Empowered Data Societies: A Human-Centric Approach to Data Relationships - WHITE PAPER SEPTEMBER 2021
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Empowered Data Societies: A Human-Centric Approach to Data Relationships WHITE PAPER SEPTEMBER 2021
Images: Getty Images
Contents
Foreword 3
Introduction 4
Executive summary 5
1 Understanding the trust gap in the data ecosystem 6
1.1 What is trust? 6
1.2 Building trust in data relationships 7
1.3 Policy implications 11
2 Empowering people 12
2.1 The journey towards data empowerment 12
2.2 Intersecting journeys 14
2.3 Putting it all together 17
2.4 Policy implications 19
3 Designing proactive services to be human-centric 20
3.1 The role of government in proactive services 20
3.2 Case studies 21
3.3 Considerations for proactive service provision 23
3.4 Policy implications 24
4 Data in Helsinki: an experiment 25
4.1 Building the blueprint for a human-centric approach to 25
data relationships
Conclusion 28
Annex A: Data classifications in Helsinki’s data strategy 29
Contributors 30
Endnotes 32
Disclaimer
This document is published by the
World Economic Forum as a contribution
to a project, insight area or interaction.
The findings, interpretations and
conclusions expressed herein are a result
of a collaborative process facilitated and
endorsed by the World Economic Forum
but whose results do not necessarily
represent the views of the World Economic
Forum, nor the entirety of its Members,
Partners or other stakeholders.
© 2021 World Economic Forum. All rights
reserved. No part of this publication may
be reproduced or transmitted in any form
or by any means, including photocopying
and recording, or by any information
storage and retrieval system.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 2
September 2021 Empowered Data Societies:
A Human-Centric Approach
to Data Relationships
Foreword
Sheila Warren
Deputy Head, Centre
for the Fourth Industrial Jan Vapaavuori
Revolution; Member of Urban Activist, former
the Executive Committee, Mayor of Helsinki
World Economic Forum
The world is awash with data; 25 quintillion bytes are Finland and the City of Helsinki have made a strong
generated every day. When data becomes insight, commitment to ensuring that the interests of their
it has the potential to drive unparalleled progress, citizens are not only reflected but respected and
transform business and society, and improve the prioritized in data policy. Helsinki enjoys a high level
state of the world. Fourth Industrial Revolution of citizen trust as evidenced by the enthusiastic
technologies demand data as the foundational uptake of city services and corresponding
resource for solving systemic challenges, from satisfaction levels. Voted the world’s second
pandemic response to climate change. smartest city in 2020,1 Helsinki has blazed a trail
in using data to improve the quality of life for its
Yet despite an abundance of both supply and citizens and has pioneered new frontiers in service
demand, the evolution from data to insight still delivery and accessibility.2 From privacy protection
presents many challenges. On the one hand, data to the development of innovative new solutions like
often remains siloed and unavailable to those pro-active services, Helsinki remains focused on its
who would use it to benefit people, societies, and citizens and how to make their data relationships as
the planet. On the other, the type of governance human-centric as possible.
needed to assure proper oversight, transparency,
and accountability by those using data is still being The big challenges in the world cannot be solved
understood. Many efforts have made data more by government, business or civil society alone.
available, but they are predominantly organization- Public-private cooperation is essential for shaping
centric – focused on the company, government or our future. This report is the product of a year-
entity responsible for the data’s capture, while the long effort by the World Economic Forum and the
interests of those generating data or most impacted Government of Finland to develop a human-centric
by the resulting insights may go overlooked. approach to data and to deploy aspects of this
framework within Helsinki.
As the data universe expands, it becomes
exponentially more complex, requiring systemic With the release of this paper, we embark on the
solutions that integrate political, economic, next phase of a shared vision to create societies
social, environmental, technological, and, most empowered by data. We invite you to join us as
importantly, human aspects. This paper seeks not we chart a course towards a world where data is
simply to make data open and available but to used in responsible and innovative ways to create
do so in a way that focuses on the values, needs progress while serving people and the planet.
and expectations of individuals, communities and
societies, proposing a human-centric approach.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 3
Introduction
What does it mean to live in, or to create, an minimize undesirable behaviour through regulation?
empowered data society? Data powers Fourth Instead, what if policy solutions began with the
Industrial Revolution technologies, but any human beings who generate and are affected
agreement around who should use it, for what by data? What if the goal were to empower
purpose, and how its benefits are to be shared people to benefit from the data about themselves
remains elusive. Data is unlike an industrial product, and to set the agenda for how they want it –
which is consumed with use, or intellectual and themselves – treated in today’s “datafied”
property, which loses its value once shared. Rather, societies? Here, “either/or” can become “and”.
the value of data often increases with availability
and repeated analysis. Individual contributions Empowered data societies are ones where the use
may have little value while their aggregate can of data is governed in a human-centric way, i.e. in
be priceless. A single data point alone can either a way that centres around the values, needs, and
be meaningless or the key for detecting a critical expectations of people, groups, and communities.
anomaly, and it is often impossible to know When this human-centric approach to data is the
which is true at the moment it is first collected. norm, people are understood as being aware and
active agents in the data ecosystem that is society,
Policy solutions that attempt to govern data use where they form data relationships entailing risk,
generally assume that they must choose between vulnerability, and trust. Human-centricity entails
two routes: either capitalizing on the promise treating data collection, analysis, and interpretation
of innovation or protecting fundamental rights, as sources of opportunities – insights that can
such as privacy. This apparent choice is rooted become meaningful actions with positive outcomes
in a paradigm that starts with the organization. for society while maintaining the utmost respect for
How to improve company performance? How to the people who are part of it.
