Towards an international data governance framework

1. Introduction

Data: the single word that defines our age. Today, data have assumed a new importance for economies and societies. They are at the heart of almost every activity, a ubiquitous globalized resource, easily shared, duplicated, traded and exchanged. Data transcend borders, challenge national sovereignty and are increasingly being thought of as a new form of capital. Data are used for the development of products and services that generate value, and are key building blocks of communications, government, social media, the cloud, blockchain, the internet of things and crypto-currencies.

Data are no longer just bits of information that can be used to inform policy decisions. Data are now a policy issue in and of themselves, playing an increasingly important role in economics, politics, sustainable development and even national security. It is no coincidence that the World Bank [1] and UNCTAD [2] both dedicated their flagship reports to data questions in 2021 and the risks associated with not having robust national and international data governance mechanisms in place. The publications attest to the importance of data and data governance. Data present opportunities (not least as a means of implementation for Agenda 2030) but also peril (for example, threats to privacy and manipulation or curtailment of freedom of expression threaten international human rights treaties). Data can be a tool for prosperity or liberation, but also potentially a weapon for exploitation and a driver of inequalities. As digitization advances, an advance accelerated by the COVID-19 pandemic, data are collected, stored, analyzed and interpreted at previously unthinkable rates, offering opportunities like never before,1 but generating new risks. New forms of data aided by technological advancements tend to exacerbate existing inequalities across and within nations, with the more privileged parts of society better protected against potential harms, and better able to take advantage of data opportunities. As the data stockpile grows and data exchanges and infrastructures mature, greater efforts must be made to ensure equitable access to certain types of data (e.g. public goods data) and prevent data monopolies. As Passarelli and Day note ‘monopolistic control of data has a strong tendency to undermine crucial collective outcomes’ [4, p. 4] by perpetuating ‘data silos, exclusive data access rights, and an inconsistent or reluctant adoption of sharing practices.’ It is problematic that data flows remain largely unregulated today. While issues of equity of access and control remain unresolved, there is a growing sense of urgency to work through traditional and new networks to address this challenge.

The data world(s), ecosystem(s) or what could be described as the ‘dataverse’ is evolving rapidly, driven by the fast pace of technological advance, such as machine learning and artificial intelligence, which brings an urgency to the need for protection, safe processing, sharing and use of data. Data types, volumes and uses are evolving and expanding quickly and at an accelerating pace. Data accessibility varies greatly – some data are global public goods (e.g. climate data) whereas other data are proprietary and privately owned by companies (e.g. IT platform data). Some data, intimately tied to individuals or population groups, are extremely sensitive (e.g. health or financial status) whereas other data relate to non-human activity (e.g. natural phenomena) and are more easily shared. Some data deal with emergency situations (e.g. disease prevalence or earthquake victims) while others describe routine, day-to-day life (e.g. shopping, commuting) activities.

Given the importance of data for, inter alia, the modern digital economy, surveillance, artificial intelligence, it is sure to be a defining geopolitical issue in the coming years. Hence many people concerned with developments in the dataverse are arguing that some sort of new international data governance framework is needed. In recent years there has been a massive proliferation of data governance frameworks and data principles, not least, the FAIR Guiding Principles for Scientific Data Management and Stewardship,2 the CARE Principles for Indigenous Data Governance,3 and the Health Data Principles,4 all indicating a recognition of the importance of this topic. There are also a growing number of measures to assess the adoption of these principles, including Global Data Barometer5 and Open Data Watch.6 Data governance is also an increasingly popular topic for academic research [5].

This paper explores why an international data governance framework might be needed, what that might entail and what developments have been taking place to bring us closer to such a framework. While some countries and regions have begun tackling the challenge of regulating the collection and use of data, these efforts remain piecemeal and fragmented, and thus risks creating barriers to production, trade, innovation and cooperation.

