Franco World Data

CHA
PT
8
E
Institutions for data governance:

Building trust through collective
action
Main messages
1 The institutions required to govern data fill four main functions: strategic
planning; developing rules and standards; compliance and enforcement;
and generating the learning and evidence needed to gain insights and
address emerging challenges.
2 Nongovernmental institutions and mechanisms such as data interme-

diaries can help governments and other actors safely share and use data
to capture greater value, while promoting equitable access to data and
the value they create.
3 Public institutions must have sufficient resources, adequate autonomy,

and technical capacity, including data literacy, to fulfill their mandates
efficiently. Political champions in positions of power are critical to leading
data management reforms that create incentives and a culture of data
use, dissemination, and transparency.
4 A multistakeholder, purpose-driven approach to data management and

governance can help institutions keep pace with an ever-evolving data
ecosystem and enhance their legitimacy, transparency, and accountability.
Institutions for data governance: Building trust through collective action | 265
How can institutions help govern actors; the role fulfilled by data intermediaries; and
the performance-enhancing features of institutions.
data for development?
A
Data governance functions include developing over-
s described in part I of this Report, capturing arching data strategies and policies; elaborating legal
greater value from data requires sharing frameworks and guidance on how rules should apply
and using more data. This chapter describes and be enforced if violated; undertaking arbitration
how institutions can help facilitate the secure flow in case of conflict; and maintaining monitoring,
of data, while ensuring their confidentiality and evaluation, and constant feedback loops to promote
protection in alignment with principles of the social engagement, learning, and improvements.
contract for data. These functions are performed by data governance
Formed by state and nonstate institutions, a data institutions, whose roles and relations are specific to
governance ecosystem1 provides structure and incen- the context. This chapter highlights patterns in insti-
tives for the trusted creation, storage, processing, tutional mandates in the public sector and in the roles
sharing, use, and destruction of data throughout their of nongovernmental institutions and actors across
life cycle. It does so by means of implementation of countries. Examples are provided of commonly used
policies, laws, platforms,2 systems, and standards. institutions, while recognizing that both the actual
Three building blocks contribute to an effective and and optimal allocation of data governance functions
inclusive data governance ecosystem: the data gov- across institutions will vary, depending on local con-
ernance functions carried out by institutions and ditions (see box 8.1).
Box 8.1 Uruguay’s whole-of-government approach to data governance
Implementation of data governance reforms across programs and policies are informed by multiple sources
the whole of government is complex. Some countries of data. More generally, well-designed, user-centric data
have opted to first build the foundational hard and soft infrastructure will encourage the repurposing and reuse
infrastructure. This Report interprets soft infrastructure of data, thereby increasing the value of data otherwise
broadly to include software platforms (sometimes called trapped in siloed infrastructure.
data and information management systemsa) supported Along with infrastructure, countries must invest in
by technical interoperability standards, data integration the “analog complements,” including adopting enabling
methods, and people accountable for the functioning legislation and regulations and institutionalizing gov-
of these systems. Siloed approaches, bespoke technical ernance arrangements to ensure the sustainability of
architecture, and disparate database taxonomies are reform efforts.b
often indicative of outdated soft infrastructure, prevent- One example of an institution-focused approach to
ing data from being used more widely. data-driven digital transformation is that taken by Uru-
Because of the disparate nature of existing platforms guay. Its Agency for Electronic Government and Infor-
and the complex web of data management architecture, mation and Knowledge Society (Agesic), launched in
the initial stages of soft infrastructure reforms usually 2007, has driven the country’s successful e-government
focus on digitizing, classifying, and sharing data within reforms. Because of its proximity to the Office of the
the public sector. The first step in the process should be President, Agesic has benefited from the high-level stra-
identifying the data to which the government has access, tegic leadership required to drive the country’s digital
how these data are classified (open, restricted, or per- agenda in a multistakeholder manner. A central factor in
sonal), and who produces or uses the data, along with the success of Uruguay’s digital transformation has been
other information such as limitations and provenance. the integration of a well-developed domestic informa-
Desirable platforms and standards enable secure data tion and communication technology (ICT) industry that
flows across a wide variety of institutions and actors. provides access to quality platforms and services with
This foundation of modern data infrastructure (both local technical knowledge to inform design and imple-
soft and hard) is meant to ensure that, for example, mentation efforts and avoid reliance on infrastructure
data produced in one ministry in the public sector can built by the public sector.c The country’s interoperabil-
be easily shared with other ministries or users so that ity platform, the Integrated Government Architecture,
(Box continues next page)
266 | World Development Report 2021

Box 8.1 Uruguay’s whole-of-government approach to data
governance (continued)
and its supporting Enterprise Architecture Framework and institutions) are designed and implemented in a
(TOGAF), are the technical foundation on which a robust coordinated, inclusive manner to enable better use
data governance framework has been built. of data for decision-making and user-centric service
Uruguay’s Digital Transformation Agenda 2020 delivery.d
exemplifies how countries can take a whole-of-
government and multistakeholder approach to guaran- a. World Bank (2016).
b. OECD (2019a).
teeing that the various layers of the data governance c. Porrúa (2013).
ecosystem (platforms, systems, policies, laws, standards, d. Agesic (2019).
After de jure governance arrangements are in from the private sector, academia, civil society, and
place, actors may still not have strong incentives to international organizations can help governments
create, share, and use data productively.3 They may strengthen the social contract around data by enhanc-
find these actions too costly, or they may try to free ing perceptions of procedural fairness and legitimacy.
ride on the efforts of others.4 Incentives to hoard data Finally, coordination among institutions in the public
in siloes may arise from perceptions that control sector and nongovernmental stakeholders can avoid
of data is tantamount to power over government data and process duplication and facilitate secure data
decision-making. Other challenges to data sharing sharing, leading to gains in efficiency. Transparency
may be linked to autonomy or capacity constraints. and opportunities for scrutiny and accountability can
Data intermediaries and a user-centric design of be built into decision-making processes to increase
digital platforms can lower the costs of sharing data, their legitimacy.
thereby reducing incentives for free riding. They also The final section of this chapter uses the maturity
can support inclusion in data use by increasing the model introduced in chapter 1 to illustrate how coun-
usability of information for nontechnical experts. tries can best develop a solid institutional foundation
This chapter explores how these new types of insti- to support their data governance ecosystem.
tutions and mechanisms facilitate data sharing and
reuse between diverse actors and increase access to
Data management across the
otherwise siloed datasets.
Free riding of data can occur in both the private
data life cycle
and public sectors.5 This chapter discusses three fea- The data life cycle starts when a government, private
tures of institutions that could improve incentives for sector firm, civil society organization (CSO), nongov-
collecting, sharing, and using data: (1) the technical ernmental organization (NGO), or academic institu-
capacity, including sound data literacy, to discharge tion (including think tanks and researchers) collect
their functions effectively; (2) a culture of perfor- data (see figure 1.2 in chapter 1). These data are then
mance and rewards and incentives for staff that validated, stored, and processed, and then possibly
support a transition to data-driven government; and shared with others. After using the data, the actor may
(3) the institutional accountability and independence archive them or destroy them. If the data are retained,
that help establish public trust in the integrity of insti- they can be reused. The life cycle begins again when
tutions, particularly those tasked with rule making data are reused, potentially for a completely new pur-
and compliance, which may otherwise be vulnerable pose. Engaging in outcome-oriented and user-centric
to undue political or commercial influence. data management at each step of the data life cycle
Adopting an inclusive, multistakeholder approach can promote greater value creation from data (for
to data governance can help ensure that the right chal- examples, see table 8.1).
lenges around data use are identified and addressed, Some data management decisions lower the
keeping in mind the diverse needs of end users, costs of data sharing across actors, thereby facilitat-
including traditionally marginalized groups. More- ing reuse. For example, as data are being processed
over, collaboration by a wide range of stakeholders they should be coded using standardized units or
Table 8.1 Data management decisions along the data life cycle
Stage of life cycle Area in which data management is needed
Create/receive • Determine lawful use (such as obtaining consent for data collection and sharing).
• Collect identifications that allow data to be merged with other datasets.
Process • Standardize units and categories (such as industry classifications).
• Use data formats that are widely compatible and accessible.
• Validate the quality (accuracy), relevance, and integrity of data.
Store • Encrypt data; use secure servers; back up and archive data.
Transfer/share • Verify whether consent allows for data to be shared.
• Deidentify data, if appropriate.a
• Sign confidentiality agreements for use of identified data.
• Publish data via bulk downloads or APIs.
Analyze and use • Ensure reproducibility; publish code or algorithms.
• Do not publish identifiable data.
• Visualize and communicate insights from data.
Archive and preserve • Classify and catalog data systematically so they can be found easily.
• Include data dictionaries and notes on how data were created.
• Maintain access to data and their security and integrity over time.
Destroy or reuse • Keep records of destruction processes.
• Verify that consent for use is still valid.
Source: WDR 2021 team.
Note: APIs = application programming interfaces.
a. See Elliot et al. (2016); Polonetsky, Tene, and Finch (2016).
categories, such as common industry classifications, The decisions at every stage of the data life cycle
and converted to a format widely compatible with will vary, depending on the type of data and their
various types of software. Adopting common classifi- proximity to features of public goods.7 To guide and
cations and formats requires an upfront investment, structure decisions, data management needs to rely
but it will allow actors to share and combine data on a data governance framework. In a mature data
more easily. In Mexico, states and local municipalities system, data governance and data management work
collect and share data via the central government’s together to create value from data use in a manner
Chapter 8_Additional Figure 2
open data network, Red México Abierto, in accor- consistent with the values of the social contract
dance with centralized data quality standards.6 (figure 8.1). The data governance framework can
Figure 8.1 Data governance and data management, working seamlessly together

in support of the social contract
Create
ence Stra
vi d t eg
de ic
an
p la
Archive Process
i ng
nni
Le a r n
ng
Value
Data Data
governance Trust management
Equity
tat n d
en ng a
io n
Analyze Store
Co
a
ki
mp
ia n em
Rul ple m
l
ce
im Transfer