BOX 1 On the importance of human-centricity and data
Key elements for adopting a human-centric 3. Ecosystems approach: interoperability
approach to data governance, as taken from on multiple levels of technology, policy and
On the Importance of Human-centricity and Data, valuation models
a policy primer released for the launch of the
Empowered Data Societies collaboration: 4. Pluralism: cross-cultural and global
1. Human as the logical point of integration: applicability as well as multiple autonomous,
accountability to individual people as interoperable frameworks
stakeholders in the use of the data they are
involved in generating 5. Proportionality and equity: appropriate levels
of responsibility and freedom on the one hand,
2. Empowerment with data: a shift from data
protection to a more holistic view of people as and risks and opportunities on the other
active beings with the will and the capacity to
improve their lives with data Source: World Economic Forum 20213
BOX 2 Data society: Helsinki
The city of Helsinki, Finland, stands out among message. No more forms to fill out, as the city
many others for the high level of trust that citizens will take the initiative to contact the families. The
show through their active engagement with city service sends the notifications via SMS and will later
services. Helsinki’s use of data to create and expand to a handy mobile application as well.”5
improve services, particularly those related to
inclusion and accessibility, won it the title of the Such services make it easier for families to
world’s second smartest city in 2020.4 enrol their children in educational facilities while
also removing a considerable amount of the
One recent Helsinki pilot, now in production city- bureaucratic burden from service providers and
wide, developed a service via which “Helsinki offers service requestors. Pilot schemes allow for a
parents of children who will be starting pre-primary greater understanding of how both technical and
education a spot at an early childhood education social aspects of a new service will function before
facility that they can accept with a simple text moving on to larger-scale implementation.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 4
Executive summary
This white paper is intended to provide different Section 3 applies the discussion of trusted
insights for governments, businesses, academics, relationships and targeted interventions to the
and civil society actors. For public sector innovative practice of proactive services: where
employees and elected officials – from mayors service delivery is automatically triggered with the
and ministers to data scientists and service help of data and without the need for a manual
developers – it offers ideas, insights, suggestions, request. This section provides case studies and
and recommendations for the further development offers preliminary guidance on factors to be taken
and practical deployment of human-centric data into account when considering such implementation.
policy. It also offers valuable considerations for
business, research, and civil society organizations Section 4 concludes by sharing Helsinki’s
that work closely with the public sector. The paper practical experience in building out a human-
is separated into four main sections, each of which centric “blueprint” for experimenting with the
builds on the previous concepts. implementation of previously discussed concepts.
Section 1 begins with a high-level examination of Together, these four sections trace a path from the
the trust relationships that are formed in connection theoretical to the practical aspects of integrating
with data. It then explores why the health of such human-centricity into the work of public sector
relationships is a critical prerequisite to flourishing organizations. As a whole, the paper shows that
human-centric data ecosystems and suggests how human-centricity is not a “nice-to-have” or “deluxe”
they can be created and nurtured. approach to data; rather, it is the foundation for
building any empowered data society. The paper
Section 2 continues the journey by proposing shares frameworks, insights, and best practices
a series of novel methodologies for better so policy-makers around the world can adapt and
understanding the flow of data and identifying key build systems that use data in responsible and
junctures where opportunities arise for human- innovative ways to create healthy ecosystems that
centric intervention aimed at empowering people. are centred around people right from the start.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 5
1 Understanding the trust
gap in the data ecosystem
Expectations that data subjects and data
collectors have of one another determine
the level of engagement.
Trust is important in any relationship, and data complexity and practicality require a degree of trust
relationships, where data is generated and on both sides for interactions to run smoothly.
captured, are no different. The expectations
that data subjects and data collectors have of This section applies the psychological concepts of
one another, and whether these are respected, trust and trustworthiness to data relationships and
determine the level of engagement and therefore examines how trust can enhance data availability
the amount of data available. Although technical for innovation, as well as best practices that
and regulatory solutions can set a baseline that allow trust to form.
reduces the need to rely on trust entirely, overall
1.1 What is trust?
Trust is “the willingness of a party to be vulnerable to the
actions of another party based on the expectation that the other
[party] will perform a particular action important to the trustor,
irrespective of the ability to monitor or control that other party.”6
On an individual level, trust allows intimacy. To establish trust, parties must establish common
On a societal level, trust enhances social ground. As parties interact, they build knowledge
capital, facilitates cooperation, and fosters an about one another and must believe that any trust
atmosphere that takes into consideration the is reciprocal.12 Trust also requires solidarity, or the
needs of others. The level of trust in a relationship commonality of goals; we trust those who appear to
or an environment affects whether individuals share our objectives and move towards them.
deploy their resources (cognitive, physical,
emotional, or economic) in the service of self- The most intimate area of trust is related to “face
protection or towards greater ends,7 from a work”: ways in which people control how they present
willingness to get involved in their communities themselves to the world through language, social
to driving higher rates of economic growth.8 behaviours, and actions.13 Trust is built when people
are allowed to “maintain face”, meaning they can
A distinction can be made between moral choose what to make public and keep private. “Face
trust, which is a durable, optimistic view that threat” occurs when, intentionally or unintentionally,
others have good intentions, and strategic trust, this control is compromised. Given its importance,
which is specific to short-term exchanges. exposure of data that creates “face threat” can be
Trustworthiness is based on past and present one of the worst violations of vulnerability and trust.
performance, claims (whether they are aligned
with one another and with future promises), and Trust is demonstrated by taking the risk of making
the overall consistency of behaviour.9 Expectations oneself vulnerable to people, organizations, or
play a critical role in building trust, as they drive circumstances that one cannot control. Actors who
the calculations of risk involved and the level of have access to sensitive data, then, are high-risk
vulnerability at stake for each party. Paradoxically, partners in the dance of trust. If they allow the
even when expectations are negative, adherence sense of control to be maintained, trust will improve.
to them may be judged as more important If, intentionally or not, they tamper with that control
than benevolence,10 while circumstances of or create “face threat”, the loss of trust will be more
risk create greater opportunities for trust.11 devastating than any comparable breach.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 6Because of the importance of trust, a human- empowerment – a sense of control and agency –
centric approach to data relationships emphasizes is critical for data relationships to grow and serve all
the need for people and communities to be parties, be they individuals, groups or communities,
empowered agents regarding their data. This or organizations.
