March 2022 ALIGNING DATA GOVERNANCE WITH THE SOCIAL CONTRACT Analytical Insights FOR DATA TO PROMOTE VALUE, worldbank.org/digitaldevelopment TRUST, AND EQUITY In a world where data are becoming an integral part of our lives, data governance has become essential to support the production, use and reuse of data in a safe, ethical, and secure manner. In effect, data governance enforces the social contract around data by applying the principles of trust, value, and equity. This primer provides an overview of the different elements of a data governance framework as discussed in the World Development Report 2021, Data for Better Lives. The implementation of the different elements of the framework will be specific to a country context, informed by local norms, laws, and culture. Using this framework, a series of briefs accompanying this primer, will explore and review the data governance landscape in different regions with a view to facilitating the region’s pathway to a green, resilient, and inclusive recovery. Some of the key overarching messages of this primer are as follows: • Equitable development of the data economy calls for a foundation of infrastructure to ensure that both poor people and poor countries have affordable access to data services. • The legal and regulatory framework for data entails a balanced development of enablers that support reuse of data for value creations, and safeguards that create trust in the system. • As more economic activities shift online, a country’s data governance choices will have important implications for the real economy, in terms of competition, trade, and taxation. • However sound the legal and regulatory framework, data governance will not get very far without adequate institutions to implement and enforce the rules, and these are often missing. 1 ANALYTICAL INSIGHTS - NOTE 6 • While data governance is primarily a national concern, there are many areas where international cooperation on data governance is critical and beneficial. • Broad principles on data governance are helpful, but the realities on the ground differ substantially across regions necessitating more regionally grounded analysis and treatment. The COVID-19 pandemic has brought data governance issues to the forefront of public awareness. The debate about the use of call detail records from mobile phones to support contact tracing to con- trol the virus illustrates many of the challenges posed by data governance. On the one hand, the ability to readily access and repurpose call detail records has added value by helping to arrest the spread of disease in some countries. On the other hand, this practice has raised major concerns about whether people can trust public authorities not to misuse the data in other ways. At the same time, such an approach has little to offer those who may be too poor or disadvantaged to own a mobile phone in the first place, highlighting the issue of equity. worldbank.org/digitaldevelopment © sdecoret - stock.adobe.com 2 ANALYTICAL INSIGHTS - NOTE 6 A DEARTH OF DATA GOVERNANCE Currently, most countries around the world do not system, an aspirational vision that is built on the have robust data governance frameworks in place. principles of the social contract for data and seeks A new Global Data Regulation Survey, undertak- to deliver the potential value of data equitably while en especially for the World Development Report safeguarding against harmful outcomes. A solid 2021 (WDR 2021), shows that on average countries data governance framework is one that creates an are only 40 percent of the way toward implement- environment that allows economic and social value ing good data governance practices, ranging from from data to be readily created, provides adequate 30 percent in low-income countries to around 50 safeguards to preserve trust in data systems, and percent among high-income countries. Countries levels the playing field so that the benefits of data have made most progress passing data governance are equitably shared. The following sections pro- legislation, but those laws are not always compre- vide a brief overview of each of the data governance hensive, while the institutions to implement and pillars that are essential for delivering the potential enforce them are often inadequate. benefits of data for development while safeguard- ing against harmful outcomes. Although there The WDR 2021 broadly defines data governance to is no one-size-fits-all approach, this framework include data infrastructure policy, the legal and reg- provides a structure for more in-depth regional ulatory framework for data, the related economic analysis which will also take into consideration the policy implications, and the institutional frame- country context (history, culture, governance, and work (see Figure 1). These elements constitute the political economy). building blocks of an integrated national data INFRASTRUCTURE CAN ENSURE EQUITABLE ACCESS TO THE BENEFITS OF DATA Data infrastructure policies, a key building block Significant progress has been made during recent of the data governance framework, help level the years