Note: The data management life cycle at right appears in figure 1.2 in chapter 1.

stipulate rules about the use and reuse of data, includ- concentrated on private sector firms.8 However, rec-
ing consent, and also set standards for processing ognition is growing that data governance frameworks
and classifying data. Together, clearly defined data are also needed to guide countries’ public sectors and
management standards and a robust data governance multilateral organizations seeking to enhance the
framework can help users better harness the value value of data to improve lives.9 Box 8.2 illustrates why
from data in a safe and equitable manner. such a framework is important to the functioning of a
data economy—and how intricate it can be—using the
example of digital IDs.
Data governance functions
This chapter draws on the literature and experi-
Traditionally, scholars studying how data governance ences of public sector management worldwide and
frameworks can improve data management have the body of work on corporate data governance to
Box 8.2 The importance and complexity of data governance

institutions: The example of digital identification (ID) systems
Verifying identity attributes or authenticating an iden- the “least privilege” powers necessary to perform their
tity—particularly using an official trusted source—can delegated functions.c If the system outsources critical
be an essential step in determining whether a person is functions to others, such as enrollment agents, registrars,
who he or she claims to be and is authorized to apply or credential providers, these parties may be subject
for or receive the requested service or benefit. The appli- to certification and obligations. Third parties using the
cation of digital identity verification and authentication system, such as hospitals, banks, universities, and public
mechanisms in conjunction with trusted and inclusive agencies, must be subject to rules on the basis by which
ID systems can increase access to services, reduce fraud they can access the ID system, standards on the form of
and administrative costs, and create opportunities for data they exchange, and controls on how they can use the
innovation, such as through the automation, integration, data they handle. Rules will govern how such interactions
and remote delivery of services. However, these mecha- must be logged to create records of an individual’s activi-
nisms also process sensitive data, sometimes including ties and relationships with numerous bodies.
biometric data, and therefore must be subject to strong Other institutions and actors may also be involved.
governance and accountability frameworks. For example, an independent digital identification
An ID system’s purpose—how personal data will be agency may be responsible for managing the system. A
used—is typically set by law or regulation. These rules civil registration agency may need to interoperate with it.
govern the system’s design and operation, as well as the A data protection authority (DPA) may exercise general
technical specifications, standards, and procedures to be oversight to ensure implementation of the appropriate
adopted to ensure that the system delivers the level of governance principlesd and compliance with the law. A
assurance needed for identification and verification. These foundational ID system may be considered critical infra-
rules also protect security and personal data and mitigate structure, requiring monitoring by the DPA, a Computer
risks of surveillance and discrimination.a Such rules may Security Incident Response Team (CSIRT), or other body
limit the collection and use of personal data to the min- responsible for cybersecurity. If the ID system is part of
imum necessary to achieve the specific processing pur- a regional mutual recognition arrangemente—such as
pose, or require deidentification or encryption. The rules the European Union’s electronic IDentification, Authen-
may state as well that certain data—such as biographical tication and trust Services (eIDAS) frameworkf—inter
data and biometric data—should be processed separately operability and use of common standards with foreign
to prevent any attempt to assemble complete profiles of agencies that issue IDs and credentials may be required.
individuals.b Whether data localization requirements will a. Cavoukian (2011).
apply to the data will depend on the risks, opportunities, b. Danezis et al. (2014).
and costs involved, and whether third-party databases, c. For example, the Unique Identification Authority of India (UIDAI) oper-
ates clearance levels for accessing the Aadhaar identification database.
processors, or cloud providers can provide assurances See UIDAI, Aadhaar (dashboard), https://uidai.gov.in/.
about security and data protection requirements. d. The development of data strategy, policy, and regulations should be
informed by a principles-based approach (Floridi and Taddeo 2016).
Administrative rules aimed at mitigating risks of e. The African Union (AU), Economic Community of West African States
human error and misuse of personal data may require that (ECOWAS), East African Community (EAC), and Association of Southeast
Asian Nations (ASEAN) are considering introducing mutual recognition
identification and authentication functions be separated of identification credentials across borders.
in the system or that administrators be authorized with f. EC (2020); EU (2014).
ditional Figure 1
Figure 8.2 Functions of data governance use and misuse (chapter 3). At the country level, the
first step is to develop a national data strategy in line
with the country’s priorities (chapter 9). To facilitate
implementation, strategies should be devolved into
Strategic planning action plans with clear targets.12 Strategies should also
• Develop strategies include identifying institutional arrangements and
• Establish institutional mapping governance functions to existing or new
arrangements institutions.
Rule making and implementation

Learning Rule making and
Legislating and regulating. Laws and regulations are the
and evidence implementation
critical safeguards and enablers needed to standard-
Data • Legislate/regulate
• Monitor and ize and organize data throughout the data life cycle.
evaluate governance • Set standards
They stipulate how sharing, pooling, or granting of
• Anticipate and • Provide clarification
and guidance access will be carried out, including limits on certain
manage risks
uses of data to promote trust (see the detailed discus-
sion in chapter 6). Rule-making functions include cre-
Compliance
ating new public sector data governance institutions
• Enforce
whose mandate, criteria for appointing managers,
• Audit
and funding arrangements are stipulated by regula-
• Arbitrate
tion or decree.
• Remedy
Setting standards. Systems should be designed
around recognized harmonized formats and pro-
tocols for data production, storage, transfer, access,
protection, and security, thereby supporting inter
operability, increasing data quality, and improving
take a broad view of data governance. Its functions the usability and integrity of data.
are divided into four thematic clusters: strategic plan- Providing clarification and guidance. Institutions can
ning; rule making and implementation; compliance; reduce barriers to compliance with laws and regula-
and learning and evidence to provide insights and tions (say because of lack of information about obliga-
improve policy making (figure 8.2). Within each the- tions) by providing stakeholders with clear, practical,
matic cluster are several functions.10 The next major easily accessible, and user-friendly guidance.13 The
section maps the governance functions described more complex the data and the actors involved, the
here to specific institutions and actors both inside greater may be the need to clarify and guide partic-
and outside government. ipants to ensure a shared understanding of how the
data are governed.
Strategic planning
Developing strategies and establishing institutional Compliance
arrangements. The overall objective of data institu- Enforcing. Enforcement is the day-to-day work of
tions and governance frameworks is to safely realize ensuring compliance with laws and regulations, stan-
greater social value from data. Finding the appro- dards, and norms.
priate balance between encouraging greater use of Auditing. Enforcement is supplemented with regu-
data while maintaining safeguards against misuse lar and occasional audits to identify areas of noncom-
is ultimately the role played by each country’s social pliance that may require remedies or improvements
contract for data. Achieving this balance in practice in the rules.
requires that institutions and actors work together Arbitrating. When rules do not answer all the ques-
to transform the general principles11 of the social tions, arbitration may be helpful. For example, if there
contract into strategies, policies, and integrated data is doubt about whether the combination or associa-
systems (chapter 9). This transformation must go tion of certain data renders the data sensitive (such as
beyond protecting personal data to include strategies by revealing religion), a decision may be required on
for responsible and ethical data use (chapter 6). This whether the data processing falls within the scope of
step is particularly warranted because of the rapidly the data protection law.
changing data landscape and incentives to collect Remedying. Faults in compliance require remedies
vast amounts of data, creating opportunities for data to correct or compensate for any breaches or damage