TA B L E 1 Building blocks of trust
Trust grows strongest:
When behavioural
E.g. Users of free online services who understand ad-supported business
consistency meets
models may not feel betrayed when data associated with their use is sold.
expectations.
E.g. When investing a lot of money in something with no track record,
In environments
getting a high return creates greater trust than investing only a little, or
of high risk.
investing in a sure bet.
In solidarity and
E.g. Organizations regularly remind their constituents of shared goals and
commonality
their alignment with stakeholder interests.
of purpose.
When allowing
E.g. Online advertising that unexpectedly reveals sensitive information based
parties to
on previously searched terms can create a very deep breach of trust.
“maintain face”.
1.2 Building trust in data relationships
Building trust for better data availability
By taking a human-centric approach to the data statements.16 Such short-term strategic trust is
relationships created between data rights holders, often misplaced, as the person trusting (the data
controllers and processors, these relationships subject) assumes that the data handling entity (the
can be made more trustworthy, enabling fruitful data collector) will, in the case of wrongdoing or
collaboration on all sides. harm, be held accountable. In reality, this is highly
dependent on the local legislation, enforcement
Generally, when data is made available or shared mechanisms, and the ability to bring claims.
within an ecosystem, its potential to generate
valuable insights is multiplied. Data is not a The complexity of data ecosystems and ecosystems
commodity in the sense that it is “consumed” and and their constituent relationships makes it
eliminated by use; it can be used concurrently, impractical to manually monitor every aspect.
repeatedly, and in multiplicity. Many datasets can Attempting to do so imposes prohibitively high
be described as “anti-rival”,14 meaning they are “administrative” costs on both sides: decision-making
cheaper to share than transfer (the latter involves for the data subject and compliance for the data
the additional step of erasing the original), the cost collector. Few relationships (non-personal data or
of copying is negligible, and an increased number of where disclosure is required by law being exceptions)
Data is not a users increases their value.15 follow a set path, so more durable, “moral” trust
is required. Such trust can be fostered through
commodity in
However, the benefits of data collection and analysis increased transparency by sharing value statements,
the sense where
are often not equally distributed, and people are expected results, or having accountability measures
it is “consumed” becoming increasingly aware of how valuable in place at the time of collection. Availability of self-
and eliminated their data can be for organizations, as well as the administered controls and general awareness of
by use; it can be associated risks to privacy and loss of control. relevant policies can also help. However, abundant
used concurrently, Still, convenience tends to outweigh caution, information has diminishing returns, as “information
repeatedly, and in with “trust” granted in exchange for immediate overload” sets in, and trust is again granted out of
multiplicity. access, like accepting unread “notice and consent” convenience instead of deliberate decision-making.17
Empowered Data Societies: A Human-Centric Approach to Data Relationships 7[People] can’t be expected to read the lengthy terms and
conditions or evaluate all the risks every time [they] use a [data]
service. That’s like asking each of us to assess whether the
water we drink is safe every time we take a sip.18
Appropriate legal mechanisms can reduce the All legislation in this domain affects trust within data
need to evaluate each data relationship separately, relationships, especially by enforcing transparency
building the foundation for trusted interactions by and accountability. Frameworks that reflect both
setting (and abiding by) expectations. In Europe, this regional priorities and cultural expectations around
has taken the form of the General Data Protection trust can enable more data to become available by
Regulation (GDPR), which other regions have used as correctly balancing the need to promote innovation
a blueprint, including Brazil’s General Personal Data with considerations for individual vulnerability,
Protection Law (LGDP), California’s Consumer Privacy and triangulation between individual, public, and
Act (CCPA), and several African nations’ legislative private interests. Approaches that favour any one
initiatives. Alternatives, such as the Asia-Pacific side of this equation too heavily will lack legitimacy
Economic Cooperation (APEC) Privacy Framework and may reduce trust, as discussed in the World
have embraced more market-focused legislation (as Economic Forum’s Authorized Public Purpose
opposed to the rights-based approach of the GDPR) Access case study from Japan.21
on the commercial benefits of data,19 and some areas
have yet to adopt a comprehensive framework.20
FIGURE 1 Balancing multistakeholder interests to build trust
(a) Individual bias
Individual rights
(b) Data-holder bias
inadequate
(c) Public interest bias adequate
excessive
Interests of Public
data holders interest
Source: APPA (Authorized Public Purpose Access) report, 2019.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 8Building trust through data minimization
More sharing is not the end goal, rather it is necessary to
strengthen controls or limitations on sharing in order to build trust.
