Managing public sector data: National challenges in the context of the European Union’s new data governance models

2.1The concept of data governance and its dominant models

The concept of data governance has gained the attention of different fields in the literature, but its conceptual boundaries are still being determined. The expression was first used in the realm of Information Management, and it was thought of as the system of governance used to manage data inside different organisations (Abraham, Schneider, & vom Brocke, 2019). In Science and Technology Studies (STS), authors emphasise that data governance entails the “power relations between all the actors affected by, or having an effect on, the way data is accessed, controlled, shared and used, the various socio-technical arrangements set in place to generate value from data, and how such value is redistributed between actors” (Micheli et al., 2020, p. 3). In critical data studies, Kitchin explains that the concept of data governance designates the idea of a system of actors with different entitlements and several legal and organisational layers that define how value is extracted from data (Kitchin, 2022, pp. 278–279). In socio-legal scholarship, the concept of data governance captures both the managerial element and the question of power/entitlements. In this sense, Ducuing explains that “from a policy and regulatory perspective, data governance can be defined as a system of rights and responsibilities that determine who can take what actions with what data.” (Ducuing, 2020, p. 59). Additionally, from a policy perspective, data governance can be understood broadly as the ensemble of technical tools and mechanisms, legislative and regulatory actions that aim to “enhance the creation of value from data” (Graef, 2020, p. 25). In brief, all these perspectives, and more specifically, the perspectives of critical data studies and the social-legal scholarship, highlight the social constructions that enable the use and reuse of data and, consequently, the extraction of value from them.

Two crucial and entangled issues are at the heart of the issue of data governance: the concentration of data in the hands of just a few actors and the stewardship of data-driven innovation toward the common good. Data governance models determine how and by whom data can be accessed, used and reused (Beaulieu & Leonelli, 2022). There is a variety of rules and regulations that define the conditions in which data governance takes place. These regulations encompass data protection rules, proprietary rights, security and secrecy rules, contractual conditions, and the still unsolved question of data ownership, among others. Different types of data will be subject to different rules and regulations, that will also depend on the context of their use. Broadly speaking, the different possibilities of data governance will be found anywhere along the spectrum between entirely closed and completely open access. Figure 1 illustrates how the regulatory framework determines the place of data under this spectrum. It is important to note that any data in this spectrum can be held or controlled by either public entities (such as governments of different spheres, local, regional, national or even international authorities) or private actors.

Figure 1.

Openness spectrum.

The current legal and political framework of data governance enabled the rise of the platform economy and data-driven markets with the winner-take-all structural logic, leading to the concentration of data and technical resources in a few giant tech companies (Pistor, 2020; Stilgoe, 2020). The exclusive access enabled by the current legal framework locks data into silos and hampers innovation. Indeed, small actors with good business ideas could find insurmountable difficulties in going further with their ventures if access to data is too difficult or, in some cases, impossible (Beaulieu & Leonelli, 2022; Verdegem, 2022). The second aspect that becomes salient in the discussion on data governance concerns the final use of data, the desirability of innovation and the legitimacy of the decisions concerning the direction and speed of innovation. Much of the recent technological development has been driven by giant corporations that retain the power to decide the areas of innovation, having as their core value the pursuit of economic gains (Birch, Chiappetta, & Artyushina, 2020; Taylor, 2021; Viljoen, 2021). In this sense, the question of the purpose of data-driven innovation underlines the discussion about increased access to data and improved data-sharing conditions (Taylor et al., 2022).

