Governance: Data-sharing frameworks

To what extent do relevant laws, regulations, policies, and guidance provide a comprehensive framework for data sharing?

DefinitionsResearch GuidanceQuestion sub-componentsIndicator Justification

Definitions and Identification

Data-sharing frameworks, which may take the form of law, regulation, policy, or guidance, govern and support the wider use of sensitive, proprietary, or otherwise non-open data.

More broadly, data sharing involves making data accessible to a defined group of other stakeholders with certain controls and restrictions on use. It is distinct from open data, which involves making data available without restrictions.

Government agencies, civil society, and private sector actors may all hold datasets that contain sensitive, proprietary, or personal information which, if made available to other stakeholders with appropriate constraints, could potentially be used for the public good in various ways. For example, data on mobility patterns from private taxi apps might be used to support transport planning; sharing mapping data or logistics datasets following an earthquake might help first responders; farm production data might be used to develop improved insurance products.

A legal or policy framework to facilitate data sharing within or across sectors may cover*:

• Government to government sharing—establishing the basis on which different parts of government may exchange data;

• Government to third-party sharing—establishing when and how government can share sensitive data with third parties (e.g., private sector, research, or others);

• Business to government sharing—establishing when and how government can access and use data generated by the private sector;

• Business to business sharing—establishing rules and incentives for public benefit pooling or exchange of data.

*This list is not exhaustive.

Frameworks that promote data sharing for public good should combine incentives or rules to support appropriate data sharing with robust mechanisms to ensure that sharing is safe and possible harms are well managed. This includes unambiguously identifying who holds accountability at each step of sharing and resharing; establishing oversight mechanisms for every step; and requiring relevant impact assessments prior to sharing.

Further, individuals and collectives should have the right to transfer—share—their data from one provider to another offering a similar service, so that they are not compelled to stay with a particular technical service provider.

Some regions and countries are developing comprehensive frameworks to govern data sharing. Other countries have ad-hoc frameworks for particular sectors, or covering particular concerns, such as the use of data for public health or for artificial intelligence applications.

Note: Data-sharing frameworks are distinct from data protection frameworks, which primarily set out restrictions on use of personal data. Data-sharing frameworks are also distinct from open data and RTI or FOI frameworks, which primarily set out requirements for publishing or otherwise providing government data to the public.

Example

• New Zealand's Privacy Act 2020 allows the sharing of personal data between government agencies and, in certain cases, private entities through mechanisms called Approved Information Sharing Agreements (AISAs). AISAs are formal agreements that permit the sharing of personal information between specified parties to deliver public services more effectively, improve efficiency, or achieve specific policy objectives

Starting points

• Sources:

  • The World Bank Digital Government/GovTech Systems and Services (DGSS) Dataset includes a section entitled Data Governance Institution, Policy & Regulations (columns FM–FX), which may provide leads to relevant policies and frameworks.

• Search:

  • “National data sharing framework”;

  • “Data sharing agreement” + [country] + “government”; typically these structure specific instances of data sharing, but they may also cite the larger framework or authority behind such agreements;

  • Recent academic papers on data sharing in the country;

  • Articles or papers about data sharing in particular sectors such as transport, health, or education.

• Consult:

  • National experts on data sharing.

What to look for?

Look for evidence that can answer the following questions:

• Are there policies, laws, or provisions in place designed to govern and support the wider use of sensitive, proprietary, or otherwise non-open data?

• What kinds of data flows and users do these policies or laws cover?

  • Government to government sharing—establishing the basis on which different parts of government may exchange data;

  • Government to third-party sharing—establishing when and how government can share sensitive data with third parties (e.g., private sector, research, or others);

  • Business to government sharing—establishing when and how government can access and use data generated by the private sector;

  • Business to business sharing—establishing rules and incentives for public benefit pooling or exchange of data.

• Does the framework clearly identify which party or parties hold accountability for each step of sharing? Resharing?

