Data governance for the 21st century: the role of data trusts

In the second installment of CSaP’s citizen science series, Professor Neil Lawrence, Jessica Montgomery and Professor Sylvie Delacroix guide us through the world of data trusts, and take a deeper look at how we can use rights, privacy and policy to empower citizens to steer data governance – before it steers them.

Which is more impactful on a person’s life: a decision to perform surgery or a decision to recommend a job advert? These types of decisions have become increasingly data-driven, but discussions surrounding them typically focus on those decisions that are immediately high-impact, such as health or driverless cars – consequential decisions. “But what about those inconsequential, everyday decisions that may constrain our lives through the data we project?” asked Professor Lawrence. Could a search engine’s perception of a user, and its subsequent choice to display only a particular job advert, similarly affect someone’s life? If so, then establishing policy frameworks around these data becomes crucial.

That is exactly what governments have been scrambling to do over the past 5 years, to install frameworks that “promote data use and technology for beneficial purposes, whilst managing risks related to privacy violations, digital discrimination or wider social issues.” explained Ms. Montgomery. Indeed, now that Covid has placed data, and the decisions they inform, at the front and centre of public life, the value attached to good data infrastructure has closely followed. Nevertheless, Professor Lawrence remains cautious: “Using these infrastructures to make data-driven decisions at the country level comes with challenges, whether that be data access or quality, technical privacy standards and security breaches or simply a fundamental lack of organisational culture based around data.”

So how should we design such infrastructures? Ms. Montgomery outlined key themes that often arise: “We need access to data, we need those people with skills to make use of the data to take part in decision making, and we need data governance systems that are deserving of public confidence.” The latter of these has been the topic of many public dialogues, which aim to understand citizens’ aspirations for what they perceive as acceptable data use. These have found that citizens’ perceptions of trustworthiness vary across demographics, time and context, meaning whichever system is in place needs to allow for continuous dialogue.

This challenge of creating new institutions that enable data access, whilst giving the community a continuous voice in how that data is used, is where data trusts come in. Trust law itself has a long history in the U.K. but is relatively new to this context. “It is a framework that enables individuals to take the rights they have and place them in an institution that governs and stewards those rights on their behalf.” explained Ms. Montgomery. “The trustees have a strict fiduciary duty to manage the rights that have been placed in the trust for the benefit of the trust’s members.” What make trusts attractive are the stronger laws and safeguards that surround them - the ability for courts to intervene in disputes.

As to what data trusts physically look like in reality, “it’s not a one-size-fits-all" stated Professor Lawrence. Being abstract governance mechanisms, the forms that data trusts take rarely dictate how data are physically stored; instead “data trusts work by centralising rights, not the data itself” explained Professor Delacroix. This is the opposite paradigm in force today, in which individuals are assumed to consider long-term consequences when providing consent. “[We need to be] burying this myth that people have the time to meaningfully engage with this field. Instead, we need a new profession around data trusts, who are intermediaries that negotiate on our behalf” stressed Professor Delacroix.

For Ms Montgomery, effective citizen engagement is crucial for making this work: “We need to understand where the demand is for these new types of data institutions, we need to widen participation, we need to negotiate these different perceptions of what makes an institution trustworthy or not and we need to have decision making processes which embed participatory governance in the operation of trusts”. This is the focus of the Data Trusts Initiative.

But can we trust the trust? Professor Delacroix explained that what sets data trusts apart, from a data co-op for example, is this involvement of trust law. If something goes wrong, it is this ability for equity courts, who possess substantial powers to intervene and replace undesirable trustees, that reverses the burden of proof. “It's not that the beneficiaries must prove that the trustee has acted wrongly, but it’s up to the trustee to prove they have acted with loyalty.” This avoids the situation where beneficiaries must constantly verify the actions of the trustees.

Regaining control over data in this way is far from trivial, partly due to the difficulty of translating principles to practices. Whilst we already have different legal tools and mechanisms suited for various data sharing purposes, the challenge is matching tools to a particular purpose - something which is made more difficult by the shifting usages of data and changing patterns of data reuse. As such, we’re yet to see something bring these principles together. But Ms. Montgomery is hopeful that the Data Trusts Initiative can support pilot projects to implement practical solutions, such as those implemented by the PLACE Trust and Driver’s Seat Coop.

In this case, it might not be long before we sign into online retailers not through our social network profiles but our data trust profiles. That way, we would be setting the terms and conditions – reversing the consent. As Professor Lawrence remarked, “we just need to make sure that we don’t wait until another pandemic, like Ebola or Covid-19, to realise this.”