2. Why is an international data governance framework required?

In 2020, the Committee for the Coordination of Statistical Activities (CCSA)7 began discussing developments in the global dataverse and how these could potentially undermine the aims and aspirations of the Agenda2030 [6] and of the aims and objectives of the multilateral system more broadly. These discussions led to a series of published blogs which began socializing a debate on these important issues [7, 8, 9]. This culminated in an invitation from the World Bank to the CCSA to contribute to the 2021 World Development Report [1] that would be dedicated to data issues. The CCSA contributed a special section entitled The need for a new global consensus on data: A call to action. Separate to this call, the World Bank report suggested there is a need for a new social contract pertaining to data. UNCTAD too, dedicated their 2021 Digital Economy Report to data issues and they too highlighted the need for global data governance [2]. Others, have been advancing similar ideas, but often in different contexts, from different perspectives, and using different language and terminology. Smith [10] argued that a Digital Geneva Convention is needed, while others called for an Al and Data Commons [11], a Bretton Woods for AI [12], a New Global Data Deal [13], or A Global Digital Data Governance Architecture [14]. Timnit Gegru who was controversially fired from Google in 2020 has called for better data governance [15] while Verhulst and Saxena [16] have called for a new Social License for data reuse. Not unrelated, the ‘Declaration for the Future of the Internet’ signed by 60 (mostly developed) countries in April 2022, aspires to protect data privacy and ensure the internet is ‘governed, and deployed in an inclusive way’ and remains ‘open, free, global, interoperable’ [17]. In 2022, the National Statistics Advisory Group (NSAG) of the Royal Statistical Society in the United Kingdom began exploring the concept of, and the need for, a specific new kind of public statistics.8 At first glance these issues may not seem directly related but in fact are; when you distil digital or AI down, they are all essentially grappling with data and the use of data. As Bergstrom and West [18, p. 182] note ‘machine learning and artificial intelligence live and die by the data they employ’.

The argument put forward by the CCSA is that some sort of framework is needed to protect the safe and ethical use of data and to support a social contract that strikes a balance between full use of data for development and wellbeing and the protection of security, privacy, and human rights, and between commercial use and public good uses. Many different labels could be used to describe such a framework (including a global convention or consensus); for the remainder of the paper the term ‘Compact’ will be used for ease of exposition without limiting in any way the use of other options in the future.

The CCSA noted that data can be used for a huge variety of purposes – local, national and global public policy, commercial and emergencies – and by a wide array of actors – public sector, private sector, civil society, academia and so forth. This complex array of uses and players presents some challenges, not least:

Balancing the well-being of individuals and communities, ensuring insight can be gained from data to improve everyone’s lives, while protecting privacy and shielding people from misuse and abuse of data.

Defining an equilibrium between proprietary and public good data usage. What data should be protected as a public good, not just in the economic sense, but in the broader social sense?

Facilitating data use for a competitive, thriving, and diverse market for innovations that nevertheless improve and enrich human lives.

The CCSA argued that a Global Data Compact (GDC) could provide a framework to ensure that data are safeguarded as a global public good and as a resource to achieve equitable and sustainable development. This compact, by promoting common objectives, would help avoid fragmentation where each country or region adopts their own approach to data collection, storage, and use. A coordinated approach would give individuals and enterprises confidence that data relevant to them carries protections and obligations no matter where they are collected or used.

Such an international data framework can also influence other global initiatives and shift the thinking towards building modern data systems that are trustworthy, inclusive and accountable. This is also further reinforced by the recently launched “Data with purpose”, a joint partnership9 by the World Bank and United Nations, which aims to assist the global community in raising $500 million over 10 years to fill current gaps and help unlock better data for better, greener and safer future.

3. What might a Global Data Compact look like?

In simple terms, a GDC would constitute an integrated set of data principles and standards that unite national governments, public institutions, private sector, civil society organizations and academia. The compact would address: privacy of personal data; data accessibility; data equity; data exchange; data interoperability; and transparency, to name a few.