from the use of data. For example, if data have been level. They also may fall to sector-specific agencies,
obtained or manipulated without authority, thereby the judiciary, independent regulators and watchdogs,
breaching data protection or security requirements, it or subnational government bodies.16
may be necessary to notify the data subjects or cancel These functions may be performed as well by
an identity credential. nongovernmental institutions, including individual
citizens; CSOs; NGOs; the private sector (such as
Learning and evidence industry associations and standard setting organiza-
Backward-looking monitoring and evaluation (M&E). tions); the news media; academic institutions, think
M&E can serve at least two purposes. First, it can tanks, or researchers; and bilateral and multilateral
help supervisors track the performance of their own organizations.17
staff and organizations, allowing them to make better Nongovernmental institutions and actors play
management decisions.14 Second, M&E can assess an important role in performing or informing data
how a program or policy delivers on identified objec- governance functions. Deliberation and consensus
tives. Disseminating M&E frameworks and results in building between these actors promote trust and
user-friendly formats can foster accountability and responsive policy making, thereby strengthening the
promote trust in data governance institutions. social contract on data (see discussion later in this
Forward-looking learning and risk management. chapter). These processes have become more import-
Complex areas of data governance can benefit from ant over the last 20 years.18 Nongovernmental insti-
horizon scanning and scenario planning, as well tutions can also impose checks on governments in
as from anticipatory governance.15 These tools and states with weak or limited formal institutions where
approaches can be used to identify and respond to elite capture may impede data governance and hinder
emerging or unforeseen issues before they become outcomes in the public interest.19
acute societal challenges and to inform planning and Table 8.2 maps institutions and actors to the gov-
policy-making activities. For example, the growing ernance functions they typically perform, according
use of artificial intelligence (AI) and big data technol- to the most prominent function of each institution.
ogies in some sectors (such as the utilities market) or This mapping does not imply that certain institutions
for emergency uses (such as contact tracing during do not also perform other functions that may fall in
the COVID-19 pandemic) may require policy makers other thematic clusters. The institutions and actors
to adapt existing data governance regimes before any discussed here are not meant to be prescriptive or
misuse of that data occurs. exhaustive. Rather, they illustrate how these func-
Innovation. Both M&E and risk management can tions and processes can be performed in different
be helpful in responding to the rapid technological contexts.
changes reshaping the possibilities and risks in how The institutional arrangements adopted should
data management systems are designed and used. consider preferences about the data at issue, the exist-
In response to the rapidly changing environment, ing structure of the public sector and society, techni-
institutions can play an important role in facilitat- cal capacity, and available technologies. Institutions
ing timely assessments of what works in the newly that perform well in certain contexts may fail in oth-
evolving data environment and offer guidance on ers. As the 2002 World Development Report on building
how to quickly adapt to change and promote knowl- institutions for markets stated, “Much of the import-
edge sharing. Institutions can also play an important ant work in building institutions lies in modifying
role in rolling out lessons and capacity building both those that already exist to complement better other
within the nation and internationally. Once a new institutions and in recognizing what not to build.”20
approach has been shown to succeed in one region,
country, or locality, existing mechanisms should Strategic planning institutions
enable it to be tested in others, especially those with Government entities. Many countries—especially higher-
limited internal resources. income countries—have taken a centralized approach
by adopting a national data governance entity that
Mapping data governance provides strategic direction, makes policy decisions,
and sets institutional arrangements. Countries either
functions to illustrative
establish a separate data governance agency or opt
institutions for a dedicated data governance unit embedded in an
The governance functions described in the preceding existing institution. Fifty-three percent of high-income
section may be performed by entities within govern- countries have a data governance entity in place, com-
ment, at the center of government, and at the technical pared with only 18 percent of upper-middle-income
Table 8.2 Candidate institutions and actors to perform or inform data governance
functions
Thematic clusters and functions Indicative institutions and actors
Strategic planning Data governance arrangement
• Developing strategies and policies in • Centralized approach: data governance agency/unit embedded in
line with the social contract for data an existing institution (such as NSO, digital economy ministry)
• Establishing institutional arrangements • Decentralized approach: data governance units and
responsibilities embedded across government
• CSOs
• Universities
• Research institutions
Rule making and implementation National legislature and sector-specific regulators
• Legislating/regulating • Telecom regulator
• Setting standards • Banking and financial securities market regulator
• Providing clarification and guidance • Industry associations
• CSOs
• Institutional Review Boards
International institutions
• Sector-specific SSOs
• International organizations (World Bank, IMF, UN, WTO)
Compliance Watchdog and umpire
• Enforcing • Data protection authority
• Auditing • Access to information agency
• Arbitrating • Antitrust authority
• Remedying • Consumer protection agency
• Audit body
• Courts
• Ombudsperson
• CSIRT
Learning and evidence Knowledge community
• Engaging in backward-looking • M&E unit within entity or independent M&E body
monitoring and evaluation • CSOs and NGOs, multilateral development institutions,
• Engaging in forward-looking learning international development banks
and risk management • Academic institutions
• Think tanks, policy institutes, research institutions
• News media
• Training bodies
• Professional associations
Source: WDR 2021 team, based on a functional approach to governance and public sector management.
Note: CSIRT = Computer Security Incident Response Team; CSO = civil society organization; IMF = International Monetary Fund; M&E = monitoring and
evaluation; NGO = nongovernmental organization; NSO = national statistical office; SSO = standard setting organization; UN = United Nations; WTO = World
Trade Organization.
countries and 10 percent of lower-middle-income of development of a national data system in support

countries (figure 8.3, panel a). 21 To date, no low-income of a national data strategy).22
country has established a data governance entity. For Lower-middle-income countries and upper-
the most part, countries that do not have a data gover- middle-income countries are more likely to embed
nance entity also do not have a stand-alone national the strategic planning function in an existing gov-
data strategy in place. Only 3 percent of low-income ernment institution (figure 8.3, panel b). One reason
countries have such a strategy, compared with 6 perfor doing so is that creating stand-alone institutions
cent of lower-middle-income countries, 18 percent of can be costly and inefficient, requiring sufficient
upper-middle-income countries, and 52 percent of resources and technical capacities to be productive.23
high-income countries (see chapter 9 for a discussion Embedding new functions in existing institutions

Figure 8.3 No low-income and few lower-middle-income countries have a separate data
governance entity; most embed them in another government institution
a. Share of countries with a data governance entity, b. Type of data governance entity,
by country income group by country income group
60 100
53
90
50 29
80
70 56
40
60
Percent
Percent
30 50 100
40
20 18 71
30
10 20 44
10 7 8
4 10
0 0
0 0
Low-income Lower-middle- Upper-middle- High-income Lower-middle- Upper-middle- High-income
income income income income
In progress or planned Established Separate data governance agency

