Our data are collected every day. When we go to the shops, use the internet or use any government service. A visit to the hospital, going to work, using a bank, going to school all involve data collection.

While we may feel reasonably comfortable with sharing our name, email address or phone number, we generally are less comfortable when it comes to sharing our health information. This is particularly true for diseases that are stigmatised (e.g. HIV, HCV) or for stigmatised procedures (e.g. abortion). Much of these data are systematically collected by governments, and generally without consent as authorised by legislation. There are registries (complete, systematic collection of all cases) for cancer, pregnancies and births from 20 weeks gestation, serious injury and a vast array of clinical registries. All admissions to hospital, public or private have a centrally collected abstract of the admission details.

Data governance provides the set of rules to manage these data. Well-designed, they ensure compliance with legislation and include monitoring systems for compliance. These rules include the purpose of the data, what is collected and how, how it can be used and the way in which they can be released to those outside of government for their own use. Generally, there are legislative rules which guide the data governance system.

What can Indigenous Data Sovereignty teach us?

We now understand that there are other dimensions of data governance that until more recently have been under-prioritised. The gaps become clear when we consider the work of Indigenous Data Sovereignty.  “Indigenous Data Sovereignty refers to the right of Indigenous peoples to exercise ownership over Indigenous data. Ownership of data can be expressed through the creation, collection, access, analysis, interpretation, management, dissemination and reuse of Indigenous data”. (Kukutai & Taylor 2016; Snipp 2016)

Across Australia communities are working through how Indigenous Data Sovereignty can be implemented. As one example, guidance has been provided by the National Indigenous Australians Agency. It includes four pillars, summarised here:

1. Partner with Aboriginal and Torres Strait Islander people – meaningful partnerships over the whole data life cycle
2. Build data related capabilities – communities supported to use their own data, tell their own stories, make their own decision and set their own priorities
3. Provide knowledge of data assets – Aboriginal and Torres Strait Islander people can easily access their data for self-determination and community development
4. Build an inclusive data system – a more accessible and culturally competent public service.

This approach goes well beyond the legislative approach to data governance to the importance of data to community self-determination and wellbeing.

Indigenous Data Sovereignty and social licence

Social licence for governments to use health data cannot be taken for granted. The community is increasingly sophisticated in their understanding of data and expectations of how their data will be used, and consequently their support for the current system may be fragile. A single negative event, such as a data breach, inadvertent identification of individuals or communities, or inappropriate use of data can erode public confidence. We could see reduced acceptance of mandatorily collected data without consent, the mainstay of health data.

An informed community that actively participates in the use of their data is more likely to provide the ongoing social licence to operate. The current rules tend to revolve around the data custodian and controlled uses of the data (e.g. for research), rather than the community that provided the data. Existing data governance frameworks generally do not include:

• meaningful two-way communication between data holders and the community
• rules that ensure data analysis avoids stigma or discrimination
• transparent reporting back to communities on how their data have been used
• ensuring increased data literacy in the community so communities can interpret and use data themselves.

These missing elements are part of the more sophisticated approach to Indigenous Data Sovereignty. The four pillars – partnership with communities, building data literacy, community access to data and an inclusive data system – represent best practice in data governance.

A modern data governance system moves beyond legislative compliance to genuinely earn and sustain social licence. Its time data governance caught up with the principles of Indigenous Data Governance and Data Sovereignty.

References

Critical Intelligence Unit. Evidence brief: social licence for health data. NSW Government, 4 December 2024. Evidence brief: Social licence for health data

Snipp, C., 2016. ‘What Does Data Sovereignty Imply: What Does It Look Like?’, in T. Kukutai & J. Taylor (eds.), Indigenous Data Sovereignty: Toward an Agenda. ANU Press, Canberra. https://doi.org/10.22459/ CAEPR38.11.2016.03

The Framework for Governance of Indigenous Data was co-designed by Australian Public Service (APS) agencies, and Aboriginal and Torres Strait Islander and non-government partners. Framework for Governance of Indigenous Data