The universal principles and standards should set out the elements of responsible and ethical handling and sharing of data and data products. The compact should also move beyond simply establishing ethical principles and create a global architecture that includes standards and incentives for compliance. Such an architecture could be the foundation for rethinking the data economy, promoting open data, encouraging data exchange, fostering innovation and facilitating international trade. It should build upon the existing canon of international human rights and other conventions, laws and treaties that set out useful principles and compliance mechanisms.

Such a compact will require a new type of global architecture. Modern data ecosystems are not controlled by states alone, so any Compact, Geneva Convention, Commons, or Bretton Woods type agreement will require a multitude of stakeholders and signatories – states, civil society, and the private sector at the very least. This would be very different to any international agreement that currently exists. Therefore, to support a GDC, a new global institution or platform may be needed to bring together the many data communities and ecosystems, that comprise not only national governments, private sector and civil society but also participants in specific fields, such as artificial intelligence, digital and IT services. Participants would maintain and update data standards, oversee accountability frameworks, and support mechanisms to facilitate the exchange and responsible use of data. The proposed Global Digital Compact [19] which has been proposed as part of Our Common Agenda [20] will also need to address the challenges of bringing many different constituencies together and may point the way.

4. A confluence of thinking

The 2021 report of the UN Secretary General Our Common Agenda identified a number of priorities to position countries and the UN to better confront future challenges. One of the priorities was ‘improved digital cooperation’. Under this framing, the report pointed to a need to protect data, introduce accountability criteria for discrimination and misleading content, regulate artificial intelligence, as well as support a digital commons. The Report also highlighted the need to ‘build trust’, including the development of a global code of conduct to promote integrity in public information. These aspirations, and many others, involve data, either directly or indirectly.

At the 42 ${}^{\text{nd}}$ session of the UN High-level Committee on Programmes (HLCP),10 the Committee approved a three-pillar strategic framework ((i) duties to the future; (ii) new global public goods; and (iii) networked and inclusive governance) to guide its work over the coming years and translate Our Common Agenda into concrete action across the UN system.11 Although data are pertinent to all three pillars, the importance of data was recognised in particular in the context of pillar (ii) new global public goods.12 Understanding that data have both an economic value but also a social or public value (for example, in areas such as health, climate and other environmental issues) the HLCP decided to undertake a preliminary review of the international data governance landscape. That scan included identifying present data governance bodies, both within and outside the UN, detecting gaps that exist and pinpointing capacities that would be needed in the UN system to carry forward any data governance recommendations to ensure that data work for people, especially in developing countries, for the planet, and supports sustainable development. To achieve these objectives, the HLCP established a working group under the strategic narrative workstream: pillar 2 – new global public goods: international data governance and asked the Committee of Chief Statisticians of the UN (CCS-UN) to lead this work in collaboration with along with partners across the UN system of programmes and specialized agencies.

The CCS-UN hosted a preliminary brainstorming meeting on 24–25 January 2022 in Vienna, including several partners from outside the CCS-UN. The HLCP asked the CCS-UN to draft a concept note for the spring 2022 meeting. In preparation, the brainstorming session was convened to discuss how the UN system should proceed, what would be the scope of this work, what stakeholders would need to be involved and consulted, what might be the cost of inaction, how to best scan existing data governance frameworks and learn lessons on how to advocate for an international data governance framework that nurtures the creative use of data while protecting against abuse and misuse, and what positive and negative incentives could be designed to encourage stakeholders to adopt any new principles or governance framework.

The paper Concept note on a UN system paper on international data governance13 was submitted to the HLCP and discussed in London on April 1 and 2, 2022. After setting out the background and context, the concept note proposed an annotated outline of what was foreseen as the requirements for a UN system-wide contribution to the international data governance agenda. These were organized as follows:

Scanning gaps in international data governance and data flows

Aim of the UN system data proposition

Why does the world need to develop better global data governance?

Scanning existing data governance frameworks

Scanning existing/on-going global data governance approaches

Protecting Data as a Global Public Good

Universal Data Principles

Scanning opportunities for UN system on international data governance

Data Compact: beyond defining universal principles

Data Compact across the data lifecycle

Who to call upon to make the Compact a reality?

