GCRI · Data and Compute
Data rights and trust
Data about people, communities and places can serve the public good or cause harm. Privacy law, consent, data sovereignty, Indigenous data governance and trusted access arrangements decide who may use data, for what and under which safeguards. This page sets out how data rights and trust are built and lost, how governance is assessed, and what evidence serves the regulators, data stewards and communities involved.
Data rights and trust on the record.
Data rights and trust: how the risk develops.
Data access, licensing and privacy. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Personal data carry rights
Data protection laws give people rights over their data and set lawful bases, purpose limits and safeguards for processing.
Communities have collective interests
Data about groups, including Indigenous peoples, can affect them collectively. The CARE principles assert community authority over such data.
Trusted access enables safe use
Secure research environments, safe outputs and approved researchers let sensitive data be analysed without being released.
Breaches of trust spread
Misuse or a breach in one programme reduces willingness to share data in others, harming research and services that depend on participation.
Data platform and pipelines.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Data platform and pipelines
Data rights and trust · Public data platform · Catalogue v5
Datasets
| Flood extents | Open | Complete | Yes | Published |
| Health facility list | Open | Complete | Yes | Published |
| Mobility traces | Restricted | Partial | n/a | Rights review |
| Household survey | Restricted | Complete | Yes | Access by request |
Pipeline checks
Data rights govern who benefits from data in each domain.
Findings are designed for the Evidence Brief series. FAIR (2016) and CARE (2020) principles, the Data Governance Act (2022) and the Data Act (2023) frame rights and sharing.
- Data sharing agreements as examples.
- Cases where data use harmed or helped a community.
A threshold model of collective behaviour.
Each agent acts once enough of its contacts have; small changes in the mean threshold or the early movers decide whether the behaviour stays local or cascades through the population. Teaching model with stated illustrative values, not a prediction.
Controls
- Mean threshold (share of neighbours)
- 18%
- Spread of thresholds
- 8 points
- Early movers
- 2.0% of people
- Contacts per person
- 8
Readouts
- Share who acted in the end
- 100%
- Global cascade
- Yes
- Steps to settle
- 10
Numbers, methods and sources
| Step | Share who have acted (%) |
|---|---|
| 0 | 2.0 |
| 1 | 7.2 |
| 2 | 17.8 |
| 3 | 29.0 |
| 4 | 44.3 |
| 5 | 64.5 |
| 6 | 81.8 |
| 7 | 94.0 |
| 8 | 98.5 |
| 9 | 100.0 |
| 10 | 100.0 |
Methods
- Threshold models of collective behaviour Granovetter (1978), American Journal of Sociology 83
- Global cascades on random networks Watts (2002), PNAS 99
- Complex contagions Centola and Macy (2007), American Journal of Sociology 113
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
No observed data enters this model: it runs on the teaching values set by the controls, to be replaced with a programme's own evidence.
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Data and Compute in Foundry
- Tested at Data and Compute in Universe
- Codified in Data and Evidence in Standards
- Published in Data and Compute in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Countries with comprehensive data protection law | count | annual | UNCTAD data protection legislation tracker | Published statistics |
| Data protection complaints received | count | annual | Data protection authority reports | Published statistics |
| Projects using trusted research environments | count | annual | Environment operator reports | REPORTED |
| Outputs checked for disclosure before release | percent of outputs | annual | Output checking records | OBSERVED |
| Data sharing agreements with community governance | count | per assessment | Agreement registers | DECLARED |
| Public trust in data use | percent of respondents | per survey | Public attitude surveys | REPORTED |
How data rights and trust is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Datasets and provenance
The data classes behind data rights and trust and what is recorded about each before it is used.
| Data class | Provenance recorded | Resolution stated | Licence checked |
|---|---|---|---|
| Satellite imagery, optical and radar | sensor, processing level, acquisition date | pixel size and revisit | per scene |
| Reanalysis and climate model output | model, experiment, member, version | grid and time step | per release |
| In-situ sensors and gauges | station, instrument, calibration record | point and sampling rate | per network |
| Population and asset exposure | method, vintage, input sources | cell size and unit | per release |
| Boundaries and reference geography | producer, edition, date | scale | per edition |
- Lineage
- W3C PROV record from source to figure
- Principles
- FAIR: findable, accessible, interoperable, reusable
- Gaps
- shown as missing, never filled silently
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| UNCTAD Data Protection and Privacy Legislation Worldwide | Status of data protection laws by country | Public, UNCTAD terms |
| Data protection authority annual reports | Complaints, breaches and enforcement | Public records, licence per authority |
| Global Indigenous Data Alliance CARE principles | Principles for Indigenous data governance | Public, GIDA terms |
| Five Safes framework documentation from statistical agencies | Framework for safe access to sensitive data | Public, terms per agency |
| Public attitude surveys on data use | Trust and acceptability of data sharing | Licence per survey |
Who decides, and what the evidence serves.
Data and Compute prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Data protection authorities | Where to focus guidance and enforcement | Complaints and breach evidence |
| Data stewards in agencies and research bodies | How to provide safe access to sensitive data | Environment designs; disclosure protocols |
| Communities and Indigenous governing bodies | On what terms data about them may be used | Agreement templates; governance reviews |
Outputs this topic produces
- Data governance reviews against legal and ethical frameworks
- Trusted research environment designs
- Disclosure control protocols
- Community data agreement templates
What experts ask about rights and trust.
- Is the licence for this data clear enough that others can reuse it lawfully?
- Can useful analysis be done without exposing personal or sensitive data?
- How can people and communities see and influence how data about them is used?
- How are cross-border transfers handled when laws differ?
What builds and erodes trust.
Trust in data systems is slow to build and quick to lose. A single breach, an undisclosed reuse or a feeling that data was taken without fair return can close off sharing for years. Engineering cannot create trust on its own, but it can make trustworthy behaviour verifiable.
Clear terms
Unclear or incompatible licences block reuse even when holders are willing to share.
Protection by design
Technical measures that limit exposure make sharing possible where it otherwise would not be.
Community interest
Communities whose data is used without say or benefit lose trust and may withdraw cooperation.
Engineering methods for rights and trust.
- 01
Privacy-enhancing technologies
De-identification, differential privacy, secure enclaves, federated analysis and secure computation, grounded in cybersecurity and cryptography. Limits: each trades some utility or cost for protection, and de-identification can sometimes be reversed.
- 02
Access control and audit
Recording who accessed what and why. Limits: logs only help if someone reviews them.
- 03
Trusted research environments
Controlled settings where approved researchers analyse sensitive data without removing it. Limits: cost and capacity.
- 04
Machine-readable licences and policies
Encoding terms so systems can respect them. Limits: legal interpretation still requires people.
How it is studied, and what the methods cannot say.
- 01Data engineering, interoperability and stewardshipFAIR data assessment · Interoperable catalogues · Data quality pipelinesApplied here
- 02Cybersecurity and cryptographySecure research environment design · Federated identity securityApplied here
- 03High-performance, cloud and edge computingWorkload characterisation · Porting codes to new architectures · Hybrid cloud and HPC workflowsApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Where this page leads across the Consortium.
Questions and answers.
What is data sovereignty?
What are the CARE principles?
What is a trusted research environment?
Does anonymisation make data safe to share?
What is Indigenous data sovereignty?
Does the platform give legal advice on data?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.