Lisa LeVasseur, Me2B Alliance
An alternative perspective to the focus on disproportional to the value received. For
regulation is that building trust is better achieved example, when subscribing to a newsletter, a
by practices that limit overall data collection. request for gender and date of birth are valuable
This can promote commonality of purpose by to the data collector and may help tailor services
tempering current business models that rely on but can pose disproportionately high risks to
the data collection imperative,22 which leaves the data subject if this information is breached
internet users unwittingly adrift in an invisible or used for irresponsible analysis (for example,
“parallel dataverse”,23 and resigned to the gender data used in biased algorithms).27
fact that their online lives are not private.24
Therefore, beyond legal regulations that set
The relationship between an individual and a fundamental requirements and expectations, trust
connected product or service can be seen as can be further reinforced through judicious data
a two-way dialogue where trust is unfortunately minimization. Although “more is better” may be true
already at a deficit25 and trending downward.26 for the collecting entity, a human-centric approach
Several dynamics and industry norms exacerbate requires acknowledgement that this may not
this, including: always serve the best interests of the human data
subject. One method to achieve such judicious data
– Unknown third-party participation – internet minimization is by moving away from a default of
users have a limited understanding of the “data entitlement” by treating identifiable, sensitive
constellation of third party “strangers” who data as a “highly toxic asset”,28 and the data
collect their data. relationships forged while creating user accounts
that store such data as a “forced marriage”. These
– Information-to-value quid pro quo – the amount should be treated with the utmost caution and
and type of data requested is unilaterally undertaken only when absolutely necessary, always
decided by the collecting organization and favouring practices that promote aggregation and
can expose the data subject to risks that are anonymization instead.
BOX 3 The role of civil society
Trusted civil society organizations can provide 2. Validate shared data. This can be particularly
a key link to a diverse range of stakeholders, helpful when there may not be a high level of
including those who may not be traditionally trust between the government and certain
represented by government or business. community groups. Engaging civil society to
Engaging these community members in the data interrogate the data and ask “Is this correct?
infrastructure of local and regional governments Does it reflect all parts of the community?”,
is key to creating equitable access and a shared can be a key trust-building activity.
basis for civic engagement. Civil society has an
opportunity to engage in three key areas: 3. Enhance shared data. Civil society holds
unique knowledge about the unmet needs
1. Provide a link to published data. Civil society of community members as well as the lived
organizations can support local community experience of their constituents. They can be
members in understanding, accessing, and enabled and supported to organize and share
interrogating published data. This activity can their data to provide a more complete picture
happen in community anchor institutions such of communities.
as libraries, and local civil society organizations
can provide relevance for their specific Combined, these key areas can build trust,
constituency. In this role, organizations can increase a sense of common purpose,
focus on working with community members to and ensure that all community members
develop and share insights and opportunities see themselves represented in the data
based on the shared data. which supports civic engagement.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 9Building new data relationships with trust
Human- Any considerations for implementing a human- digitally mature settings. Furthermore, in developing
centric, robust centric approach to data relationships depends, countries with low-quality and low-intensity data
data governance in large part, on overall digital maturity. As the infrastructure, gaps in government statistics and
frameworks must World Bank’s 2021 World Development Report public registries make data generated by the private
on data for better policies notes, “lower-income sector increasingly important, for example, that of
be the tangible
countries are too often disadvantaged, lacking … telecom operators, considering the high penetration
expression of the infrastructure and skills to capture data and of mobile phones. For the World Bank, this involves
a country’s turn [it] into value; the institutional and regulatory “creating trust in the integrity of the data system,
social contract frameworks to create trust in data systems; and the while ensuring that the benefits of data are equally
around data. scale and agency to participate equitably in global shared. Such a framework must be the tangible
data markets and their governance”.29 expression of a country’s social contract around
data”.30 In order to be human-centric, robust data
A human-centric focus, however, is even more governance frameworks must first include data
necessary in such contexts to ensure that data is infrastructure policies; rules and regulations on the
inclusive and representative, that it reflects local responsible use of data by government agencies;
realities (across and within countries) and has economic policies to foster and regulate the new
a sufficient degree of granularity to capture any data economy; and data governance institutions to
extremes, which may be more pronounced in less oversee and enforce the application of data policies.
FIGURE 2 Value, trust, and equity
Value
The full value of data
materializes: when
systems enable the use
and reuse of data for
different purposes
The social
contract
Trust Equity
A trust environment is All share equitably in the
created: when rights benefits of data: when
and interests all investments and
stakeholders have in regulations create a
data is safeguarded level playing field
Source: World Bank, World
Development Report 2021:
Data for Better Lives, 202131
Empowered Data Societies: A Human-Centric Approach to Data Relationships 10BOX 4 Inclusion is necessary for trust to be possible
Making everyone count in the data-driven digital often lack any legally recognized identity, not to
age is especially critical for developing countries mention a digital identity. Those unbanked in the
and emerging economies. Globally, just over half of formal sector also run the risk of being missed or
households (55%) have an internet connection.32 under-represented in data generated by the private
In the developed world, 87% are connected, sector. This is the case, for example, for urban
compared with 47% in developing nations, and dwellers in large city slums. Those who are not
just 19% in the least developed countries. In adequately reflected run the risk of being further
sub-Saharan Africa, one gigabit of data – enough marginalized as public policy choices increasingly
to stream a standard definition film for one hour –
make use of artificial intelligence and automated
costs nearly 40% of the average monthly wage.
tools which rely on data.