An ambitious work plan between spring 2022 and spring 2023 was also set out in the concept note. The concept note and work plan was unanimously adopted by the HLCP with some minor modifications and suggestions.

5. The cost of inaction

One of the interesting aspects of the concept note presented by the CCS-UN was that it attempted to articulate the costs of inaction. Noting that while data are increasingly used to develop other data products and services – including being used as inputs to artificial intelligence (AI) capabilities that generate value – there is no single governance framework for this new value chain of data production that is so key resource for economic growth and development, and which carries the potential to widen existing gaps and lead to potentially destabilizing inequalities. AI-powered products and services, if developed using data that do not adequately represent the users of these products and services, tend to work less well for groups underrepresented in the data [22]. This is a notable challenge for products and services in critical areas, such as healthcare. Where data contain information about the past, AI and algorithmic powered and analytical data products and services are prone to perpetuate historic patterns, which can be problematic in areas with known systemic errors or injustices or where past behaviour diverges from desired future actions [23]. Lack of diversity in data and algorithms can also make AI vulnerable to worrying concentrations and systemic failures [24, 25]. More recently the same concerns prompted Bergstrom and West [18] to counsel that machine learning might be better termed machine indoctrination or what Harari [26] called digital dictatorships as we hard code errors and various forms of bias into algorithms.

Data are a non-rival and a non-excludable public good resource meaning they can be used simultaneously by many at the same time. But as MacFeely [10] notes, data can be made at least partially rival and/or excludable, by controlling or restricting access. This is indeed the case today, where many data are not treated as a non-rival or non-excludable resource. Instead, large data holders mostly in the global north are limiting access to proprietary data. This widens existing inequalities along pre-existing fault lines and limits opportunities for innovation. Lack of data governance, in particular, lack of mechanisms for making available data for public good may not only exacerbate existing inequalities but also prolong suffering, and in critical situations lead to lives lost (after disasters, for example) [4].

Some data contain personally identifiable information (PII) and can be used to infringe upon the privacy and other fundamental human rights of individuals. Privacy is a fundamental human right, set out in the Universal Declaration of Human Rights [27] and European Convention on Human Rights [28]. In the Charter of Fundamental Rights of the European Union [29] both the right to privacy and data protection are enshrined for citizens of the Union. The Right to Privacy in the Digital Age [30] was adopted by the UN General Assembly in 2016 to reinforce the message that even in today’s digital age privacy remains a human right. Despite all of this, Schwab [31, p. 72] noted that ‘data rights and data protection are still heavily fragmented. Rules around the collection, processing and reselling of personal data are well defined in Europe but are still weak or entirely lacking in many other jurisdictions’.

These rights are important as data can be used to track and harm individuals and groups. Furthermore, when data with personal identifying information (PII) are combined with ‘suggestive design’ or ‘dark design patterns’ and capabilities that assess taste and preferences, data can be used to guide decisions of individuals including for economic benefit and infringe upon the autonomy and discretion of individuals. Schneier [32, p. 238] eloquently describes the challenge thus, ‘data is the pollution problem of the information age, and protecting privacy is the environmental challenge’. Schwartz (1989) makes a similar point arguing that ‘the enormous amounts of personal data available in computers threaten the individual in a way that renders obsolete much of the previous legal protection’ (quoted in Zuboff [33, p. 191]). But as MacFeely [34] points out, this right is being challenged and contested. For example, Tim Cook, CEO of Apple, described data protection as ‘political crap’ [35].

6. Challenges ahead

At the time of writing, this work is in its infancy. Many steps and challenges lie ahead, both foreseen and unforeseen. A few of the foreseen challenges are worthy of note, not least defining the scope and many elements that would comprise a GDC, setting out the principles that would form the backbone of a GDC and creating both the positive and negative incentives that would encourage all the different stakeholders to adhere to best practice international data governance. All of this must be done within the constraint of ensuring coherence with Global Digital Compact and other multilateral initiatives to ensure the development of coherent and consistent frameworks for our digital spaces.

