IGF 2022 Open Forum #38 Data as new gold: how to avoid ‘gold rush’ and create value for all

Governance Forum’ brought together six leading EU and Africa’s experts representing private sector, academia/think tank, civil society and public sector/government.

The speakers of the session - Marek Havrda, PhD (Deputy Minister for European Affairs, CZ Presidency), Bridget Andere (Access Now, Africa Policy Analyst), Alberto Di Felice (Director for Infrastructure, Privacy and Security, DIGITALEUROPE), Maria Rosaria Coduti (DG CNECT, Policy Officer for Data Policy and Innovation), Chloe Teevan (Head of Digital Economy and Governance ECDPM), Johannes Wander (Policy advisor on digital development & innovation at GIZ to AUC) shared  their views on the forum topic.

Human centric approach – role of the governments and how to strike the right balance between making available more data for reuse and guaranteeing  privacy and data protection

Dr. Marek HAVRDA informed that CZ presidency presented a Joint policy statement - Human-centric approach at the core of the standardisation and connectivity, at ITU Plenipotentiary Conference (Sept. 2022) on behalf of EU27, signed by 57 countries. He states that in a modern world we are dealing with trade-offs, privacy is one of the criteria, understanding and being aware of the use of technology, respect for the individual autonomy are other important criteria. And finally there is the overall impact on human well-being at large. There are much larger risks and we need better checks and balances, combining different types of data, especially criteria of privacy. On digital divide: having a human centric approach should also help to bridge digital divide. We need to know what data is out there and how it is used in the communities.

Mrs. Maria-Rosaria CODUTI expressed opinion that data protection and access sharing & use should not be treated as contradicting elements, these are two elements of the same face. EC is putting in place data protection in legislation when drafting, and complement already existing legislation. You can't just protect data and impede the use of data. We create a trustful environment, a trustful ecosystem, data subjects, data users, etc. the basis of our data governance model is a human centric approach. We have put this into the legislation, into the Data Act for example. This empowers users, ie. of IoT objects, that by individuals, by interacting, by using IoT objects they produce valuable data and they need to have a say on the data. We need investing in technologies that includes privacy by default.

Digital transition and data economy – how ensure no one is left behind?

Alberto di FELICE noted that companies in Europe - big or small  - do not have monopolies in the market. These are all central points of the EC. And their data strategy has been centred around sovereignty and how data can protect the economy. In the EU we are in the middle of several proposals around data, such as AI act. And respect safety and fundamental rights, data sharing across sectors and players in the economy (Data Act), vertical proposals such as the EU health data space. It is a complex environment because there are lot of proposals and also lots of regulations in place (e.g.GDPR). ‘Gold is great but it's also heavy’, so we need to know the amount of regulation particularly if we have more of it, can also facilitate data sharing. We're also in the middle of a global crisis (pandemic, war in Europe). One aspect underlying data discussions is a connectivity. We're building partnerships worldwide, e.g. US: TTC strengthening joint initiatives built on the global gateway.

How to build a data governance model which benefit both the economy and the society? Regulation versus enforcement: margins for improvement.

Bridget ANDERE – expresses opinion, that  human being is central. We need always pick society if having to choose between society and the economy. Importing laws and infrastructure from other places without looking at consequences in own country are detrimental. So we need to build models that benefit society, what impact will it have on the end-user. Human rights diligence is very important. Look at the people whose data will be collected and who is at most risk, make sure they're protected and you don’t have to go back and fix it in retrospective. We need to engage in public participation in these processes. Regulation vs enforcement is not just a problem in Africa. We have lots of regulatory frameworks that are amazing and have policies and regulations that are supposed to go with them, these laws are often existing in vacuums. No absolute rights protection, opt-in/opt-out mechanisms, just use national security as a reason. Limitations on laws are very broadly formulated and not clear, creates lots of gaps. When it comes to operability we have principles but we find ourselves with really good laws but bad implementation. We need mechanisms that allow people to complain about infringement of their rights. 