• Does the framework mandate oversight mechanisms for every step of data sharing?

• Does the framework require an appropriate impact assessment to be conducted prior to sharing data? For example, regarding privacy, environmental, or social impact.

• Does the framework recognize people as having a portability right? That is, can people transfer their data across service providers?

• Does the framework require that certain private sector data—such as that related to common goods like health or the environment—be shared in the public interest?

• Is there special guidance for making use of this data through artificial intelligence techniques?

• Are there any restrictions on the sharing of detailed personal information via sale or exchange? For example, restrictions on to whom data brokers can sell such data (e.g., not to foreign entities for national security reasons).

Show/hide supporting questions

Existence

• What is the nature of the framework?

  • No framework exists.

    Supporting questions: In the absence of a strong legal framework, are there alternative norms or customs that play this role in the country? If so, please explain.

  • A framework exists but lacks full force of law.

    Supporting questions: In the absence of a strong legal framework, are there alternative norms or customs that play this role in the country? If so, please explain. Please provide brief details.If there are draft laws or regulations not yet in force that would provide a more robust framework in the future, please provide brief details, including the date(s) of any relevant drafts. Please provide a URL(s) for where evidence can be found.

  • A framework exists and has the force of law.

    Supporting questions: Please provide brief details.Please provide a URL(s) for where evidence can be found.

• Extent of existence:

• How comprehensive, in terms of jurisdiction, is the coverage of the framework assessed for this question? (The framework covers one or more localities, but there are many other localities without such a framework, or with a framework of a lesser quality., The framework covers one or more localities and is representative of the kind of frameworks that can be found for all, or most, localities., The framework provides national coverage.)

  Supporting questions (conditional)

  If The framework covers one or more localities, but there are many other localities without such a framework, or with a framework of a lesser quality. or The framework covers one or more localities and is representative of the kind of frameworks that can be found for all, or most, localities.: Which locality or localities does this framework cover?

  If The framework covers one or more localities, but there are many other localities without such a framework, or with a framework of a lesser quality. or The framework covers one or more localities and is representative of the kind of frameworks that can be found for all, or most, localities.: Please explain your response.

  If The framework covers one or more localities, but there are many other localities without such a framework, or with a framework of a lesser quality. or The framework covers one or more localities and is representative of the kind of frameworks that can be found for all, or most, localities.: Please provide supporting URL(s) as necessary.

• How comprehensive, in terms of parts of government, is this framework? (The framework covers only a limited part of government (e.g., only a single agency or a few agencies), and there are many parts of government without such frameworks., The framework covers, or is representative of frameworks covering, many agencies or parts of government, but there are some agencies or parts of government without such frameworks., The framework covers all or most of government.)

  Supporting questions (conditional)

  If The framework covers only a limited part of government (e.g., only a single agency or a few agencies), and there are many parts of government without such frameworks. or The framework covers, or is representative of frameworks covering, many agencies or parts of government, but there are some agencies or parts of government without such frameworks.: To which agency or agencies, or part(s) of government, does this framework apply?

  If The framework covers only a limited part of government (e.g., only a single agency or a few agencies), and there are many parts of government without such frameworks. or The framework covers, or is representative of frameworks covering, many agencies or parts of government, but there are some agencies or parts of government without such frameworks. or The framework covers all or most of government.: Please provide supporting URL(s) as necessary.

• Existence summary:

• Please summarize your answers to the preceding existence sub-questions, including the extent of existence. [Open Text] Drawing on the research you have conducted and the evidence you have gathered for this section, describe what you have found (or not found) when answering the existence sub-questions for this indicator.

  Supporting questions

  Please provide the URL(s) for the evidence that supports the summary provided.

Elements

• Provisions for definitions, kinds, and fields:

• The framework covers data sharing within government. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Please indicate which section of the framework refers to this issue.