Digital divides lead to digital exclusion, especially
Data is often employed to make cities more
for vulnerable groups not generating a sufficient
efficient, or less corrupt, but whether they become
data footprint to be reflected in data-driven
policies. Welfare programmes and emergency more inclusive is still an open question. While
transfers during the pandemic have shown how compelling cases that demonstrate the success of
critical inclusive and representative data is to data-driven interventions for increasing inclusion
targeting social assistance programmes in times and equity are still forthcoming, this remains a goal
of emergency. This is especially true of countries of paramount importance. One critical condition for
with a high degree of economic informality, and increasing inclusivity in the context of data use by
for migrant and internally displaced populations, the public sector is, therefore, the establishment of
especially in conflict zones. Vulnerable populations robust accountability mechanisms.33,34
1.3 Policy implications
Building trust in data relationships can be supported Further, given the complexity of the data
through policy in the following ways: legislation landscape, it is vital to provide
greater guidance such as toolkits, standard
– To build trust and promote engagement, agreements, and rulebooks to simplify data
governments must create human-centric sharing processes and share best practices.
foundations through legislation that This will increase the confidence of all actors in
is consistent and upholds reasonable the data ecosystem. The passage of legislation
expectations. Data rights holders should have must be supported by a comprehensive
the opportunity to review details regarding the multistakeholder feedback process to assure
purpose of data collection and intended uses that implementation effects on various groups
from the collecting entity. In addition, redress are considered, especially those with a smaller
and appeals mechanisms should be accessible or more fragmented data footprint, such as
to allow for the correction and control of any SMEs or underrepresented minorities.
undesired or unintended data exposure,
and there should be clear transparency and – Where the digital divide is substantial,
auditability controls regarding the relevant laws governance arrangements that ensure
governing data collection. data is inclusive, representative, reflects
local realities, and has a sufficient degree
– Regulatory sandboxes can provide of granularity to capture inequalities and
environments where existing and new legal exclusions are required. Building trust in data
mechanisms can be tested to determine is often better achieved at the local level of
the appropriate amount of regulatory municipalities, especially in cities, and robust
oversight required prior to scaling up. accountability mechanisms are essential.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 112 Empowering people
A human-centric approach requires
a holistic understanding of the data
journey from multiple perspectives.
In addition to fostering trust within the data data collector. It also explores additional elements,
ecosystem, a human-centric approach requires including regulatory requirements and technical
a holistic understanding of the data journey from restrictions. By observing how these intersect and
multiple perspectives. This section introduces and affect one another, we can identify critical junctures
combines three methods of representing data (“tussle points”) where targeted policy interventions
flows, as experienced by the data subject and the can empower users and have the most impact.
2.1 The journey towards data empowerment
History shows that incredible progress is made As this multidimensional system takes shape, we
when society masters the ability to control, manage utilize the concept of “tussle zones” to identify
and govern flow. Whether it is the flow of water, points of tension or conflict which can only
oil, electricity, blood, aircraft or shipping, trust is be discerned when the system is considered
granted to the everyday management of these holistically. The human-centric approach is
flows because the techniques and standards for premised on the imperative to empower people
governing them have evolved over time. with data, therefore we focus on tussle zones as
opportunities where trust mechanisms can be
Data ecosystems are inherently complex and reinforced.
dynamic. They are shaped by discrete and diverse
forces – people, policies, and perspectives – that Understanding these critical moments enables us
are interdependent, constantly in motion and often to design policy levers that promote agency of,
unpredictable. A systems thinking approach allows and engagement from, the person, empowering
us to map these forces and identify “tussle zones”, Aino to improve her life because of data availability
or places where there is pent-up energy for change and processing. As opposed to an organization-
in the system. centric approach, which is focused on optimizing
processes, the human-centric approach prioritizes
In this section, we begin by using a variety of Aino’s interests, whether by actively giving her
mapping methodologies to make sense of a ways to express preferences or, more passively, by
particular system and explore how a specific creating an environment in which she feels that her
person, Aino, engages with a government counterparts are trustworthy.
unemployment service. While all these different
mappings (customer journey, data flow, legal Aino’s experience starts with the “front stage
and policy landscape) bring insights that are journey” as she engages with a public sector
independent of each other, they are more than the service and the concurrent “backstage journey”
sum of their parts when considered together. of the data generated by and about her in the
course of the engagement and service provision.
While different By layering elements of human-centred design, such From there, relevant legislation and public and
as persona canvases,35 journey mapping,36 data flow private policies are overlaid on these journeys.
mappings
mapping (as described in the OBASHI methodology,37 Their progress and intersections offer a holistic
bring insights which covers ownership, business processes, view of the forces at play in the ecosystem.
individually, they applications, systems, hardware and infrastructure), The clarity gained from ecosystem mapping
are more than the and the identification of relevant legal and policy is used to identify the tussle zones, where
sum of their parts overlays (such as GDPR or the terms and conditions strategic action can enable empowerment.
when considered of a service provider), we can identify opportunities for These opportunities can translate into new
together. data-collecting entities to empower data providers. policies, thereby scaling their possible impact.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 12Meet Aino literate and has relative proficiency in interacting
with services that collect user data. Her challenges
Throughout this section, a character named
Aino will illustrate the journey towards data and opportunities reflect those of citizens who have
empowerment. Aino is by no means universal, the means and capabilities to use digital technology
however, personas created using a canvas to request city services, utilize them in digital form,
as outlined in Figure 3 can provide a general and provide feedback. Although true in Aino’s home
representation of the average person to help ground of Helsinki, this cannot be assumed for all settings
ideas and showcase the practical consequences and special consideration must be made where
of proposed policies. In this case, Aino is digitally human-centricity in digital inclusion is the first step.
FIGURE 3 Persona canvas
PERSONA CANVAS
Age: LIKES THINKS FEELS LOW HIGH
Internet
Education: usage
Profession: Mobile
AINO device
Place of work: skills
Location: DREAMS & WISHES WELLBEING SOCIALISES
Affinity to
new tech
Family:
Privacy
Pets:
literacy
EMPLOYMENT A B C D
SERVICES
Step name: Step name: Step name: Step name:
Description
Time frame
Fears and pain points
Wishes and dreams
Source: MyData Global, Canvas based on MyData Design personas canvas, 2020. Design: Kirmo Kivelä.