Chloe TEEVAN argued that GDPR, one of most established European regulations, was based on multistakehokder consultation (incl civil society), but it is also not without its faults. It has become a model around the world but is not necessarily either adhered to in other contexts/countries. Ireland hosting many tech companies, this has an impact not only at EU data protection but also globally as other countries have to go through the Irish Data Commissioner. And if there are improvements it is because of civil society putting pressure. Data Commissioners across the EU have been discussing how to improve enforcement and also invited civil society to the table. Multistakeholderism is important element, and if enforcement improves it is because civil society constantly holds government accountable. Active CSO participation is really essential and also means adapting to the context you're in and bring the voices in. In certain contexts there aren’t even data commissioners in place to enforce such regulation or they don't have the resources and independence they need. Also questions whether big tech - even in EU- takes government seriously, they pushing limits in EU. Even more difficult for smaller African countries. These are just a few issues with enforcement, also when talking about GDPR as a gold standard.

Key challenges on regional level (focus on Africa)– how to act efficiently to closing digital gaps. Role of data to bridge digital divide, ensure strong data protection and inclusive economic growth - case study of EU-AU Data Flagship and the Digital Global Gateway.

Johannes WANDER presented a perspective is from the work with the African Union. Lots of countries in Africa are interested in more localisation which then tends to very much a locked-in approach and you can not leverage the benefits for the economy and society. AU developed Data Policy Framework and endorsed it this year, the EU is supporting this. AUC is in a leading role in formulating such policies at a continental level. EU should support this endeavour, also as part of the global gateway. But of course harmonisation is an issue, AU has double as many members as the EU, but we all know how many years it took for the EU to reach a consensus. Enforcement is also an issue. This is something we will work through the next three years, plan is to align existing stakeholders to bring this framework alive. We need to find solutions at national and community level. How do we ensure a just data governance? How can the African continent manage and use the data for itself, without localising more than 50 countries. Certainly the data is a new gold or oil, but the main question is how to make use of that.  Some countries have legislation in place and second step should be enforcement to ensure the economic growth.

Question/ Answers round.

·      

Tony Blair institute: how can we simplify protection evaluation to actually make data transfer possible across borders in case of GDPR?

Maria Rosario CODUTI answered the question by addressing international provisions of Data Governance Act, between EU and third countries. Provisions to ensure sensitive publicly held non personal data so it will not be subject to unlawful access. We have a regime abased on intervening acts for non-personal data that we think will create a bottleneck. We extend the provision in data governance act to cloud service providers and customers. These rules are similar to Schrems II. We don’t create data localisation but encourage data sharing.

Chloe TTEVAN mentioned South African example -  it took a certain amount of time to develop the Protection of Personal Information Act (POPIA) and by that time the EU has moved to GDPR and South Africa was not granted adequacy. So this is a really big question.

·      

Question (Government representative): knowing data is gold, how to manage our data if there is no standard framework internationally?

Bridget ANDERE. There is no one standard framework working for everyone. So how do we ensure adequate data protection? Take the person that is most at risk and then you have adequate data protection frameworks that will work more widely

Johannes WANDER added that in case of the AU data framework, its principles that can be interpreted at a national level and see what works for them

·      

Question: (representative of Ministry of Technology, Ethiopia): which values can be incorporated at national levels in African countries?

Johannes WANDER replied that in EU there is a law interpretation focused very much on the individual. In some countries in Africa the communal aspect tends to be more important or higher priority than the individual. For example, health data is very private and should not be at communal standard. But societies really vary across the continent.

Dr. Marek HAVRDA added that  there is a need for new methods to monitor enforcement. Especially on privacy rules that differ between countries.

Key takeaways from the forum:
-Enforcement of the data policy regulation should be adequately addressed and ensured. Enforcement is crucial, but common understanding and harmonised approach across the globe are important too.
-Civil society organisations play very important role to make sure human rights are defended.
-Multistakeholder engagement throughout the process is crucial.
-Human centric approach and human rights should be embedded in the legislation.
-A clear need for models that benefit society starting from the principle that the most vulnerable should be protected. If they are – the whole society (is protected) too.