in rolling out coverage of 3G internet services. playing field in the modern data economy through However, internet coverage does not necessarily infrastructure that enables equitable access to data translate into internet use. A staggering 40% of the services for poor people in poor countries. This world’s population live within range of a mobile includes both the policies that make it possible for signal but nonetheless fail to make use of it, and people to connect to internet data services, and the this share (which is known as the “usage gap”) has policies that ensure that countries have adequate stubbornly persisted over time even as coverage has infrastructure to exchange, store, and process data increased. Promoting competition in the provision efficiently over the internet (see Chapter 5). of broadband services can help to keep down prices worldbank.org/digitaldevelopment 3 ANALYTICAL INSIGHTS - NOTE 6 and make services more affordable. In addition, face service charges up to ten times higher than policymakers should increasingly aim to address those able to perform these functions domestically. demand side barriers to service uptake such as Such infrastructure can often be developed by the expensive devices, poor digital skills, and limited private sector, but calls for the creation of a sup- local content. portive enabling environment, including strong governance arrangements as well as availability of At the same time, many low- and middle-income renewable electricity supply. Due to economies of countries lack internet exchange points (IXPs), scale, small economies may need to club together colocation data centers, and access to on-ramps at the regional level to support the development of for cloud computing. Countries needing to send such infrastructure. their data overseas to access such facilities can FIGURE 1: Data governance layers at the national and international levels Source: WDR 2021 worldbank.org/digitaldevelopment 4 ANALYTICAL INSIGHTS - NOTE 6 SOUND REGULATIONS CREATE A TRUST ENVIRONMENT Achieving trust in data exchanges requires a robust nonpersonal data (from mobile phones) is person- regulatory environment for both personal and ally identifiable, while even anonymized personal nonpersonal data. This is the second building block data can increasingly be reidentified by pooling of the data governance framework (see Chapter 6). multiple sources of information and applying It involves both rigorous cybersecurity measures modern analytical techniques. to protect the integrity of data systems and strong measures for data protection. Overall, the level of development of regulatory frameworks for personal data protection remains Personal data protection is grounded in a human rather uneven around the world. According to rights framework, which demands that individual the Global Data Regulation Survey, policy makers rights are first respected, typically by seeking indi- across the income spectrum have systematically vidual consent, before anything else is done with neglected certain important aspects of the data pro- data. But this type of protection is not without tection framework—such as regulatory limitations costs both for firms and individuals. A survey of on algorithmic decision making, requirements to relatively large firms indicates that companies’ cost incorporate privacy by design, and limitations on of complying with the EU’s General Data Protec- government exceptions for accessing personal data tion Regulation (GDPR) range from US$250,000 (see Figure 2). to almost US$2 million a year (EU 2018). On the consumer side, estimates indicate that it would At present, only a handful of lower-income coun- take the average person 76 days a year to read and tries have developed sound data protection legis- study all the consent notices regarding data pro- lation. A rare example is Kenya, whose 2019 Data tection that they routinely click on when visiting Protection Act includes comprehensive best prac- different websites (Madrigal 2012). Such concerns tice cybersecurity requirements (such as pseud- have prompted public debates regarding possible onymization and encryption), as well as a personal alternative approaches to data protection, including data protection framework that incorporates many placing stronger fiduciary obligations on data pro- elements of the EU’s GDPR. cessors, upscaling deployment of Privacy Enhanc- ing Technologies (PETs), or introducing Personal The economic and social value of data can be Information Management Systems (PIMS) through multiplied exponentially as data are reused, repur- intermediaries that support people with the man- posed, and recombined with other data sources. agement of their data (see Chapter 6). Such intensive reuse of data is possible only if the legal framework contains enablers that require data To make matters even more complex, it is getting sharing and facilitate data exchange through legal increasingly difficult to define personal data. Much requirements (such as open access) and technical worldbank.org/digitaldevelopment 5 ANALYTICAL INSIGHTS - NOTE 6 FIGURE 2: Progress on personal data protection legislation differs markedly across country income groups (2020) Source: WDR 2021 based on World Bank, Global Data Regulation, https://microdata.worldbank.org/index.php. catalog/5866. Data for 80 countries surveyed at http://bit.do/WDR2021-Fig-6_4 Note: The figure shows the percentage of countries in each country income group that had adopted good-practice legal and regulatory frameworks to safeguard personal data as of 2020. norms (such as interoperability). Many govern- creation of smart cities, metropolitan areas such as ments around the world have already adopted open New York, San Francisco, and São Paulo have made data provisions, often supported by access to infor- legal attempts to require certain private sector mation legislation, with valuable results. An impact platforms to share their commercial data. Among assessment of the EU’s 2003 Directive on Reuse of the most comprehensive efforts to date, France’s Public Sector Information found that it generated Law for a Digital Republic (2016) requires that the €52 billion in value in 2017 (EC 2018). private sector make certain public interest data sets publicly available based on open standards. The However, sharing of private sector data (both United Kingdom’s Digital Economy Act (2017) among firms and with the public) has proven takes a somewhat different approach, enabling much more difficult due to commercial incentives researchers to gain access to deidentified data for to retain data and more limited government influ- research purposes. ence to encourage sharing. In an effort to spur the worldbank.org/digitaldevelopment 6 ANALYTICAL INSIGHTS - NOTE 6 DATA GOVERNANCE HAS ECONOMIC IMPLICATIONS Data governance also has important implications Competition dynamics in platform-driven busi- for the economic fortunes of countries. The expa nesses tend to lead to market dominance and create nding role of data in ubiquitous platform business an unlevel playing field for entrants in low- and models is reshaping competition, trade, and taxa- middle- income countries, affecting equity. Half a tion in the real economy, posing important risks dozen major US data-driven companies (Google, for low- and middle-income countries. This means Facebook, Microsoft, Amazon, Zoom, Verizon) that the way countries design the safeguards and account for 40 percent of global data traffic and enablers to govern the data on which these business two-thirds of the top 25 most visited website across models depend, will have knock-on effects for the a majority of lower-middle-income countries (see real economy (see Chapter 7). Figure 3). This raises equity concerns as market dominant platforms may be able to extract rent from consumers, and also preclude entry by new players. FIGURE 3: Google, Facebook and Microsoft alone own half of the top websites and are among the top 10 most visited websites in all low-income countries for which data are available. Source: Alexa (downloaded 2020:Q2) worldbank.org/digitaldevelopment 7 ANALYTICAL INSIGHTS - NOTE 6 FIGURE 4: Cross-border data regulation regimes in place around the world. Source: WDR 2021 Antitrust agencies—where they exist—will need data-enabled services trade, a major new source of to adapt their traditional approach to mergers to economic value for the developing world. The Ban- address the challenges posed by platform busi- gladeshi firm Augmedix, for instance, offers remote nesses, while balancing the complex interactions assistance to medical doctors in the United States. between data protection and competition concerns. Doctors wear smart glasses allowing Bangladeshi Proactive adoption of data-sharing regulations may assistants to “witness” patient consultations and help to restrain the accumulation of market power. create associated medical records. This two-way For example, in the Uber-Careem merger in Egypt, exchange of data, and the high value-added services Uber was obliged to grant future competitors that it generates, is possible only because both coun- access to Careem’s “points of interest map data” tries allow for such sensitive data to move across on a one-time basis; provide current competitors borders (open transfers). In other parts of the world, with access to trip data (including rider and driver such cross-border data flows may be limited due to information), subject to data protection laws; and government regulations requiring prior approval or give riders access to their own data. mandating local storage of data (limited transfers), or be conditional on a regulatory determination of Regulations governing the cross-border flow of the adequacy of data protection arrangements in personal data (see Figure 4) are a critical factor the trading country (conditional transfers). in determining a country’s competitiveness in worldbank.org/digitaldevelopment 8 ANALYTICAL INSIGHTS - NOTE 6 Taxation of data-driven businesses is posing seri- When it comes to corporate taxation, the recent ous challenges that are preventing an equitable G20 agreement on international harmonization of geographic distribution of the tax