BOX 5 Categories of data
Data categorization requires different criteria more pressing when the organization has ambitions
in different contexts. While no single way of beyond the merely adequate performance of
categorizing is absolute, one common starting mandatory duties and seeks to improve the
point is based on who controls, processes, provision of proactive and personalized services.
or holds rights over data. This can be a useful
categorization schema because stakeholders – From here, the public sector typically goes one
the “who” – have different rules to play by, and level deeper on data categorization, deploying
different challenges when it comes to data use. both content-based classifications – for example,
whether the data is personal or not – and usage-
Consider the public sector as a stakeholder type based classifications – for example, whether the
in this categorization. It operates with a mandate data is processed in a procured cloud environment
to serve society and the common good and is or a self-produced physical environment.
therefore held to a high standard for creating and
maintaining trust, acting openly and transparently, These additional categorization schemes help
and showing overall moral integrity regarding data the public sector determine who has the right to
and technology use. access the data and who ought to be included in
the policies and processes relevant to that data.
The public sector requires data to fulfil its basic
functions: providing statutory services, data-driven (For more detailed descriptions of both types of
Source: Original content decision-making, and optimizing public resources data classification, inspired by Helsinki’s data
inspired by the Helsinki and spending. This need for data becomes even strategy, please refer to Annex A.)
Data Strategy
Empowered Data Societies: A Human-Centric Approach to Data Relationships 132.2 Intersecting journeys
It is important to understand that the huge untapped
potential in data can only be successfully utilized if we
are able to create a system where individuals can feel in
charge of their data. This is the central question in making
sure we can use data in the future to solve society’s
biggest problems or create new economic value.
Jan Vapaavuori, Urban Activist, former Mayor of Helsinki
Front stage journey: Aino’s experience
Designing a human-centred approach starts with Mapping Aino’s experience as she engages with
a method called “user journey”, explored using a public sector services yields a few key insights.
simple visual map of an individual’s experiences First, Aino’s journey towards employment begins
as they engage with a product or service, from with her manually seeking assistance in response
beginning to end. This method helps to identify key to a need. Second, Aino must interact with three
moments of the customer experience which, in different government service programmes,
turn, become opportunities for design interrogation, providing each with varying levels of personal
differentiation, and innovation. information and, likely, redundancy.
FIGURE 4 Customer journey mapping
EXTERNAL EVENT
10 11
6 9 A plan for Aino is
5 Aino is Aino is Aino's directed to
Aino is contacted given subsequent a specialized
directed by the city information interactions service 14 15
1 to the city employment of the kinds with (education, Aino's Aino is
Aino employ- services and of services employment coaching, specialist invited to
becomes ment assigned a available services is rehabilitation, contacts a 3-month
unemployed services specialist to her drawn up healtcare) her interview
2 3 4 7 8 12 13 16
Aino Aino Aino Aino Aino Aino Aino requests Aino finds
searches discovers registers participates provides completes a meeting with employment
online for that she as a job- in an additional tasks her specialist
what to must seeker and onboarding information described through an
do register as a provides meeting on her in her online self-
job-seeker basic with her background employ‐ service portal
with the information specialist and ment plan
national about her situation
unemploy‐ situation
ment office
AINO’S EXPERIENCE
Source: Visualization based on group discussions and input from the City of Helsinki, 2021. Design: Kirmo Kivelä.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 14Backstage journey: data about Aino
The user journey reflects what is happening on technical systems used to support the flow of data
the surface, as the individual sees it. However, to required for Aino’s front-stage journey. Figure 5
develop a holistic understanding of the system, it is demonstrates aspects of Aino’s engagement
necessary to look “backstage”. with employment services.
By illuminating the forces behind the scenes Aino is, of course, just one of the millions of people
– stakeholders, processes, and tools – policy- who provide and consume vast amounts of data.
makers and service providers can identify real Each person has their own personal data flow and
points of leverage, where modest actions have the interacts with the digital world in many ways. Some
potential for significant impact. To understand the might be more liberal with data sharing, others
backstage journey of Aino’s data in parallel with more cautious. A major challenge for governments
her front-stage experience, we made use of the and data collectors is to help the people they serve
OBASHI methodology for mapping data flows.38 become, and feel, in control of their data flows.
With this methodology, we examined the socio-
FIGURE 5 Data flow mapping
OWNERSHIP
Aino National employment services Aino City employment services Aino
BUSINESS PROCESS
Receive Register with Process Develop Complete
Register as Process Provide direction to the city registration employment tasks in
a job-seeker Aino's directions register with employment plan employment
registration for Aino the city services plan
APPLICATION
National National
City employment City employment
employment employment
services website services website
services website services website
SYSTEM
iPadOS iPadOS iPadOS iPadOS
HARDWARE
iPad iPad iPad iPad
INFRASTRUCTURE
WiFi WiFi WiFi WiFi
Internet Internet Internet Internet
router router router router
Source: Figure based on Cloughley and Wallis, OBASHI methodology data flow mapping, 2011. Design: Kirmo Kivelä.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 15Legal and policy overlays
Several levels of legal mechanisms and policy issued by Finland’s Office of the Data Protection
instruments mediate the data relationships between Ombudsman.40 Some types of data are further
parties with different interests. These levels include: governed by Finland’s Act on the Secondary Use of
Social and Health Data.41
1. Binding laws and regulations, such as
regional and national legislation The second level, non-binding government and
corporate policies, can include best practices
2. Non-binding government and corporate such as those which corporate data collectors
policies, such as terms of service implement to assure data security, notice and
consent statements, or acceptance of cookies.