Part of another government institution
Source: WDR 2021 team calculations, based on World Bank, DGSS (Digital Government/GovTech Systems and Services) (dataset), https://datacatalog.world
bank.org/dataset/digital-governmentgovtech-systems-and-services-dgss-dataset. Data at http://bit.do/WDR2021-Fig-8_3.
Note: Panel a: data are for 198 economies. Data governance entities include both separate agencies and units that are part of another institution. Panel b: data
are for 58 countries. Data are only for countries that have a data governance entity established or in process. Low-income countries are not included in the
figure because none has a data governance entity.
or creating an interinstitutional body such as a data Brazil is one of the few upper-middle-income
governance council may give governments greater countries with a separate data governance entity.
flexibility in the early stages of establishing a data Established in 2019, the Central Data Governance
governance framework. This approach also enables Committee is tasked with steering Brazil’s transition
governments to draw on expertise from relevant to a data-driven public sector by promoting data shar-
institutions and, by incorporating more stakeholders ing among federal agencies and integrating citizens’
in the process, to increase the inclusivity of strategy information in a single platform (the Citizen Base Reg-
setting and policy design. ister).25 The committee was created as a separate entity
In Jordan, the strategic planning function is by presidential decree to ensure high-level collabora-
assigned to an existing government institution. The tion and coordination of data governance activities.
Policies and Strategies Directorate of the Ministry of Other countries have followed a more decentralized
Digital Economy and Entrepreneurship (former Min- approach, whereby a network of ministries, depart-
istry of Information and Communications Technol- ments, and agencies share responsibilities for imple-
ogy) is responsible for developing relevant strategies menting data governance functions. For example,
and policies. The directorate has drafted the country’s national statistical offices (NSOs) often serve as the
Digital Transformation Strategy for Government Ser- focal point for development of National Strategies for
vices (2019–22), as well as technical policies related the Development of Statistics (NSDSs), a component
to various elements of data governance, including of a country’s data strategies (see chapters 2 and 9).26
the government’s policies on data classification and The entity responsible for strategic planning must
cybersecurity. Similarly, the government of Thailand be placed at the highest level in government, where it
assigned the strategic planning function to previ- can exercise the appropriate leverage. In some coun-
ously existing agencies by fully replacing its Minis- tries, this location is at the center of government, such
try of Information and Communication Technology as the Prime Minister’s Office or President’s Office, in
with the Ministry of Digital Economy and Society in coordination with the NSO.
2016. Several agencies responsible for cross-cutting Nongovernmental institutions. Institutions outside
data and digital technology functions were consoli- of government, including civil society actors, academic
dated under this new centralized structure.24 institutions, think tanks, and nongovernmental research
institutions, also play a key role in developing strate- (EITI), the Open Government Partnership (OGP), and
gies and policies.27 Some initiatives are almost entirely the United Nations’ International Telecommunica-
driven by civil society, such as in the open data space. tion Union (ITU), establish common sets of principles,
For example, nongovernmental actors established rules, and procedures that help support interoperabil-
the Open Definition in 2012, standards for open data ity and portability of data within a sector. Transaction
licensing in 2013, and the Open Data Charter in 2015.28 costs then fall and the prospects rise for productive
Civil society actors can also add value by advising data flows between data suppliers, data intermediar-
on how strategies and policies can build on and be ies, and data users.
responsive to local dynamics and address problems Private sector industry participants also have an
in a manner suited to the local context. important role to play in setting standards because
Strategic planning functions may also be per- they can facilitate market access, increase efficiency,
formed by international or regional organizations. reduce costs, and manage labor and environmen-
In 2018 the Association of Southeast Asian Nations tal standards to achieve responsible productivity.31
(ASEAN) adopted the ASEAN Framework on Digital Although private standards are voluntary, they may
Data Governance, which guides members seeking to become de facto industry norms if they are widely
strengthen and coordinate their policy and regulatory adopted. They can be especially appropriate when
regimes and institutional arrangements for data gov- informed by public sentiments; industry actors may
ernance and to achieve interoperable data governance be moved by pressure related to ethical behavior,
systems. The framework is aimed at bolstering the fair labor practices, their environmental footprint,
region’s digital economy and enhancing cross-border and more. Voluntary industry standards can also
data flows in a manner consistent with the data reg- potentially avoid the rigid qualities of government
ulatory thresholds of partners. Similarly, the African standard setting.32 For example, industry associations
Union’s Digital Transformation Strategy for Africa develop standards and provide guidance at the indus-
(2020–30) is aimed at increasing data interopera- try level. The foremost example is the International
bility (to spur greater use of data and transform the Organization for Standardization (ISO),33 an inde-
digital economy) and improving standards for data pendent global organization with a membership of
protection.29 165 national standards bodies composed of domain
experts who develop market relevant standards based
Rule making, standard setting, and on an international consensus. On the other hand,
implementing institutions market asymmetries may lead to a lack of inclusivity
Rule making and implementation functions are in the development of standards, with dominant com-
performed across the three branches of govern- panies having a first-mover advantage to determine
ment. National legislatures typically make laws, while industry specifications (see chapter 6).
executive bodies develop implementing regulations. Institutional Review Boards (IRBs) monitor research
Enforcement of legal frameworks is undertaken involving human subjects, including impact evalua-
by independent regulators (such as data protection tions and other M&E efforts. They have the power to
authorities) and the judiciary. Nongovernmental approve, require modifications in (to secure approval),
actors could support enforcement by means of mon- or disapprove research. IRBs are mostly found in
itoring, advocacy, advice, and legal aid. In addition, high-income countries and are not yet a critical data
sector-specific regulators—such as telecommunications, governance institution in low-income countries. Yet
banking, and financial securities market regulators— their reviews have an important role in ensuring
could support sectoral rule making. For example, a responsible data use in research and protecting the
banking sector regulator could require banks to sub- rights and welfare of human research subjects, includ-
mit credit information to credit reference bureaus, ing those from low- and middle-income countries.
which, in turn, could increase access to finance for International organizations, academic institutions, and
those who may not be able to obtain bank credit in the CSOs can also help transform the principles of the
absence of credit reference bureaus.30 Similarly, secu- social contract into actionable guidelines for ethical
rities markets regulators could compel listed compa- data use. For example, they can help data science
nies to disclose financial data to assist investors in professionals and practitioners create ethical codes
their decision-making and thus improve the alloca- of conduct that are specific to their organization or
tion of resources across the economy (see chapter 6). stakeholder community. In 2017 the United Nations
Sector-specific standard setting organizations, such Sustainable Development Group—a consortium of
as the Extractive Industries Transparency Initiative 36 United Nations (UN) agencies, departments, and

programs—convened to develop a set of ethical guid- index and gross domestic product data. After reforms
ing principles to protect data privacy and to use big by Argentina’s NSO to address the methodological
data in development and humanitarian contexts.34 and data quality issues in question, the IMF lifted the
Likewise, the NGO DataEthics.eu, a collaborative censure on the country in 2016.
effort across academia and civil society, has developed At the national level, data protection authorities
a series of data ethics principles designed using a (DPAs) oversee and enforce compliance with data
European legal and value-based framework for volun- protection legislation by investigating data breaches
tary adaptation and use by European Union (EU) data and issuing monetary penalties, enforcement
providers, data intermediaries, and data users. notices, or other punitive measures when an organi-
zation is found to have breached its data processing
Institutions that enforce compliance obligations.40
Compliance can be enforced internally—that is, by Some DPAs have adopted a more principle-based
parties governed or affected by the rules at issue—or approach to compliance by encouraging data process-
externally by a third party. It can also be enforced ing organizations to embed accountability practices
informally35 through peer pressure or shaming or into their operations. For example, Singapore’s data
formally through official investigations, rulings, and protection commission, Infocomm Media Devel-
sanctions. opment Authority (IMDA), has adopted an enforce-
Informal institutional arrangements rely on ment framework that rewards good accountability
commitment-based and opt-in approaches whereby practices such as adopting data protection by design
parties are not obliged to undertake specific actions. and encouraging the use of data protection impact
For example, the United Nations Fundamental Princi- assessments through capacity building, change
ples of Official Statistics guide national statistical sys- management, and organizational restructuring.41
tems that self-govern according to these principles.36 This approach can be helpful in instances in which
Institutions with internal enforcement mecha- existing data protection laws do not yet require such
nisms can be effective because they typically feature practices, in parallel to strengthening the legal frame-
a recognized system of incentives and penalties to work. Other DPAs, such as the French National Com-
encourage desired behaviors. For example, EITI and mission for Informatics and Liberties (CNIL), provide
OGP have sanctioned or expelled member countries incentives for compliance by developing certification
when it was determined that these countries did not schemes for data protection officers in order to stan-
adhere to articulated standards.37 Both institutions dardize competencies within this compliance role.42
sanctioned Azerbaijan (EITI in 2015 and OGP in 2016), The presence of a DPA increases with country
and EITI delisted Equatorial Guinea and São Tomé income level (figure 8.4). Although 81 percent of
and Príncipe in 2010 for insufficient progress against high-income countries have a DPA, only 45 percent
agreed-on deadlines. In the latter two countries, this of upper-middle-income countries, 38 percent of
delisting catalyzed the expected action.38 lower-middle-income countries, and 24 percent of
Public pressure can also be brought to bear by low-income countries have such an authority.
NGOs that assess the quality of data governance and In certain contexts, an existing institution, such
monitor compliance with standards through public as an access to information agency or related ICT agency,
indexes or scorecards. An example is the Global Data may be tasked with compliance responsibilities. For
Barometer, which assesses the quality and scope of example, Argentina’s DPA falls under the country’s
countries’ data governance, availability of key data- Agency of Access to Public Information—a 2018
sets, and capacity for responsible data use.39 presidential decree modified the then-newly adopted
Transnational institutional arrangements have a Access to Information Law.
formal constitutional setup, such as Articles of An antitrust authority may find certain data prac-
Agreement, that obliges members to abide by specific tices anticompetitive (see chapter 7). It may break
standards or rules. They typically stipulate internal up an existing organization or its datasets when
compliance requirements and articulate what sanc- the organization has accumulated levels of control
tions apply to noncompliance. Censure is a typical that give it an unacceptable level of market power.
enforcement mechanism. An example of a transna- For example, a decision by Germany’s Federal Cartel
tional institution is the International Monetary Fund Office (Bundeskartellamt) prevented efforts by Face-
(IMF). In 2011 it found Argentina to be in breach of book to combine data from Facebook, Instagram, and
its obligations under the IMF’s Articles of Agreement programming interfaces integrated into websites
because it was providing inaccurate consumer price producing social plug-ins.43 Antitrust authorities are
Figure 8.4 The lower the country Figure 8.5 More than half of countries
income level, the fewer are the across all income groups have antitrust
countries with data protection authorities
authorities 80 75
90 68
81 70
64
80
60
Share of countries with

data protection authority (%)
70 52
antitrust authority (%)

