutional arrangement where a group of people come together to pool their data and put in place a collective governance process to determine who has access to this data, under what circumstances and Who has access to the benefits.” It can also take a public-private partnership model where private data can be used for governance issues and policies. The European Union’s proposal for “data philanthropy organizations” that would enable the pooling of non-personal data for non-profit, “general interest” purposes and the World Economic Forum’s ‘data for general purpose’ initiative would be the only way for such an arrangement. There are commendable examples. By creating such privacy-focused data forums, the goal is to enhance data-based value creation for optimal use. While this platform will be a marked improvement from capitalism, it remains to be seen whether these groups can truly unlock the potential of data. For one, such an initiative would require proper state-of-the-art infrastructure. Most of the countries in the Global South would then be at a huge disadvantage because they do not have enough equipment or resources. Therefore, data management is an ideal solution, while not exactly practical.

semi-common approach

The data consists of three layers. Semantic layer containing the encoded information. The syntactic layer which represents information in the form of a machine-readable dataset and the physical layer which is the infrastructure through which one extracts the data. An ideal data governance structure should prevent the holders of the syntactic and physical layers from having exclusive rights over the semantic layer.

A quasi-generic approach to data governance seeks to balance public and private claims to data. It basically recognizes the data as a social commons where the first movers do not get special rights.

data holder and seeker

Data holders – whether private, public or charitable organizations can have only non-exclusive rights on the base layer of data (raw non-processed data). They can use and generate profit through this but data sharing is required as other data seekers are entitled to access in semi-normal approach. Data seekers may have access to raw non-personal data and aggregate non-personal data (after meeting appropriate security measures for irreversible anonymity). However, this access is not an unconditional right. Different data seekers have different rights on the kind of data being demanded.

For example, personal data subjects can access their personal data and non-personal data. Public agencies have ‘authority access’ to raw non-personal data and non-personal data held by other private players. The use of authority refers to the “right of public agencies to access data on the basis of carrying out lawful public policy actions supported by specific legislation”. Private organizations can conditionally access raw and aggregate non-personal data. These terms would have to be harmonized with the larger economic and social policies of a country.

A semi-common approach would require a complete re-ordering of the existing way in which data is pooled and kept in the exclusive ownership of platform capitalists. There will be a need to create a common data market that encourages production through collaboration. The authors cite the example of the municipality of Barcelona, ​​which is building a smart city by creating a public-funded data infrastructure.

Here, the public is armed with smart contracts and cryptographic tools that allow them to contribute data directly to the city’s data commons on their own terms. Local companies and cooperatives are also given access to the city’s data commons. It also mandates the data to be in a machine readable format with open-source APIs. Furthermore, a semi-generic approach will help foster data-driven solutions and innovation in areas that desperately need it. For example, the NITI Aayog had remarked that the agriculture sector, which is in dire need of more data-driven innovation, would see only a mellow response from private AI players due to the low leverage compared to other sectors.

Therefore, a quasi-normal approach, to be real, calls for a complete change of perspective in which data should not be thought of as the exclusive property of an individual or company, but as a form of social commons that is properly regulated. and needs to be redistributed.