3. Non-mediated space To use her various digital devices and apps, Aino
has signed many terms and conditions and legal
Such interfaces can be superimposed onto persona requirements that are defined by such policies.
and data journeys to identify where
tussle points may occur. In each instance, the laws and regulations create
obligations and opportunities for entities to interact
The first of these levels, binding laws and with the data flowing between them and their
regulations, can include the EU GDPR, which networked interfaces. Whatever is left uncovered by
identifies the functions and responsibilities of data elements that fall into the first and second levels is
controllers and data processors. Within Finland, non-mediated space. This means there is no legal,
where Aino lives, related legal measures include the policy or governance instrument that acts as an
Finnish Data Protection Act (Data Protection Act interstitial mediator between forces in a system.
of Finland 2019)39 and regulations and decisions
FIGURE 6 Policy and regulatory landscape mapping
4 Non-mediated
space
Corporate City of Helsinki Helsinki City data
3 Non-binding government
and corporate policy overlay
terms and
conditions
internal data
protection policy
protection officer's
guidelines
Finnish Act on the Finnish Issuances of
2 Binding laws and regulations:
national legislation overlay
Secondary Use of
Social and Health
Data
Protection
Act (2018)
the national
data protection
ombudsman
Data (2019)
1 Binding laws and regulations:
EU regulation overlay
GDPR eIDAS
Source: This figure is an original landscape developed by the authors for the paper
Empowered Data Societies: A Human-Centric Approach to Data Relationships 16“Tussle points”
“Tussle” is a concept coined by David D. Clark paper, the second tussle space identified – that
and colleagues in a 2005 paper entitled “Tussle of trust – is particularly relevant. Regarding these
in cyberspace: defining tomorrow’s internet”.42 tussle spaces, Clark and colleagues suggest that
In the abstract of the paper, the authors write: “mechanisms that regulate interaction on the basis
“This paper explores one important reality of mutual trust should be a fundamental part of the
that surrounds the internet today: different internet of tomorrow.”
stakeholders that are part of the internet milieu
have interests that may be adverse to each other, The idea of “tussle” is adapted here to refer to the
and these parties each vie to favour their particular goal of understanding people holistically in order
interests. We call this process ‘the tussle’”.43 to empower them. In systems thinking, it is often
observed that where tension or conflict (or tussle)
Further, Clark and his colleagues posit that the exists, there is also energy and potential for motion
internet’s two primary tussle spaces involve and change.44 If and when systems designers and
economics – where actors pay others to allow the policy-makers can pinpoint where tussle occurs in
passing of data traffic – and trust – where providers their systems, they will simultaneously recognize a
trust each other in such traffic exchanges. In the source of potential for empowerment.
context of the work described in section 1 of this
Some examples of contention are very current. Music lovers
of a certain bent want to exchange recordings with each other,
but the rights holders want to stop them. People want to talk in
private, and the government wants to tap their conversations.
Conservative governments and corporations put their users
behind firewalls, and the users’ route and tunnel around them.
ISPs give their users a single IP address, and users attach a
network of computers using address translation. Some examples
are so obvious that they are almost overlooked. For the internet
to provide universal interconnection, ISPs must interconnect, but
ISPs are sometimes fierce competitors. It is not at all clear what
interests are being served, to whose advantage, to what degree,
when ISPs negotiate terms of connection.45
David C Clark, Tussle in cyberspace: defining tomorrow’s internet
2.3 Putting it all together
The complexity of requirements in play at any Historically, public-private data sharing has only
moment during the data’s journey can be difficult considered two key stakeholders: government
to comprehend, especially for Aino as she goes and business. However, more often than not,
about her life. To find opportunities that steer data the data being shared is generated by a distinct
utilisation in a human-centric direction, we must third stakeholder: the individual. The absence of
consider the tussle points where front-stage, consideration for this key stakeholder can create
backstage, and legal journeys intersect. distrust, fear, and lack of participation in the data
ecosystem, which is why it is critical to include their
In Figure 5, the front- and backstage journeys journey and identify their role in the tussle.
are superimposed with legal requirements which
provide clarity on what is experienced, enforced, Data relationships are continuous processes
or expected and illustrates potential tussle points. that occur in iterative, non-linear and multilateral
The legal requirements forming the legal and ways, so understanding an individual’s journey
policy overlay are shown by the numbers 1 to is just a small part of the overall picture. Different
11, and the persona journey points are indicated stakeholders’ interests may be in tension
with the numerals 1 to 16. Potential tussle throughout the system, but mappings allow for a
points emerge at the clusters of simultaneous graphic representation that is more manageable to
rights and obligations; non-mediated space is work with and a practical way to begin designing
present where these do not explicitly exist. human-centric interventions.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 17FIGURE 7 Tussle points
16
OWNERSHIP
1
( 11 13 14 15 )
Aino
OWNERSHIP
Aino
OWNERSHIP
National employment services11 Aino City employment services
11
Aino National employment services Aino City employment services Aino
BUSINESS PROCESS
10 1 10 1 Receive Register with 10 Process
9 1 9 1 10
Develop Complete
Register as Process Provide direction to the city registration employment tasks in
BUSINESS PROCESS
BUSINESS PROCESS
a job-seeker Aino's directions register with employment plan employment
Register as registration
Process forProvide
Aino the city
Receive services
Register with Process Develop plan
Complete
a job-seeker Aino's directions direction to the city registration employment tasks in
registration for Aino register with employment plan employment
2 3 4 the city services 6 plan
APPLICATION 5 7 8 9 10
12
National National
City employment City employment
employment employment
1 10
2 3website 2 services
3 9 1website
10 services website
services services website
APPLICATION
APPLICATION
National National City City
SYSTEM
employment employment employment employment