While the ’closed’ side of data governance had led to data and technology concentration in the hands of a few powerful actors, leaving small space for social innovation, the open regime of freely and widely accessible data embodied by the OGD movement has produced only modest outcomes. In this context, research into OGD’s features, barriers and effects provides insightful inputs concerning the process of opening up data and its consequences. Within this literature, there is an emerging consensus that the OGD’s initial ambitious promises are difficult to realise in the real world (Janssen, 2012; Jetzek et al., 2013; Murillo, 2015; Reggi et al., 2022; Schwoerer, 2022). Some authors have suggested that the real potential of OGD is quite limited (Ruijer & Meijer, 2020). Others suggest that the results of widespread OGD availability are not meeting expectations (Murillo, 2015; Susha, Grönlund, & Janssen, 2015). Safarov and colleagues indicate a general lack of evidence of the causal links between OGD and positive outcomes and point out that “it is not enough to assume that the effects will occur, and that this will occur automatically” (Safarov et al., 2017, pp. 18–19). Khayyat and Bannister highlight the weakness of misguided ideas about openness that ignore the complexity of license regimes and argue that an adequate license regime could offer a better solution to the management of PSD (Khayyat & Bannister, 2015). Jaakola and colleagues note that it is not enough to open data, it is necessary to promote and encourage the use of that data (Jaakola, Kekkonen, Lahti, & Manninen, 2015).

The literature thus shows that the simple provision of access to data does not ensure its reuse nor that its potential reuse will produce results aligned with social goals. Research to date corroborates this view, emphasizing the need for improving mechanisms of feedback (Reggi et al., 2022) and for constructing a closer collaboration between public sector bodies and potential PSD users (Ruijer & Meijer, 2020; Smith & Sandberg, 2018). Furthermore, one should not be blind to the commercial interests behind the movement to open up PSD (Bates, 2014; Birch et al., 2020; Bodó, 2019; Longo, 2011). The question of open (or closed) access is only the beginning of the discussion on better uses of data. New forms of data governance, forms that were more socially responsible and sustainable, would entail a discussion on systems of participation and representation within a democracy, not only on the possibilities of access, but also on what kind of uses are enabled and what innovation is both needed and necessary (Beaulieu & Leonelli, 2022; Bodó, 2019).

2.2Alternative models of data governance

The discussion about alternative data governance models aims to find new ways to best articulate the different rights related to data to maximise its potential value, considering equally social and economic goods (Graef, 2020). Scholars have proposed several alternatives to resolve the problem of data concentration and promote more sustainable use of data (Madison, 2020; Micheli et al., 2020). Sustainable use of data can be understood as the type of use that preserves and supports communities and their values (Taylor & Purtova, 2019). Another argument in this debate is that regimes incentivizing data sharing could be a more economically efficient answer and would boost innovation, even if it is not without costs (Graef & Prüfer, 2021; Pistor, 2020). Some authors call for public data infrastructures or data spaces that foster innovation and sustain better political decisions (Zygmuntowski, Laura Zoboli,& Nemitz, 2021). Most alternative models proposed depend on creating new legal arrangements and policy adaptations.

From this perspective, Micheli et al. propose a taxonomy of alternative data governance models that policymakers could foster to counter-balance the problems created by the platform economy (Micheli et al., 2020). Among the different models put forward, the public data trust model entails establishing a new kind of institution that manages, preserves privacy and improves the public value of data (Kitchin, 2022). A public data trust would be an independent institution empowered to receive, store, and share data from public bodies (but also eventually from private actors); it would establish the conditions for sharing such data with private actors and other interested public bodies. The institution would also oversee data reuse, preserving control over data and preventing abuse. The key idea underlying such a proposition is that data should provide insights and support for policymaking and promote innovation and social good (Micheli et al., 2020). Under the model described by Micheli et al., there is no detailed specification of how the governance of such structures would be organized, but the authors emphasize that innovative forms of participation and democratic decision-making should be deployed (Micheli et al., 2020). A few pilot projects of public data trust have been tried and are discussed in the literature. One such is the city of Barcelona and others are to be found in the United Kingdom in different areas, for example urban data, the illegal wildlife trade, and food waste (Hardinges, Wells, Blandford, Tennison, & Scott, 2019; Morozov & Bria, 2018).