revenues from corporate tax rates is helpful. However, internation- data-driven businesses. In the case of the value al allocation of taxation rights is unclear and incon- added tax (VAT), the principle of taxation in clusive talks are underway, facilitated by the OECD. jurisdiction where sale occurs is well established, In the meantime, some 30 countries are stepping but developing countries struggle to implement it into the breach with their own ad hoc digital administratively. To illustrate how much revenue services taxes, creating international tensions. For is at stake, in Indonesia, the gross VAT revenue example, in 2016, India enacted a 6 percent “equal- potential of the business to consumer (B2C) digital ization levy” on digital services linked to online economy is estimated to amount to 0.39 of GDP in advertising, as a proxy for a corporate income tax 2021 and is projected to rise to 0.65 percent in 2025. on foreign suppliers. © kras99 - stock.adobe.com worldbank.org/digitaldevelopment 9 ANALYTICAL INSIGHTS - NOTE 6 INSTITUTIONS DRIVE IMPLEMENTATION AND ENFORCEMENT For effective implementation and enforcement of and enforcing compliance with established laws the various building blocks of data governance, a and regulations; undertaking arbitration in case of suitable institutional ecosystem that encompasses conflict; and maintaining monitoring, evaluation, both state and nonstate institutions and actors and constant feedback loops to promote engage- must be in place. The roles and responsibilities of ment, learning, and improvements. In some coun- institutions and actors are evolving in response to tries, these functions can be performed by existing changes in the data economy. However, the main institutions (such as the national statistical office or functions (see Figure 5) include developing overar- relevant sector regulators). In others, there might ching data strategies and policies; elaborating legal be a need to create new institutions (such as data frameworks and guidance on how rules should protection agencies or data intermediaries). apply and be enforced if violated; implementing FIGURE 5: Functions of data governance Source: WDR 2021 worldbank.org/digitaldevelopment 10 ANALYTICAL INSIGHTS - NOTE 6 FIGURE 6: The lower the country income level, the fewer FIGURE 7: Only about one-quarter of low-income countries are the countries with data protection authorities. have cybersecurity agencies Source: WDR 2021, teams calculations based on Wold Source: WDR 2021, teams calculations based on Wold Bank, DGSS (Digital Government/GovTech Systems Bank, DGSS (Digital Government/GovTech Systems and Services) (Dataset), https://datacatalog.worldbank. and Services) (Dataset), https://datacatalog.worldbank. org/dataset/digital-governmentgovtech systems-and- org/dataset/digital-governmentgovtech systems-and- services-dgss-dataset. Data at http://bit.do/WDR2021- services-dgss-dataset. Data at http://bit.do/WDR2021- Fig-8_4. Fig-8_6. Note: Data are for 198 economies. Note: Data are for 198 economies. Despite the increasing importance of these institu- perform critical data governance functions involved tions, they are not common in lower-income coun- in the production of official statistics. The demands tries. Only 21 percent of low-income countries have of the changing data landscape require NSOs to established data protection authorities, compared modernize their data governance functions to to 81 percent of high-income countries (see Figure improve data flows both within public sector and 6). Similarly, cybersecurity agencies are relatively with other non-governmental actors. NSOs require widespread in middle- and high-income countries sufficient financing, independence, and capacity to but are present in only 24 percent of low-income effectively modernize countries’ national statistical countries (see Figure 7). National statistical offices system (see Chapter 2). (NSOs) as premier data institutions in countries worldbank.org/digitaldevelopment 11 ANALYTICAL INSIGHTS - NOTE 6 Whatever the roles and functions of individual No matter what institutional design a country institutions, the new data economy calls for a chooses to implement, institutions and actors must whole-of- government approach that enables have the leadership, technical capacity, resources, data flows between different institutions and and incentives to perform their roles and harness actors, eliminating siloed decision making, and the value of data and shift toward a culture of data guiding data management decisions along the use (see Figure 8). Moreover, a multistakeholder data life cycle. For example, Uruguay’s creation approach to data governance is better equipped to of a lead agency — the Agency for Electronic govern the complex data ecosystem in a transpar- Government and Information and Knowledge ent, inclusive, and equitable way that reflects the Society (Agesic)—close to the Office of the Presi- interests of all key stakeholders (see Chapter 8). dent and acting with a whole-of-government and multistakeholder perspective has been critical in driving the country’s