Share of countries with
50
60
50 45 40
40 38
30
30 24 20 17
20 16 12
10
10 4
5 2
3 2
0
0
e
m
m
e
co
co
co
co
m
m
co
co
co
co
-in
in
in
in
e-
e-
h-
-in
in
in
in
dl
dl
ig
e-
e-
h-
Lo
w
id
id
H
dl
dl
ig
Lo
-m
r-m
id
id
H
-m
r-m
er
pe
w
er
pe
Up
Lo
w
Up
Lo
Planned Operational
In progress or planned Established
Source: WDR 2021 team calculations, based on data from World Bank. Data
Source: WDR 2021 team calculations, based on World Bank, DGSS at http://bit.do/WDR2021-Fig-8_5.
(Digital Government/GovTech Systems and Services) (dataset), https://
Note: Data are for 218 economies.
datacatalog.worldbank.org/dataset/digital-governmentgovtech-systems
-and-services-dgss-dataset. Data at http://bit.do/WDR2021-Fig-8_4.
Note: Data are for 198 economies.
Security Incident Response Team (CSIRT) is a designated
team of information security experts. It protects data
operational in more than half of countries across all management architecture and detects and resolves
income groups (figure 8.5). any computer, network, or cybersecurity incidents,
Formal independent audits—or the possibility such as data breaches and denial of service attacks.46
of one—can also be an effective mechanism to hold CSIRTs and related institutions are also typically
institutions to account and drive performance responsible for running public awareness campaigns
improvements. Audits are typically performed by an aimed at data intermediaries and users to help ensure
audit body, whether an independent Supreme Audit adherence to data security protocols. Cybersecurity
Institution, a committee (such as a parliamentary agencies are relatively widespread in middle- and
Public Accounts Committee), or a specialized sub high-income countries, but are present in only 24 per-
national department (such as a city audit office).44 cent of low-income countries (figure 8.6).47
Likewise, courts provide a venue for independent
redress and enforcement, and they can also facilitate Institutions that promote learning and
informal settlement. A centralized or decentralized evidence-based policy making
ombudsperson may be able to collect complaints and M&E functions, as well as anticipatory governance,
provide redress for grievances. In some countries, can be embedded in dedicated units in ministries
data protection legislation explicitly provides for and agencies involved in data management and
grievance redress.45 In countries with no such legis- governance functions. Some countries may have a
lation or where existing legislation makes no such national-level M&E agency, such as the US Government
provision, service providers may set up specific Accountability Office (GAO), which is responsible for
grievance redress mechanisms to collect and address auditing and evaluating US federal government activ-
complaints internally. ities. Other countries may locate their M&E unit within
Oversight is also needed to minimize risks to data an executive office responsible for tracking strategic key
platforms, data systems, and data per se. A Computer performance indicators.

Figure 8.6 Only about one-quarter policy making.48 In 2017 the UK’s British Academy and
of low-income countries have Royal Society published a series of reports entitled
cybersecurity agencies “Data Management and Use: Governance in the 21st
Century,” based on consultations with stakeholders
100
Share of countries with cybersecurity agency (%)
from civil society, the private sector, and academia.49

90 86 Nongovernmental institutions can also help generate
80 learning and evidence on potential opportunities and
harms when developing social contracts on data in
70 66 65
different contexts. Some institutions are devoted to
60 understanding the ethical implications of new meth-
50 odologies and uses of data.50 Others focus on sharing
knowledge and acting as a catalyst for learning.51
40
To undertake learning and evidence activities, gov-
30 24 ernment institutions and other actors must rely on a
20 14 15 workforce with the appropriate skills, which requires,
12
in turn, more public or private institutions specializing
10 6
in skills development and certification (see chapter 4).
0 This need grows more pressing as data governance
and management become increasingly sophisticated
e
e
m
m
co
co
co
co
and the number and range of technicians and skills

-in
in
in
in
e-
e-
h-
w
dl
dl
ig
required increase.
Lo
id
id
H
-m
r-m
er
pe
w
Up
Lo
In progress or planned Established Data intermediation and

collaboration
Source: WDR 2021 team calculations, based on World Bank, DGSS
(Digital Government/GovTech Systems and Services) (dataset), https:// Another way to enable better data use, reuse, and
datacatalog.worldbank.org/dataset/digital-governmentgovtech-systems
-and-services-dgss-dataset. Data at http://bit.do/WDR2021-Fig-8_6. sharing is through data intermediation. An entity
Note: Data are for 198 economies. (data intermediary) or simply a contractual arrange-
ment facilitates the collection, validation, and aggre-
gation of data from data contributors and makes data
Outside of government, CSOs, specialty NGOs, uni understandable, usable, and accessible to data users.52
ver
sities, think tanks, research organizations, the news Data intermediaries can facilitate data sharing in a
media, and even individual citizens play an important trusted, more efficient manner between government
M&E role. Nongovernmental monitoring of issues institutions or between government and nongov-
of public concern can be useful in assessing govern- ernment actors as part of the broader national data
ment performance, as well as signaling accountability system (table 8.3).
failures, such as corruption or inefficiencies or gaps Data intermediaries (sometimes called infomedi-
in public service delivery. For example, during the aries) can be important enablers in low- and middle-
COVID-19 pandemic Johns Hopkins University in the income economies that may have gaps in their
United States recognized and filled a gap by creating data management frameworks or weak enforcement.
and launching a transparent, reliable data collection Where the potential of otherwise siloed data would
mechanism and dashboard for tracking virus cases remain unrealized,53 they can mediate data flows
globally. The mechanism was then used by policy between data producers and individuals or communi-
makers and the public worldwide to better understand ties for research and evidence-based policy making,54
the spread of the virus and come up with ways to com- or they can provide public sector institutions with
bat it. Such nongovernmental, independent actors can feedback.55 Grassroots-based data intermediaries
provide convenient and consistent access to accurate could also help individuals better understand and
data and reduce data governance and management enforce their rights over their personal data. Other
inefficiencies, while offering a host of actionable intermediaries create commercial opportunities
perspectives and advice. For example, the Data Gover- through data markets.
nance Network is India’s first policy-oriented research Data intermediation in the private sector. Exclusively
network on data governance, bringing together sev- commercial, for-profit data intermediaries are rela-
eral leading think tanks. It was founded to inform tively commonplace, functioning primarily as data
Table 8.3 Snapshot of common data intermediary structures
Purposes Objectives Types Examples
Create commercial value Transform raw data into more Data aggregators, data Acxiom, Experian
and data markets. consumable information. brokers
Exchange data to solve Increase incentives for Data pools Global Data
public problems through competitors to share and Synchronization Network
collaborative structures. combine data resources for (GDSN)
common use within sectors.
Create and manage shared Data commons, data The Open Commons
and interoperable data assets clubs Consortium (OCC),
and computing infrastructure UK Biobank
for research.
Contribute data in exchange Data cooperatives LunaDNA (community-
for collective benefits. owned platform for
health research)
Enable trusted sharing Facilitate sharing of sensitive Data trusts Platform Info Exchange,
and use of sensitive data and provide collective UK (Mozilla Data Futures
data through enhanced bargaining power to Lab pilot)
accountability mechanisms. individuals.
aggregators. These intermediaries collect raw, disag- companies, research institutions, or CSOs—that come
gregated data that are difficult to work with, system- together to exchange data with a view toward solv-
atize and sometimes analyze them, and then repack- ing public problems.59 Data sharing arrangements60
age them for sale to others. Many commercially could, but need not, involve the creation of a separate
driven data aggregators are familiar features of soci- entity tasked with managing data, including ensur-
ety, including credit reference bureaus. More broadly, ing safe and ethical usage.
data brokers scrape public records and buy or license Some data collaboratives function primarily to
private data to build profiles of individuals that can be increase participants’ access to data in order to solve
sold for a profit—often for marketing purposes, risk collective action issues and use insights from ana-
mitigation (including for identification verification lyzing aggregated, nonrivalrous data. Data pools are
and fraud detection), and people search pages.56 Some usually contract-based mechanisms in the private
4,000 data brokers operate worldwide in an industry sector that create a centralized repository of data.
valued at US$250 billion.57 Participants can obtain, maintain, and exchange
Data markets are passive digital platforms through information in a standard format.61 The Global Data
which data owners can offer their datasets for sale. Synchronization Network (GDSN),62 an internet-
When structured well, data markets can enable based, interconnected network of interoperable data
crowdsourcing of data (including from data subjects), pools, facilitates product-related data sharing across
support interoperability, create a central point of dis- companies in sectors such as retail, health care, and
coverability, and enforce minimum data quality stan- transport and logistics. In the private sector, data
dards.58 Rising concerns about the use (and abuse) of pools create unique opportunities for market insight,
personal data by profit-driven data intermediaries— gains in efficiency, and innovation because of their
particularly given the rise in locational data and the tailored analytical function, although they also
ultimate anonymity of data, as well as data subjects’ present competition risks (see chapters 6 and 7).63
lack of control—have increased public scrutiny and In the public sector, data pools can be used to safe-
led to new rules on their operations (box 8.3). guard centralized data stores. Mauritius has built
Data intermediation for public or common goods. New trusted digital data repositories using unique digital
types of intermediaries oriented toward public or identities, federated authentication, and a set of key
common goods are emerging. Data collaboratives digital services that can be embedded in wider public
facilitate and promote data sharing between diverse or private sector applications when data sharing is
actors by ensuring compliance with minimum data required.64
protection and security rules, as well as quality stan- Data commons and data clubs, broadly inspired by
dards and rules to make data interoperable. data pools, may help entities or people create, curate,
Data collaboratives can involve a diverse array maintain, and analyze shared data assets to create
of actors—such as government institutions, private an evolving, interoperable resource for the research