The public data trust model echoes the idea of exploring data through a regime of commons, producing a more plural and collective data governance approach (Madison, 2020; Taylor & Purtova, 2019). However, the public data trust contrasts with the idea of purely open commons, which is at the foundation of the OGD movement and the roots of PSD liberalisation (Bodó, 2019). Indeed, while in the OGD regime, PSD is widely and freely available, without any control or oversight of its use, a public data trust regime would entail democratic control over data access and reuse. The management of PSD would be closer to a closed commons regime. In this sense, Madison explains that data could be considered a collective resource, and their extraction and management should involve the participation of all the interested and affected actors. This closed commons approach relies on the idea that the resources are not completely open to being exploited, but they should be subject to collective governance through the enactment of collective institutional rules addressing coordination and social (and ethical) dilemmas. Such a governance system could co-exist with private and market laws (such as proprietary rights) (Madison, 2020). Figure 2 illustrates data flow among public sector entities and public or public actors through public data trust.

Figure 2.

Public data trust.

Public data trust and data governance through the commons approach raises the question of what kind of data-driven innovation is desirable and who decides about the desirability of such innovation? The idea is to add public and democratic reflection on the purpose and the form of data sharing and reuse. This approach, it is argued, would also bring public scrutiny to the innovation process by making the link between the input (data) and the output (final product or service) more transparent and shedding light on the overall impact of innovation. Adding this reflection layer could provide a space for discussion and negotiation on the possible harms and benefits of technological advances and how those harms and benefits are distributed throughout society (Pfotenhauer, Laurent, Papageorgiou, Stilgoe, & Jack, 2022). It also provides more transparency and public awareness of the trade-offs of innovation, making more explicit how, for example, gains in efficiency could also lead to an increase in surveillance or aggravate discrimination against certain vulnerable groups (Taylor, 2017). Moreover, a democratic debate about the desirability of innovation would contest the rhetoric of the inevitability of technological advances (Taylor, 2017).

The discussion as to how to make the most of data’s potential while aligning data-driven innovation to society’s needs and priorities envisages, inter alia, engagement with the broader question of how to increase the potential of scientific knowledge and technical innovation so as to address societal problems and challenges (such as climate change, demographic-ageing crisis, etc.) (Beaulieu & Leonelli, 2022; Mazzucato, 2016). In this respect, the literature on RRI proposes a possible path to reduce the gap between society’s needs and innovation. In the next section, we explore the RRI to bring into the discussion on data governance the lessons that can be learned from the RRI practice and literature.

2.3Responsible research and innovation

The possibility of bridging the needs of society and technological advances is a challenge and has received much attention from scholars and policymakers (Jasanoff, 2016). Several mechanisms have been proposed and in some cases tried (with different levels of success). Some of these aim to enable society to have an active voice in the discussion of the technological future. STS provides the shared theoretical base of these approaches. It considers that technological advances are not the deterministic result of technical features. Instead, it assumes that political and social choices have a direct influence over the technological trajectory (Stilgoe, Owen, & Macnaghten, 2013). This premise gains renewed relevance, considering that technological innovation, once deployed, becomes structural and shapes social sets by enabling and constraining action (Orlikowski, 1992). In this sense, considering that the trajectory of technological advances is shaped by social structures, discussions on the governance of innovation are also discussions about power and decisions over our collective future (Pfotenhauer et al., 2022).

In this context, the RRI framework emerged as a possible approach to tackle the challenge of promoting socially desirable innovation (Jirotka, Grimpe, Stahl, Eden, & Hartswood, 2017). The framework emerged simultaneously as a policy discourse and a research field (Owen & Pansera, 2019). As a policy discourse, it was adopted by the EU to make science and innovation more responsive to contemporary society’s challenges (Owen & Pansera, 2019). The framework aims to bring together on one side, science and innovation and, on the other side, the expectations and values of society (Owen, Pansera, Macnaghten, & Randles, 2021). Several researchers have collaborated on the elaboration and development of the concept. Scholars emphasize that the process of innovation creates the future and entails changes that may affect society at large; hence, it should be the subject of democratic reflection and decision (Owen & Pansera, 2019). The most current definition of RRI in the literature is inspired by a policy document published by the European Commission (EC) in 2011 (Burget, Bardone, & Pedaste, 2017). The definition goes as follows:

The RRI approach engages with a broad realm of stakeholders in the discussion concerning the direction and speed of research and innovation (Randles, Tancoigne, & Joly, 2022). It proposes a democratic and inclusive decision-making process concerning new technologies. At the same time, it is a valuable tool for managing risks and uncertainties concerning technological development (Jirotka et al., 2017).