successful e-government reforms and the data agenda since 2007. FIGURE 8: Figures of well-functioning institutions for effective data governance Source: WDR 2021 worldbank.org/digitaldevelopment 12 ANALYTICAL INSIGHTS - NOTE 6 DATA GOVERNANCE IS ALSO AN INTERNATIONAL ISSUE Efficient and effective data governance also calls For smaller economies, regional cooperation can for closer international cooperation. Such collab- play a valuable role by reducing costs of data infra- oration is needed not only at the global level, but structure through development of shared regional regionally and bilaterally, too. facilities, achieving scale economies through physical and regulatory integration of markets, Bilateral cooperation between counterpart agencies and enhancing voice and negotiating strength in in different countries can be an important means global processes. to address many data governance challenges. Law enforcement agencies need to collaborate to combat Global cooperation is needed for key areas where cybercrime, which moves effortlessly across borders, free rider behavior (such as protectionism or tax by means of Mutual Legal Assistance Treaties. Tax evasion) is a risk. At the global level, key agreements administrations need to share financial information on taxation and trade for data-driven businesses of firms to support mobilization of VAT revenues are pending international agreement. Multilateral from sales of businesses registered in third countries efforts can also do much to reduce transactions but undertaken across digital platforms. Antitrust costs through harmonization of technical stan- agencies may benefit from coordinating regulatory dards, often led by industry bodies. approaches when determinations made in one coun- try affect firms active in other jurisdictions. © S.Gvozd - stock.adobe.com worldbank.org/digitaldevelopment 13 ANALYTICAL INSIGHTS - NOTE 6 A DATA GOVERNANCE VISION While data governance challenges may seem daunt- ture and protocols) with a governance solution (the ing, the experience of leading-edge countries offers once-only principle legally obliging public sector a concrete vision of what can be achieved when these agencies to refrain from duplicating data requests). issues are systematically addressed. In Estonia, for X-Road’s cryptography protocols also enhance example, the government has set up a national data transparency because they log entries into the system to safely manage citizens’ personal data for system and give individuals detailed insights into use by government agencies and participating busi- who is sharing their data and for what purposes. nesses. X-Road is an open-source data exchange X-Road embodies the three main principles of any layer solution that allows linked public and private social contract for data governance. Its transparen- databases to automatically exchange data, ensuring cy engenders trust. Its national scope and universal confidentiality, integrity, and interoperability. It availability promote equity. Its comprehensiveness combines a technical solution (software architec- and ease of use generate value. © Friends Stock - stock.adobe.com worldbank.org/digitaldevelopment 14 ANALYTICAL INSIGHTS - NOTE 6 ADAPTING DATA GOVERNANCE TO REGIONAL DIVERSITY A well-designed data governance framework is critical for reaching the aspirational goal of an brings the social contract to life. It allows integrated national data system. countries to capture the full economic and social value of data, while creating trust in the integ- Each region or country will design data gover- rity of the data system as well as ensuring that nance policies, considering local norms, values, the benefits of data are equitably shared. This and culture. Understanding the nature of the data involves implementing policies that will close governance challenges which differ significantly the digital divide, providing universal broadband across regions will be critical for designing these access, and ensuring that all countries can access policies. In Sub-Saharan Africa, universal access modern infrastructure to exchange, process, and challenges remain paramount. In the Middle East store growing volumes of data. It also entails and North Africa, open and transparent access to developing regulatory frameworks and institu- public sector data to support value creation has tions to safeguard data through cybersecurity and been a longstanding concern. In Latin America, a data protection measures, while enabling the safe central concern is how to leverage the economic sharing and reuse of data. Moreover, data gover- opportunities posed by digital platforms and nance has important economic implications, with trade in data-enabled services. To do justice to the design of safeguards and enablers to govern these wide-ranging circumstances, this primer data in platform business models having a real will be accompanied by a series of regional briefs effect on economies. In addition, internationally which will provide a more in-depth analysis of coordinated action—on antitrust enforcement, the different elements of the