Box 8.3 Increased scrutiny of and constraints on private data
intermediaries
Although for-profit data intermediaries have historically and to whom they are selling data.d Both states require
operated with little public awareness of their practices data brokers to abide by certain minimum data security
or even existence, society’s growing unease with the standards.
private collection and sale of personal data, often In Europe, Privacy International, a European civil
without the consent of data subjects, has led to greater society organization (CSO), filed complaints in 2018 with
regulatory scrutiny in recent years.a The vast amount of the data protection agencies of France, Ireland, and the
locational data being collected by companies via smart- United Kingdom alleging that seven data brokers, credit
phone apps and then repackaged for sale to advertisers, bureaus, and ad-tech companies were violating individ-
financial institutions, geospatial analysis companies, and uals’ privacy rights under the European Union’s General
real estate investment firms, among many others, raises Data Protection Regulation (GDPR).e The complaints
additional concerns about the ultimate anonymity of claim that the companies in question build intricate,
data.b Locational data become especially valuable when potentially inaccurate profiles of peoples’ lives based
they are combined with a mobile advertising ID, which in part on derived, inferred, and predicted data used as
allows advertisers and other businesses to integrate personal data, inconsistent with protections provided
activity across apps. under the GDPR’s Data Protection Principles. CSOs and
The United States issued a high-level government governments are likely to increase their scrutiny with
report in 2014 recommending federal legislation that the spread of data broker activity, particularly if gov-
would subject data brokers to heightened governance ernments are perceived as failing to respond to citizens’
rules around data security, transparency, and the degree concerns through stronger regulation and enforcement.
of control held by data subjects.c Although no federal
legislation has been passed, the state governments of
a. Ram and Murgia (2019).
California and Vermont have adopted laws requiring b. Thompson and Warzel (2019).
data brokers that collect and sell information about the c. FTC (2014).
d. For California, see Assembly Bill No. 1202, An Act to Add Title 1.81.48
residents of these states to register annually with the (Commencing with Section 1798.99.80) to Part 4 of Division 3 of the Civil
state government. Neither state has gone so far as to Code, Relating to Privacy (Legislative Counsel’s Digest, October 14, 2019).
See also Attorney General’s Office, California Department of Justice,
give data subjects the right to opt out of data collection “Data Broker Registry,” Sacramento, https://oag.ca.gov/data-brokers.
and trading (although the Vermont law does require For Vermont, see Vermont Office of the Attorney General (2018). See
also Vermont Secretary of State, “Data Brokers,” Montpelier, https://sos
detailed disclosure of such procedures), nor has either .vermont.gov/corporations/other-services/data-brokers/.
required data brokers to disclose what data they collect e. PI (2018).
community.65 The Open Commons Consortium (OCC), existing public policy and service delivery, especially
a US nonprofit, operates data commons and cloud where the technical capacity to run the required sta-
computing infrastructure to support research related tistical analyses is lacking.
to scientific, environmental, medical, and health care Somewhat similarly, data cooperatives usually
issues.66 Since 2009, the OCC has managed the Open involve individuals who choose to contribute their per-
Science Data Cloud (OSDC), a membership-based, sonal data (while retaining ownership) in exchange for
multipetabyte science cloud that colocates scientific collective social and personal benefits, such as research
data with cloud-based computing, high-performance using larger common data that would otherwise be
data transport services, and common analytical tools. siloed or inaccessible.68 The objectives are generally
UK Biobank aggregates the health data of more than nonmonetary. For example, patients with specific
500,000 individuals from the United Kingdom and health conditions might contribute their health
makes it available to any “bona fide researcher” in records to a cooperative that makes them available for
the world.67 Making public intent data available in a medical research. LunaDNA is a community-owned
similar manner across government, and between gov- platform for health research that anyone can join,
ernment and the private sector and civil society, can share their health data, and in exchange receive own-
promote evaluation and learning activities around ership shares in the organization.69
Data intermediaries with built-in accountability However, examples are beginning to be piloted,77 given
mechanisms can facilitate sharing of sensitive data, growing interest in such mechanisms to promote
including between the public and private sectors.70 accountability and rebalance collective bargaining
The role of these intermediaries can be played by powers between data providers and users. In coun-
individuals or legal structures that are positioned tries with an enabling legal system, data trusts can
between data contributors and users and provide create unique opportunities in low-capacity contexts,
independent third-party stewardship of data.71 In and especially in countries with weak data protection
the context of public-private partnerships, they may legislation and enforcement. Certain countries and
be more effective if they are located outside gov- organizations have taken a broader definition of data
ernment. But they can also be governed by public trusts (which creates an accountability role without
institutions tasked with safeguarding and facilitat- necessarily imposing a strict fiduciary duty) to pilot
ing data sharing across government. For example, their effectiveness in practice. Such structures have
India’s 2020 “Report by the Committee of Experts on been explored for use in the fight against illegal
Non-Personal Data Governance Framework” iden- wildlife poaching in lower-middle-income countries
tifies the Ministry of Health and Family Welfare as by the UK government. WILDLABS is a community
the appropriate trustee for data on diabetes among working to discover and implement technology-
Indian citizens.72 enabled solutions to conservation challenges, and the
Certain forms of these intermediaries are emerg- Open Data Institute (ODI), a London-based nonprofit
ing in some jurisdictions, to support the protection of organization, is creating more open and trustworthy
transactions involving personal data. In India, pursu- data ecosystems. These arrangements are a low-cost,
ant to draft legislation similar to the European Union’s secure means for the conservation community to
General Data Protection Regulation, third-party con- collect and share data, while overcoming shortcom-
sent managers ensure that individuals are consenting ings in local laws and enforcement, as well as limited
to every instance of data sharing rather than “preau- resources.78 Data trusts or other contractual data
thorizing” data processing and sharing at the point sharing structures can also facilitate cross-border
of collection. The Reserve Bank of India has already data transfers, especially where international data
introduced these standards across the entire financial sharing agreements do not exist. The Microsoft Intel-
sector. A data trust, a unique type of accountabili- ligent Network for Eyecare (MINE), a collaboration
ty-based data intermediary, is based on the legal struc- between Microsoft India and India’s L V Prasad Eye
ture of a “trust,” and as such imposes a fiduciary duty Institute, facilitates the transfer of patient data from a
on trustees.73 Trustees are legally required to steward diverse range of countries to the United States, where
data with impartiality, prudence, transparency, and participating research institutes then use advanced
undivided loyalty toward the trust’s beneficiaries, and analytics and machine learning to inform the devel-
in accordance with the trust’s internal rules of gover- opment of strategies to prevent avoidable blindness
nance.74 Depending on the context, additional rules and scale delivery of eye care services worldwide.79
governing data access and use, as well as internal lia-
bility mechanisms for data breaches or misuse, can be
Making data governance
tailored accordingly through contractual agreement.
One of the alleged benefits of data trusts is that they
institutions eﬀective
offer individuals and groups a means of restoring No matter the country context, institutions can only
“bottom-up” control over personal data: individuals carry out their roles effectively if their staff are capa-
can pool the legal rights they have over their personal ble of and willing to use good data to undertake their
data within the framework of the trust and negotiate core operations, inform policies, and deliver services
with larger data “controllers” from there.75 (figure 8.7). Countries that have made great strides in
Data trusts may be particularly useful in managing improving data governance implementation across
personal health data in the context of COVID-19 con- the whole of government have typically benefited
tact tracing in which deidentified data on test results from the leadership of a strong political champion of
can be shared (with data protection safeguards) and the importance of data.
used to alert other individuals if they are at risk of
infection.76 Data trusts can also support the respon- Increasing technical capacity, resources,
sible collection and reuse of sensitive health data to and data literacy for civil servants
support academic research or public health monitor- The cognitive challenges posed by data are unlike
ing. Data trusts are still largely theoretical constructs. those of most other commodities in terms of

Chapter 8_Figure 3
Figure 8.7 Features of well-functioning institutions for eﬀective data governance
Performance- Coordination Leadership Multistakeholder governance

enhancing Create incentives to encourage Mobilize data champions in Sustain outcomes through inclusive
collaborative and user-centric positions of power to create a and legitimate stakeholder
environment decision-making. culture of data sharing and use. engagement.
Transparency Functional autonomy Data literacy