A GDC will need to establish a clear set of definitions, so that boundaries are clear. One domain that will require careful consideration is the conceptualization of global public goods as it pertains to data. Is it appropriate to designate some data or statistics as public goods, and if so which ones? Or it is more appropriate to identify issues of global public concern (e.g. climate change, environmental degradation, trade and globalization, international crime, public health, Agenda2030 etc.) and then identify the data and statistics required to manage these global issues properly? What concept or definition of public good will be most appropriate – the narrow economic concept or a broader, social-contract approach? Critically, in an environment where regulations and policies will always play catch with technological innovations, it will be important for any GDC to be forwarding looking by anticipating emerging issues (by comprehensive horizon scanning) and provide interventions in an agile manner.

An important challenge will be to establish a set of timeless, universal data principles that speak to all data communities. These principles will build on existing international norms and principles, balance different rights of stakeholders and integrate ontologies and standards that promote innovations in creative, trustworthy and ethical re-uses of data while safeguarding against harmful misuse. These principles must encompass important dimensions of quality, governance, equality of access, privacy, data protection, copyright and property rights, personal and non-personal data, human and non-human data, public and private sector data, data sharing, data ownership, data reuse and recursive data. Principles must also speak to all stages of the data lifecycle, from collection to final use and reuse. Crucially, any proposed principles must be something that all stakeholders can sign up to. Finally, proposed principles must be sufficiently future-proofed to ensure continued relevance given the fast pace at which data and digital technologies are evolving today.

The architecture of any future GDC will be unlike that of any previous multilateral agreement. The UN system and other multilateral systems put UN Member States at the centre. While member states will be a key player in any future accord, they will not be the only player. The private sector, technology and media platforms and companies, are now major players in the data space and they must be involved and also agree to become signatories to any GDC. Equally, civil society, academia and think tanks, special sectoral interests, and most importantly and also challengingly, citizens – the individuals producing, using and being impacted by data – must all be consulted. It is not clear how this might be done, but it is clear that data is being produced by, consumed by and impacts everyone, and so everyone must have a say.

The United nations is ideally suited to this purpose. In fact the UN is arguably the only organization that has the global legitimacy to undertake this work. This stems from the UN’s ability to convene experts, and through impartial mediation, facilitate debate and discussion, so that a consensus can be reached [36]. The UN can bring together, not only the member states of the world together, but also businesses, civil society, academia and other international organizations to advance a GDC that will support sustainable development for a better future for people and the planet. The UN will of course need to adapt, to use the full reach of its convening power, to engage youth and future generations. Any process must also ensure that all nation States, from the most developed to the least developed, all have a say in any agreed future. Data are a global issue and therefore cannot be addressed without effective cooperation and coordination between all member states and all of the other key stakeholders.

7. Conclusion

Work at the UN to begin preparing a GDC is in its infancy. Coordinated intellectual work has just begun, but it builds on a huge volume of work that precedes it. The work that has begun will not only act as preparation for a GDC, but it will also provide valuable intellectual inputs to the work of the Global Digital Compact, the 2023 Summit of the Future and other multilateral initiatives. Thus, considerable effort must be given to ensure coherence across all of these global initiatives.

Consultations will be critical to the success of this work. Not only must many sectoral interests be considered, but also regional and developmental status. It is clear that attitudes to data, data products, data protection and privacy differ around the world. There are also a range of different concerns and capacities; issues like data colonialism, data localization, data protection, intellectual property, and data sharing in some regions must be balanced with ambitions to drive data innovation in others.

This journey has just begun. As noted, a long road lies ahead, but the pace is brisk. This work offers an enormous opportunity for the official statistical community to contribute, to think about what sort of dataverse they would like to see in the future. A multistakeholder consultation is required, but NSOs, agencies where data form part of their very DNA, should be well placed and prepared to articulate a view of a desired future.