The RRI’s foundations are the notions of reflexibility, anticipation, inclusion, and responsiveness (Burget et al., 2017; Stilgoe et al., 2013). Some authors include the dimensions of care and sustainability as complementary concepts to RRI (Burget et al., 2017). Reflexibility aims to inculcate a culture of self-reflection, awareness and moral responsibility in researchers and innovators (Stilgoe et al., 2013). RRI seeks to respond to the idea that innovation is creating the future. For this reason, within the RRI process, there is an exercise of imaging possible futures and anticipating the risks and benefits of a given invention. By implementing an inclusive process, RRI fosters a collective debate and promotes the engagement of a larger public in finding innovative and technical solutions (Stilgoe et al., 2013). Responsiveness is linked to the transparency and accessibility of the innovation process (Burget et al., 2017). It conveys the idea that the innovation process should be open-ended and adjust the innovation accordingly to the inputs of stakeholders (Stilgoe et al., 2013). The emerging dimensions of RRI refer to the resource-efficiency of innovations (sustainability) and the idea that the decisions about our future should be collectively constructed, making citizens equally responsible for them (Burget et al., 2017). The RRI framework does not aim to build a utopian world where the risks of innovation are all foreseen, and only harmless innovation is allowed to be developed. Instead, the RRI is anchored in concrete practices and inclusive dialogue that seeks to foresee and democratically evaluate all the possible risks of a new technology (Burget et al., 2017). Authors have argued that this practice is valuable as a compliance exercise and that it adds value to innovation, improving acceptability and increasing public trust in technology (Ribeiro, Smith, & Millar, 2017).

The RRI approach has faced criticism (Owen & Pansera, 2019). The most important criticism relates to the challenge of transforming RRI from discourse into practice (Ribeiro et al., 2017). More substantially, some critics accuse RRI of slowing innovation and unduly interfering in the autonomy of science. Critics have also warned about the limits of predicting the impact of innovation due to the impossibility of foreseeing all potential uses of a given technology (Owen et al., 2021). However, RRI is an evolving concept and policy, and it has demonstrated real potential for fostering reflection and responsiveness to research and innovation (Ribeiro et al., 2017). Indeed, the RRI has become a horizontal theme in the work of the EC, which has driven the development of the RRI framework by integrating it into its research programs, encouraging its integration into the academic curricula and promoting training and public forums for discussions on the topic (Owen & Pansera, 2019). Moreover, the EC has developed tools to help governments and businesses implement the approach (https://rri-tools.eu/). In what concerns the actions of governments, the EC recommends that the RRI approach should be deployed in the design of policies covering research and innovation.11 It also recommends incorporating RRI into the structure of research funding, proposing that governments condition the allocation of funds on projects that embrace RRI.22 All in all, RRI could be a valuable framework for complementing the data governance propositions designed by the DGA. To better understand how this could work, the following section presents an in-depth analysis of the DGA policy context with a focus on the governance of PSD.

2.4The EU’s alternative approach to data

To address the challenges of data concentration and restrained innovation, the EU has adopted a data strategy and developed its regulatory framework to provide the legal conditions for harnessing the potential of data. The DGA is one of the fundamental pieces of this new regulatory framework. This section presents the policy context and then outlines the main features of the DGA, emphasizing the novelties in PSD governance and highlighting national implementation issues. It is built on an in-depth analysis of European Commission preparatory documents, including the consultation process. The selection of these preparatory documents traces back to the policy context of the DGA and considers the relevant documents that help in understanding the policy’s rationale and goals. Figure 3 illustrates the DGA’s policy path with the most relevant policy documents to its adoption. The analysis followed an inductive strategy that highlights the constitutive function of discourse (Howarth & Griggs, 2015; Yanow, 2015). The legal analysis of the DGA final text used a classic legal hermeneutic analysis that considers the policy context in which the legal act was adopted, following a law-in-context approach (Selznick, 2003).