services services services services
website website website website
iPadOS iPadOS iPadOS iPadOS
4 1 10 4 1 10 4 1 10 4 9 1 10
HARDWARE
SYSTEM
SYSTEM
iPad
iPadOS iPad
iPadOS iPad
iPadOS iPad
iPadOS
5 5 5 5
INFRASTRUCTURE
HARDWARE
HARDWARE
WiFiiPad WiFi
iPad WiFi
iPad iPadWiFi
Internet Internet Internet Internet
router router router router
INFRASTRUCTURE
INFRASTRUCTURE
WiFi WiFi 6 WiFi WiFi
6 Internet Internet 6 Internet Internet 6
router router router router
7 8 7 8 7 8 7 8
1 GDPR Aino becomes unemployed 1
2
Aino searches online for what to do
2 eIDAS
3
Aino discovers that she must register as a job-seeker
3 Bank ID service T&Cs with the national unemployment office
4 Aino registers as a job-seeker and provides
4 App Store T&Cs basic information about her situation
5 Apple T&Cs 5 Aino is directed to the city employment services
6 Aino is contacted by the city employment services
6 Router manufacturer T&Cs and assigned a specialist
7 Internet service provider T&Cs 7 Aino participates in an onboarding meeting
with her specialist
8 Public WiFi T&Cs 8 Aino provides additional information on her background
and situation
9 City of Helsinki internal data protection policy
9 Aino is given information of the kinds of services available
10 Finnish Data Protection Act to her
10 A plan for Aino's subsequent interactions with
11 Finnish Act on the Secondary Use of Social and Health Data employment services is drawn up
11 Aino is directed to a specialized service
(education, coaching, rehabilitation, healtcare)
12 Aino completes tasks described in her employment plan
13 Aino requests a meeting with her specialist through
an online self-service portal
14 Aino's specialist contacts her
Note: Figure based on Obashi methodology data flow mapping (Cloughley and Wallis 2011).
15 Aino is invited to a 3-month interview
16 Aino finds employment
Source: Visualization based on group discussion and input from the City of Helsinki, 2021.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 182.4 Policy implications
Data empowerment can be incorporated into policy – Policy should be designed for tussle and
design in the following ways: variation in outcome. This enables outcomes
to be different in different places and allows
– Human-centric policy design should aim to the tussle to take place within the design,
modularize interventions along tussle points without distorting or violating it. Human-centric
and identify tussle boundaries so that one policy should assume there will be tensions
tussle does not spill over and distort unrelated in the system and proactively address these
Effective policy areas. For example, interventions targeted without trying to avoid them. Effective policy will
will consider values at removing redundant data entry should not consider values and culturally appropriate norms
create legal liabilities due to data requests that that balance the interests of individuals, and
and culturally
are not relevant to the service being provided. public and private interests (see Figure 1).
appropriate norms Policy drafted in this respect must therefore be
that balance challenged to be as specific as possible without – The principle of “tussle isolation” suggests
the interests being overly narrow. that intervention mechanisms should not be
of individuals, overloaded into one point but separated.
and public and Further, one should consider, within the broad
private interests. topic of trust, where there are separable issues.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 193 Designing proactive
services to be
human-centric
Factors to consider when
experimenting with this type of
innovative data relationship.
Providing proactive services in a human- This section reviews several examples of proactive
centric way requires extensive participation services from around the globe and identifies
in the data ecosystem. It calls for healthy, common elements. It then proposes a preliminary
trusting data relationships, a comprehensive framework for the factors to consider when
understanding of data flows, and responsible, experimenting with this type of innovative data
targeted policy design. relationship to assure it is carried out in an ethical,
sustainable, and human-centric way.
3.1 The journey towards data empowerment
It is the circulation of data in, from and around [generators and
users of data] – and their curation of and appearance in data –
that authorizes states’ and international institutions’ governance …
It is the remote detection of these subjects’ ascribed needs, rather
than any confluence of wills, claims, grievances, or plans, that is
seen to underwrite the distribution or withholding of resources
to or from them.46
In section 2, we saw through Aino’s journey that section 1 made clear, whether individuals deploy
traditional government service delivery often takes their resources (cognitive, physical, emotional, or
a “pull” approach, whereby citizens must seek out economic) towards constructive ends is contingent
government services. upon the level of trust in a relationship or an
environment.49 Therefore, the success of proactive
However, governments around the world, such services depends on the ability of governments
as in the City of Helsinki, Finland47 and the and policy-makers to build for predictability,
national government of Taiwan,48 have adopted transparency (or verifiability), agency, and inclusion.
strategic commitments to offer and deliver
“proactive service”, following a “push” model In the context of proactive services, “trust” means
where governments act first to meet citizens’ adequately addressing concerns around legality,
needs, preferences, and circumstances. These data protection, cybersecurity, privacy, and
governments have recognized the role of data in morality. When is it legally permissible to process
offering efficiency gains in public services, improving and combine data to make accurate predictions?
the quality of government decision-making, and What extra cybersecurity measures are needed
increasing societal and individual wellbeing. An when giving individuals increased control over the
important consideration here is also the widening data that concerns them? How are rights to privacy,
sustainability gap (i.e. growing demand, diminishing individual agency, and freedom of choice respected
resources) in public service provision. when designing proactive services, especially
for those who do not wish to be proactively
As evidenced by Aino’s journey in section 2, served? “E-government 1.0”50 is a description of
the participation of the individual is requisite for the trend to digitize existing, traditional government
policy-makers, people, and societies to realize the processes and services to increase efficiency and
potential benefits of proactive services. Yet, as cut costs, both for governments and their citizens.
Empowered Data Societies: A Human-Centric Approach to Data Relationships 20You can also read