Build trust by promoting Promote institutional Invest in increasing technical
participation and independence and autonomy capacity, resources, and data
accountability in policy for effective performance. skills for civil servants.
making.
understanding the scale and complexities of (poten- tasks require cooperation between data specialists
tial) use. Governing data thus requires a strong (such as data officers and IT staff) and technical staff
technical capacity and investments in human capital in sectoral or cross-cutting entities.
development for those who collect, process, analyze, Public sector training institutions may have the
and use data to support evidence-based policy mak- requisite organizational role and resources to support
ing, core government operations, and service deliv- the development of specialized training courses.84
ery.80 Investing in technical capacity is also essential Where local resources are lacking, or to further
when regulating data-driven businesses (see chapter bolster domestic capacity, international nonprofit
7). The public sector will need resources to meet the institutions could provide up-to-date, standardized
increasing demand for data analytics and informa- training programs in collaboration with entities that
tion technology (IT) skills (see chapters 4 and 5), espe- traditionally train civil servants. These programs
cially with the shift to digital government. could be specific to certain areas or sectors, such as
Data literacy, which refers to an individual’s capac- the multijurisdictional training and certification on
ity to “read, work with, analyze, and argue with data,” data protection of the International Association of Pri-
is particularly weak in government institutions in vacy Professionals (IAPP) or the Open Data Institute’s
low- and middle-income countries.81 Skilled staff may training to support open government data. Other
be concentrated in ministries of finance or planning, organizations provide more tailored training to meet
as well as in entities responsible for the production user needs, such as that by the GovLab Academy85 or
and quality of statistics, such as NSOs. Strict salary Apolitical.86 Certification schemes can help support
scales and wage caps within most public sector enti- compliance by harmonizing training requirements.
ties affect their ability to compete with the private Institutions should also ensure that human
sector in recruiting specialized staff. resources and staffing needs are planned for and
Building data literacy requires investing in train- managed through national capabilities plans or other
ing to develop a range of technical competencies in instruments. Institutional mandates and staff terms
data collection, management, and interpretation of reference should be redefined to incorporate data
across the data life cycle, including data protection governance functions and prescribe standardized
and security.82 Training also should empower civil guidelines for handling data properly.
servants to examine data for inaccuracy and bias and Chapter 9 discusses how, beyond the public sec-
to contextualize data, including through effective tor, governments should invest in programs to build
visualization and communication techniques.83 These data literacy within the broader population to reduce
the digital divide and empower people to use data to society and private sector organizations to identify
improve their lives. challenges and prioritize key drivers of change.94
In Tunisia, the government’s decision to adopt a col-
Creating a culture of performance that laborative leadership approach to drafting its latest
supports a data-driven public sector open data decree was an important shift from its
Even when institutions have the necessary technical previously unsuccessful efforts that had resulted in
infrastructure and de jure frameworks, shifting pol- siloed and fragmented initiatives and limited results.
icy makers away from traditional and often siloed By convening more than 50 officials from across the
decision-making toward data-driven and coordinated Tunisian public administration and several CSOs,
policy design and implementation depends on creat- the government was able to gather diverse views on
ing the right incentives. These incentives are a com- the best-fit options to include in the decree.95 This
bination of institutional management practices and collaborative process was led by a unit in the Prime
cultural norms that are especially relevant to low- and Minister’s Office, thereby endowing the effort with
middle-income countries, where reform efforts are high-level support and ownership.96
often stymied by “implementation gaps” resulting Deploying effective communication and dissemination
from behavioral and political economy constraints. strategies to increase actual and perceived transparency and
Research conducted in Ghana finds that innovation promote trust in the process. In environments character-
in public agencies with fixed hierarchies may partly ized by low levels of trust, effective collaboration may
constrain innovation by impeding the acceptance of have to begin by addressing underlying conflicts.
ideas from subordinate civil servants.87 At the organi- Such a process can generate creative solutions and
zational level, institutional fragmentation, the large important trade-offs.97 Perceived increases in trans-
transaction costs of information sharing, and budget- parency and accountability, including diverse repre-
ary allocations can create incentives to restrict access sentation in stakeholder groups, are key to fostering
to data or keep data siloed.88 trust.98 Communication is also essential to support
Investments in change management and other enforcement of rules in novel situations. For exam-
techniques are essential to increasing the buy-in to ple, during the COVID-19 pandemic guidance from
and impact of data governance reforms.89 These tools the European Commission and the European Data
should be deployed within a strategy of change man- Protection Board99 helped national data protection
agement that is adapted to the organizational culture authorities, governments, businesses, and civil soci-
of an institution90 and broader political economy ety stakeholders understand how to build interoper-
considerations.91 able data sharing efforts and technologies (such as
Mobilizing “data smart” political champions who view privacy-preserving contact tracing applications) for
data as foundational. Strong political champions or a health monitoring and policy making while comply-
political culture that appreciates and understands ing with the GDPR.100
the value of data are critical to ensuring the effec- Creating incentives and reward mechanisms that
tiveness of change management reforms. Countries encourage innovation and coordinated decision-making in
at the forefront of leveraging greater value from the public sector.101 Salaries and bonuses can be effective
data through better data governance frequently have incentives or rewards, but in low-capacity environ-
strong advocates of the value of data in positions of ments where funds are restricted, awarding prizes
power. Estonia, with its decades-long history of lead- or other monetary incentives can incentivize collab-
ership by data advocates, has invested in improving oration and performance in the public sector.102 In
the data science skills of the general public.92 As a Morocco, since 2015 the Ministry of Economy, Finance
result, it is the first country to allow online voting and Administrative Reform has awarded the annual
in its general elections, and essentially all public ser- e-mtiaz prize to support competition between pub-
vices are available online. lic sector entities and service providers in adopting
Adopting a collaborative leadership approach to innovative tools and services that improve the quality
decision-making. Collaborative leadership is a central of public service delivery through e-administration,
feature of effective change management. Leaders including the development and use of e-services.103
seek a diversity of opinions and ideas among team- A data-driven culture can also be supported
mates in building strategies and solving problems.93 through “hackathon” initiatives and competitions in
Governments can benefit from collaborating with which data users are encouraged to collaborate for a
the relevant entities across the public sector and short period of time on a project. In 2019 the Tunisian
with nongovernmental stakeholders such as civil Court of Accounts organized a “Hack 4 Transparency”