Figure 3.

European data governance policy chain.

2.5Public sector data in the data governance act

The DGA was adopted by the European Council and the European Parliament in March 2022. It is built on four pillars: (i) a regime for the reuse of certain categories of protected data held by public sector bodies (subject to rights of others); (ii) a certification framework for data intermediaries (conceived as a neutral agent that provides data sharing services by connecting data holders to data re-users); (iii) measures facilitating data altruism; (iv) the institution of an expert group, the European Data Innovation Board, to facilitate and coordinate European Member States’ (EMS) efforts to support data-driven innovation, to lower transaction costs and to prevent sectoral fragmentation.

Concerning the governance of PSD, the DGA aims to complement the Open Data Directive (European Union, 2019) by establishing a data-sharing regime for PSD that is not yet covered by 2019’s Directive.

The DGA creates a mechanism for reusing specific categories of protected PSD. These kinds of data held by the public sector are subject to others’ rights, such as personal data protection, intellectual property rights and commercial confidentiality. Because of the incidence of other kinds of rights, these data sets are excluded from open data regimes. In European policy, this particular category of PSD is also referred to as ’sensitive data’ (European Commission et al., 2022). Based on the assumption that these data hold important economic and social potential, the idea is to make them accessible, despite the additional work this entails for public sector bodies.

Figure 4.

PSD in the openness spectrum.

The DGA establishes harmonized rules under which the EMS may allow and enable the reuse of public sector sensitive data. These rules set out some substantial principles. First, EMS are required to be transparent concerning the conditions under which the reuse could be granted (Article 5(1)). The DGA also prohibits – with exceptions – exclusive agreements and restrictions of access for third parties (Article 4). Moreover, the sharing conditions should be non-discriminatory, transparent, proportionate and objectively justified (Article 5 (2)). EMS should designate competent bodies to assist public sector bodies in the activities of granting access to data (Article 7 (1)). Such institutional infrastructure should be provided with the legal, financial and human resources necessary to undergo these tasks (Article 7 (3)). EMS have to put in place a single information point that will offer easy information (providing searchable asset lists and available data sources) (Article 8(1)). This single information point will receive and transmit data reuse requests to the competent bodies (Article 8(2)). The DGA also contains provisions concerning remote access to data and data processing in secured environments (secured physical locations or remote access) (Article 5(3 (b and c))). In these specific cases (processing in secured environments), the public sector body should reserve the right to exercise control through the assessment of processes, means and results of data processing to restrict any kind of use that results in prejudice to the rights and interests of third parties (Article 5(4)). There are also specific restrictions concerning the transmission of data to third countries (Article 5(9 and 10). Finally, the DGA allows public sector bodies to charge for allowing the reuse of data. The fees shall nevertheless be transparent, non-discriminatory, proportionate, objectively justified and shall not restrict competition (Article 6(1 and 2)). Such fees should be derived from the costs involved in the procedure to enable access and reuse (such as costs with reproduction, anonymisation, and maintenance of the secure processing environment, among others) (Article 6(5)). Special fee conditions should be provided for scientific research purposes, small and medium enterprises and start-ups, civil society and educational establishments (Article 6(4)).

However, it is important to note that governments have no obligation to provide data. EMS should “be able to decide whether data is made accessible for reuse, also in terms of the purposes and scope of such access.” (Recital 11). Within the DGA, the EMS should establish the specific conditions under which PSD is shared. At the same time, the conditions “should be limited to what is necessary to preserve the rights and interests of third parties in the data and the integrity of the information technology and communication systems of the public sector bodies” (Recital 15).

Overall, the DGA gives the EMS some leeway to implement a public policy covering the sharing of public sector sensitive data that is aligned with the general policy goal of implementing a model of data governance that is truly an alternative to platform models and that prioritizes the common good.