Data commons and data governance

Digital life generates vast quantities of data, most of which is collected and controlled by a small number of platform companies or by state agencies. Data governance asks who decides how data are collected, accessed, shared and used, and who benefits. A data commons answers that question collectively: data are pooled and stewarded by a community according to rules its members help make.

The idea extends the study of commons from forests, fisheries and irrigation to information. It responds to three problems: the concentration of economic value from data in a few firms; the weakness of individual consent as a safeguard when data about one person reveal information about many; and the under-use of data that could serve research or public purposes but sit locked in silos.

Knowledge commons

Charlotte Hess and Elinor Ostrom argued that knowledge resources can be analysed with the same framework Ostrom used for natural common-pool resources: who are the users, what are the rules for appropriation and provision, how are they monitored and enforced, and how are rules changed. Unlike fish, data are non-rival: use by one does not deplete them. The governance problem is therefore less over-use than enclosure, quality and harm: who may exclude others, who maintains the resource, and how misuse is prevented.

Models of data governance

Marina Micheli and colleagues identified four emerging alternatives to the corporate-platform model:

• Data sharing pools: organisations pool data for mutual benefit under common terms.
• Data cooperatives: members contribute their own data and govern its use democratically.
• Public data trusts: a public body holds data in trust for citizens and grants access for public purposes.
• Personal data sovereignty: individuals control their data through personal data stores and decide case by case whom to share it with.

Sylvie Delacroix and Neil Lawrence proposed bottom-up data trusts, in which groups of data subjects pool their rights and appoint trustees with fiduciary duties to negotiate on their behalf, arguing that no single model suits every kind of data.

Principles

• The FAIR principles (Findable, Accessible, Interoperable, Reusable), published in 2016, guide scientific data stewardship.
• The CARE principles for Indigenous data governance (Collective benefit, Authority to control, Responsibility, Ethics), published in 2020 by the Global Indigenous Data Alliance and collaborators, complement FAIR by focusing on people and purpose rather than only on data.
• Ostrom's design principles for commons, especially clear boundaries, congruence between rules and local conditions, participation in rule-making and graduated sanctions, are frequently used to evaluate data institutions.

• OpenStreetMap, founded in 2004, is a map of the world built and maintained by volunteers and released under an open database licence; its foundation and community set editing and attribution rules.
• Scientific data repositories such as genomic and climate databases operate as research commons with rules on access, credit and privacy.
• Indigenous data sovereignty movements, including Te Mana Raraunga in Aotearoa New Zealand and networks in Australia, Canada and the United States, assert collective rights over data about Indigenous peoples and lands.
• The EU Data Governance Act (Regulation (EU) 2022/868) creates a legal framework for neutral data intermediation services and registered data altruism organisations that collect data donated for purposes of general interest.
• Sidewalk Toronto: a 2018 proposal by Sidewalk Labs for an independent "urban data trust" to govern data collected in a planned smart neighbourhood drew strong criticism over privacy and accountability; the company withdrew from the project in 2020.
• Health data cooperatives in Switzerland and elsewhere let members store medical data and vote on research uses.

• Scale and capture: commons institutions struggle to compete with platforms that have network effects and capital; data trusts can become captured by the organisations they are supposed to supervise.
• Privacy and re-identification: pooling increases the risk that individuals can be re-identified, and open licences make it hard to recall data once released.
• Boundary problems: data about one person are often data about others (genetic relatives, social contacts), so it is unclear who the "members" of a commons should be.
• Free-riding and maintenance: open data are easy to use and costly to maintain; many commons depend on a few volunteers or on grant funding.
• Value distribution: even well-governed commons may see most economic value captured by firms that use the data, unless licences or fees redistribute it.
• Legal uncertainty: trust law, cooperative law and data-protection law were not designed for data stewardship, and fiduciary duties of data trustees are untested.

Data commons are a growing but still small part of the data economy. Their clearest successes are in science, mapping and open-source software, where contributors share norms and benefits are diffuse. In personal and commercial data the evidence is thinner and many pilots remain experimental. The field is moving from manifestos to institutional design: legal forms for intermediaries, licences that preserve collective control, and principles such as CARE that put the rights of affected communities alongside technical openness.

• Micheli et al., "Emerging models of data governance in the age of datafication" (2020)
• Carroll et al., "The CARE Principles for Indigenous Data Governance" (2020)
• Wilkinson et al., "The FAIR Guiding Principles" (2016)
• Delacroix and Lawrence, "Bottom-up data trusts" (2019)
• EU Data Governance Act, Regulation (EU) 2022/868
• Charlotte Hess and Elinor Ostrom (eds), Understanding Knowledge as a Commons (MIT Press, 2007)