• The framework covers how government should share data with other sectors. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Please indicate which section of the framework refers to this issue.

• The framework covers data sharing from other sectors to government. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Does this include any restrictions on government regarding the purchase or other acquisition of third party consumer data or other personal data? (E.g., restrictions regarding types of data, requirements that data brokers meet specific data governance standards, or that purchases may only be undertaken with oversight mechanisms, etc.) Please briefly explain.

  If Partially or Yes: Please indicate which section of the framework refers to this issue.

• The framework covers data sharing within the private sector. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Please indicate which section of the framework refers to this issue.

• Rights and responsibilities:

• The framework establishes unambiguously who is accountable at each step of data sharing, including resharing. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Please indicate which section of the framework applies to this issue.

• The framework establishes oversight mechanisms for every step of data sharing, including resharing. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Please indicate which section of the framework refers to this issue.

• The framework requires an impact assessment to be carried out before data is shared. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: What kind of impact assessment is required? For example, privacy, environmental, social, etc.

  If Partially or Yes: Is there a requirement to publish impact assessments?

  If Partially or Yes: Please indicate which section of the framework applies to this issue.

• The framework establishes rights to data portability. (No, Partially, Yes) Individuals and collectives should have the right to transfer their data from one provider to another providing a similar service, so as not to be locked into a particular technical service provider.

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Please indicate which section of the framework refers to this issue.

• Specific considerations:

• The framework requires certain private sector data to be shared in the public interest. (No, Partially, Yes) For example, data related to specific sectors, such as health or environment, that affect common goods.

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: What public interests are covered?

  If Partially or Yes: Please indicate which section of the framework applies to this issue.

• The framework explicitly focuses on artificial intelligence uses of data. (No, Partially, Yes)

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: Please indicate which section of the framework refers to this issue.

• The framework restricts data brokers’ ability to sell or exchange detailed personal information. (No, Partially, Yes) For this sub-question, assess restrictions on sharing that apply to the act of sale or exchange. For example, restrictions on to whom data can be sold (e.g., not to foreign entities for national security reasons).

  Supporting questions (conditional)

  If Partially: Please explain your “Partially” response.

  If Partially or Yes: What restrictions apply?

  If Partially or Yes: Please indicate which section of the framework applies to this issue.

• Elements summary:

• Please summarize your answers to the preceding element sub-questions. [Open Text] Drawing on the research you have conducted and the evidence you have gathered for this section, describe what you have found (or not found) when answering the element sub-questions for this indicator.

  Supporting questions

  Please provide the URL(s) for the evidence that supports the summary provided.

A considerable amount of data that might be used for the public good is not suitable for sharing as open data, either due to proprietary interests in the data or risks of harm if the data were to be misused. However, such data can still be used for public benefit through data-sharing arrangements.

International normative standards for good data-sharing practice are currently being developed. The OECD's Enhancing Access to and Sharing of Data (2019) describes a range of initiatives for data sharing, tracking different governance approaches to supporting data reuse across organizations and sectors. These include European Union measures to create "common data spaces," efforts to create increased interoperability and exchange of data within the public sector, and the creation of sectoral requirements for public and private sector data-sharing. The 2021 World Development Report calls for the integration of civil society, academia, and the private sector into national data systems, both as users of public data and as suppliers of data that can be reused for public benefit.

While data-sharing standards continue to evolve, since the first edition of the Barometer two areas have developed significantly. First, analysis of data-sharing during the COVID-19 pandemic has underscored the importance of the unambiguous identification of accountable parties and oversight mechanisms for every step or sharing and resharing (see, e.g., Drazewska and Findlay 2024). Second, in conjunction with AI tools and algorithmic decision-making, impact assessments—whether defined around privacy, human rights, the environment, or society more broadly—are increasingly being adopted by governments as a safeguarding mechanism (see, e.g., Global Index on Responsible AI 2024). This indicator has been updated for this second edition to reflect these two developments.