data governance regulation of platform firms, data standards, framework, and conduct benchmarking of coun- trade agreements, and tax policy— is critical to tries within specific regions. These will bring ensuring efficient, equitable policies for the data the overarching messages of the WDR 2021 to a economy that respond to countries’ needs and more concrete local level and support regional interests. Ultimately, effective data governance and national policy dialogue on the way forward for data governance. worldbank.org/digitaldevelopment 15 ANALYTICAL INSIGHTS - NOTE 6 ACKNOWLEDGMENTS This primer is based on findings from World through consultations, the work of which under- Development Report 2021: Data for Better Lives. The pinned the basis for this document. The WDR Core note was authored by Vivien Foster (Chief Econo- Author Team included Robert Cull, Vivien Foster, mist, Infrastructure Vice-Presidency) and Malarvizhi Dean Jolliffe, Malarvizhi Veerappan, Jaffar Al-Rikabi, Veerappan (Program Manager, Development Adele Barzelay, Miriam Bruhn, Rong Chen, Niccolo Economics Vice-Presidency), with editorial support Comini, Samuel Fraiberger, Craig Hammer, Talip and guidance from Rami Amin (ET Consultant, Kilic, Jan Loeprick, Daniel Gerszon Mahler, Michael Digital Development). Minges, Martín Molinuevo, Nancy Morrison, David The team acknowledges the core WDR2021 author Newhouse, Sara Nyman, Selome Paulos, Vinny Ric- team for their contribution to the overall report, ciardi, David Satola, Dorothe Singer, Philip Wollburg, as well as to those who contributed to the report and Bilal Zia. REFERENCES CEA (Council of Economic Advisers). 2018. “The Cost of Malicious Cyber Activity to the U.S. Economy.” CEA, White House, Washington, DC. https://www.whitehouse.gov/wp-content/uploads/2018/02/The-Cost-of-Mali- cious-Cyber-Activity-to-the-U.S.-Economy.pdf EC (European Commission). 2018. “Study to Support the Review of Directive 2003/98/EC on the Re-Use of Public Sector Information: Final Report. Luxembourg: Publications Office of the European Union.” https://data.europa.eu /doi/10.2759/373622 EU (European Union). 2018. “Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a Framework for the Free Flow of Non-personal Data in the European Union.” Official Journal of the European Union L 303, vol. 61 (November 10): 78–68. https://eur-lex.europa.eu/legal-content/EN/TXT/ PDF/?uri=OJ:L:2018:303:FULL&from=EN. Madrigal, Alexis C. 2012. “Reading the Privacy Policies You Encounter in a Year Would Take 76 Work Days.” Atlantic, March 1, 2012. https://www.theatlantic.com/technology/archive/2012/03/reading-the-privacy-policies- you-encounter-in-a-year-would-take-76-work-days/253851/. Marks, Joseph. 2021. “The Cybersecurity 202: The meat industry is the latest to be thrown into chaos by ransomware.” Washington Post, June 2, 2021. https://www.washingtonpost.com/politics/2021/06/02/cybersecuri- ty-202-meat-industry-is-latest-be-thrown-into-chaos-by-ransomware/ World Bank. 2021. World Development Report 2021: Data for Better Lives. Washington, DC: World Bank. https:// wdr2021.worldbank.org/ World Bank. 2021. World Development Report 2021: Data for Better Lives. Washington, DC: World Bank. https:// openknowledge.worldbank.org/handle/10986/35218 worldbank.org/digitaldevelopment 16 ANALYTICAL INSIGHTS - NOTE 6 © 2022 International Bank for Reconstruction and Development /The World Bank 1818 H Street NW, Washington, DC 20433 This work is a product of the staff of The World Bank with external contributions. The findings, interpre- tations, and conclusions expressed in this work do not necessarily reflect the views of The World Bank, its Board of Executive Directors, or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. Rights and Permissions This work is available under the Creative Commons Attribution 3.0 IGO license (CC BY 3.0 IGO) http:// creativecommons.org/licenses/by/3.0/igo. Under the Creative Commons Attribution license, you are free to copy, distribute, transmit, and adapt this work, including for commercial purposes, under the follow- ing conditions: Attribution Please cite the work as follows: World Bank, 2022. “Aligning Data Governance with the Social Contract for Data to Promote Value, Trust, and Equity.” Analytical Insights Series, Note 6, World Bank, Washington, DC. License: Creative Commons Attribution CC BY 3.0 IGO Third-party content The World Bank does not necessarily own each component of the content contained within the work. The World Bank therefore does not warrant that the use of any third-party-owned individual component or part contained in the work will not infringe on the rights of those third parties. The risk of claims resulting from such infringement rests solely with you. If you wish to re-use a component of the work, it is your responsibility to determine whether permission is needed for that reuse and to obtain permission from the copyright owner. Examples of components can include, but are not limited to, tables, figures, or images. worldbank.org/digitaldevelopment 17 worldbank.org/digitaldevelopment Analytical Insights DIGITAL DEVELOPMENT