event to support objectives that included collecting, Formal independence has legal, financial, and
processing, exchanging, mining, and analyzing pub- administrative dimensions. Legislation can define
lic financial data; improving communication with roles and responsibilities and establish formal protec-
external stakeholders; and improving transparency, tions. It may be necessary to establish a legally auton-
accountability, and participation in the use of public omous institution with formally delegated authority,
funds. The winners of the five regional hackathons especially for regulators, oversight institutions, and
and the subsequent national final received cash NSOs.109
prizes offered by the private sector.104 Financial independence relies on institutional
funding free from day-to-day political or private influ-
Promoting institutional independence and ence. Such independence can be supported by putting
autonomy for better performance in place the appropriate procedures for proposing
De facto autonomy—defined as the actual scope of and approving budgets. In Ethiopia, the Philippines,
independent decision-making powers and influence and Rwanda, NSOs are authorized to formulate their
over (and protection from) other institutions in the own budgets flexibly, based on the demands made on
governance system105—is critical to institutional per- them through national development plans and other
formance and successful implementation of policies routine activities in the statistical system, such as
or legal frameworks. periodic censuses. Providing funding on a multiyear
Within institutions, performance depends on staff basis rather than every year can increase stability and
having sufficient autonomy to make informed, inno- protect institutions from short-term political change.
vative decisions.106 Independence may also be import- Institutions may also be able to raise funds directly
ant to ensure the integrity of the data processed by through licensing fees, enforcement penalties, and
an institution. Identification agencies that process administrative charges.110
personal data, including potentially sensitive data, Administratively, key positions may be politicized
about the population and the various services and by the executive or be vulnerable to state capture and
benefits they receive should be able to resist undue corruption. Independence may be enhanced by estab-
access to this data by those who might misuse it. lishing precise, transparent criteria for selecting and
Similarly, NSOs that produce reliable, objective data appointing qualified leaders. Candidates should be
for public policy making and administration must required to disclose conflicts of interest.111
not be swayed by political interests that may wish to
downplay, distort, or conceal inconvenient statistics. Achieving better coordination across
Beyond incentivizing performance, institutional inde- institutions for better data governance
pendence and autonomy can strengthen accountabil- Coordinating for better data governance. Coordination
ity mechanisms in the data ecosystem. Performance across institutions helps prevent siloed or uneven
reporting and audits are more trustworthy when they application of data governance functions based on
are conducted by impartial institutions. opportunities and capacity. Coordination can ensure
An institution may operate with significant de that data governance processes, such as technical
facto (actual) independence regardless of its de jure standards, rules and means of audit, remedies in case
(formal) status.107 Nonetheless, public sector institu- of noncompliance, and M&E frameworks, are consis-
tions often require de jure independence so they can tently applied and, where relevant, can identify emerg-
undertake the activities falling within their mandate. ing areas for action. Useful outputs could include
The need for institutional independence is critical guidance notes or technical manuals that provide
when both government and nongovernment entities detailed instructions on how to harmonize knowledge
are regulated within the same framework and com- and implementation efforts across institutions.
petitive neutrality is required. It is also critical when Successful coordination depends at the outset
decisions can have a significant impact on interests on clearly allocating and delineating the roles and
and actual and perceived impartiality in the execution responsibilities of data governance institutions.
of governance functions is needed.108 Entities playing Institutions or individuals tasked with coordination
a rule-making or compliance function, such as DPAs, should then create robust processes to guide and gov-
regulators, audit institutions, and courts or indepen- ern their interactions and track their efficacy. Coordi-
dent ombudspersons, need to be formally indepen- nating entities should also be sufficiently empowered
dent in order to effectively oversee compliance of by high-level leadership to effectively undertake this
other entities and to provide an impartial venue for role. The structure and formality of coordination
redress and remedy. mechanisms will vary. Some countries have chosen
to designate a central coordinating institution or delivery through administrative simplification and
individual located within the executive. In Alba- shared services.
nia, the Albanian National Agency for Information
Society is under the direct supervision of the Prime Ensuring the transparency and
Minister’s Office. France has taken a similar vertical accountability of public sector institutions
approach. The chief data officer (administrateur général To encourage the transparency and accountability of
des données) works directly under the authority of the data governance institutions, policy makers should
prime minister. Centralizing coordination responsi- offer opportunities for scrutiny and input. Public
bilities and oversight in this way facilitates a strong consultation and inputs on the design of policies
hierarchy with direct supervision entities that review, and laws and regulations can support transparency
revise, and approve plans and initiatives from subor- and stakeholder engagement.116 Institutions should
dinates and oversee their implementation.112 be required to publish and review their objectives
In other contexts, horizontal coordination mech- and performance indicators during regular planning
anisms may involve networks of “peers” at the same cycles. Peer-to-peer scrutiny can be enhanced through
functional or hierarchical level.113 These types of formal processes or technical working groups,
coordination are often carried out by interagency depending on the institutional culture and needs.117
committees or working groups. In the United States, In addition to regular review procedures, institu-
24 government agencies are required to designate an tions could open their records and reports for review.
employee (civil servant) who is not a political appoin- In some cases, audit by independent third parties,
tee as their chief data officer. The officer is charged including NGOs, using international standards and
with convening and coordinating agency data gov- benchmarks with a view toward identifying areas
ernance and interagency coordination.114 Chief data of underperformance or noncompliance, may incen-
officers coordinate with one another through the tivize institutional accountability. The transparency
Chief Data Officers Council. They also coordinate of such processes is enhanced if the results of the
with other government councils that conduct data- audit are shared with the public through either pub-
related activities.115 lications or public hearings. Public knowledge and
Because of the cross-cutting nature of data review of the performance of institutions are critical
governance and the scale of the challenge, stake- to building and maintaining confidence and trust in
holders would benefit from a range of coordination data governance institutions. Civil society’s role in
mechanisms to leverage their relative strengths and supporting trusted data use and reuse is also reflected
reinforce one another. Centralized coordination can in newer forms of community-led data governance
reduce transaction costs, compared with the more and oversight mechanisms. For example, the UK’s
horizontal approaches to coordination, although Connected Health Cities project in Manchester con-
consolidating too much power in a single entity can venes a “citizens’ jury” to hear expert evidence before
heighten the risk of mismanagement and abuse. approving an approach for the project.118
Coordinating for better data use. Ministries and When institutions prioritize datasets for publica-
government agencies collect, manage, and use data, tion on an open data platform, stakeholder input in
whether in the form of tax returns, the outcomes the process can ensure that priorities are based on
of social or business programs, research, fuel con- user demand rather than on government preferences
sumption statistics, health data, immigration flows, or judgment alone. Greater transparency and collab-
geospatial maps, land management results, or crop oration could increase the use of open data by non-
inventories. However, data management platforms governmental actors, which, in turn, could increase
across ministries are often limited and lack unified research and advocacy opportunities, as well as inno-
interoperability standards, leading to duplication in vation and private sector development.
data production and IT procurement. These issues
may be compounded by a broader culture of rivalries Sustainable outcomes through
and lack of collaboration within the public sector.
inclusive multistakeholder
As a result, data generated in the public sector may
be consigned to data wastelands, captured in siloed
governance
repositories and platforms. Adherence to established As the digital economy has expanded globally, an
norms and standards and efficient use of shared increasingly complex, geographically diverse group
digital platforms to integrate and share data can of stakeholders has become active in the data eco-
improve government efficiency and public service system. However, traditional concepts of governance

based on national sovereignty or strict multilateral- (ICANN). Although they differ in structure, both orga-
ism do not take into account these dynamics. A multi nizations are constituent-driven, developing their
stakeholder approach to data governance is better governance processes and outputs using a bottom-up,
equipped to govern the complex data ecosystem in participative approach. Meaningful participation of
a transparent, inclusive, and distributed way, which civil society and other nongovernmental groups is
reflects the interests of all key stakeholders. This assured through their inclusion in formal decision-
approach is aligned conceptually with the successful making structures.127
application of multistakeholder processes designed Like stakeholder roles, the type of forum designed
to govern the internet.119 And it is an essential com- to host multistakeholder governance processes
ponent of the “trust framework” that strengthens should be purpose-driven. Concerns about restrict-
the social contract around data use. It will be espe- ing access to commercially sensitive or confidential
cially important as data governance shifts toward data and processes may at times limit participation
international harmonization of policies, rules, and to members. Other issues, particularly those of soci-
standards. etal importance such as the use of facial recognition
“Multistakeholderism” is an approach to data gov- in the public sector, may require unrestricted forums
ernance, not an end in itself. It is intended to facilitate for debate.128
better, more sustainable outcomes by enabling all For all its advantages, the multistakeholder
stakeholders to undertake their roles in a coordinated approach poses various challenges. Self-regulation
manner.120 These outcomes include ensuring more frameworks, including voluntary codes of conduct,
robust and flexible data governance frameworks developed through multistakeholder processes are
that respond to the pace of technological change121 effective only if strong domestic enforcement mech-
and improving the transparency and legitimacy anisms are in place.129 Even for a consensus-based
of and buy-in to the process (see box 8.4).122 More and stakeholder-driven rule-making process, weak
broadly, this approach can contribute to achieving enforcement and outcomes may reduce stakeholder
a more equitable distribution of the value of data, buy-in. In addition, legitimacy and buy-in may suf-
as well as protection from any harm arising from fer if the process is merely consultative rather than
data misuse.123 More equitable distribution emerges using stakeholders’ inputs to shape outcomes. Mean-
when traditionally excluded groups—including lower- ingful participation of underrepresented or margin-
middle-income countries, small and medium enter- alized groups can be difficult, particularly for new
prises (SMEs), CSOs, and indigenous peoples—are market entrants such as start-ups or SMEs, smaller
able to participate and benefit from the technical CSOs and NGOs, or indigenous peoples.130 Barriers
expertise in these forums (see spotlight 8.2). to effective multistakeholder participation can also
A continuum of multistakeholder arrangements.124 be found in international data governance arenas.
Although some areas of data governance (such as Lower-middle-income countries may find it difficult
setting standards for interoperability) may accommo- to participate as co-designers or “standard setters”
date or even require a more deliberative, consensus- and find themselves limited to being “standard-
based approach dominated by technical experts, the takers” (see chapter 7).131
development of policies and laws and regulations Finally, stakeholders need to guard against use
will inevitably involve some form of top-down, final of the multistakeholder approach by government
decision-making by a government agency or a regu- and others to legitimize top-down decision-making
lator (such as developing mechanisms to ensure data that leads to an accumulation of power. Where
security, which may need to be centralized).125 In such accountability mechanisms are lacking, the multi
cases, nongovernmental actors may play more of a stakerholder approach can be misused to exclude
nonbinding consultative role, providing inputs in the other parties (whether in the public or private sector
policy-making or rule-making process.126 These actors or civil society).132 Designing inclusive forums and
will have an important role to play in developing “soft accountable processes and earmarking resources to
law” mechanisms (chapter 6), research, training, and enable the participation of traditionally underrep-
advocacy. resented stakeholders will be key to the success of
Leading successful examples of multistakeholder such processes. Creating bottom-up approaches to
initiatives that develop technical standards for inter- data governance designed around multistakeholder
net (and increasingly data) governance include the engagement can help realign power asymmetries and
World Wide Web Consortium (W3C) and Internet improve contestability in the current social contract
Corporation for Assigned Names and Numbers on data (see box 8.4).
Box 8.4 Building multistakeholder data governance into smart city
initiatives through “digital democracy”
Smart cities combine sensors and other technologies retain control over their data and their personal data are
with physical infrastructure and services to enhance safeguarded.e Barcelona’s City Council partnered with
the lives of their residents.a Investments usually target the city’s digital democracy platform to publish data
sectors and services such as transportation, utilities, collected by sensors and other means on the Decidim
and law enforcement. Meanwhile, public-private part- platformf to promote transparency and accountability in
nerships are often used to leverage the technical and decision-making.
innovation capability of the private sector by outsourc- In Belgium, Ghent has developed a collective gover-
ing infrastructure and data management.b Because these nance model. In its “City of People,” citizens can create
initiatives involve the continual collection of personal or online profiles on the platform Mijn Ghent (My Ghent),
nonpersonal data from embedded sensors,c governance which they can use to access public services such as
structures are needed to ensure that the data collected libraries and child care.g
from citizens are used responsibly for public intent rather Such digital democracy platforms have been repli-
than commercial use and that residents retain control cated in lower- and middle-income countries. For exam-
over their data. The need for robust data governance in ple, Morocco’s Fikra e-participation platform collects
this area will become more acute as the uptake of smart citizen feedback and generates community-driven ideas
cities increases against a backdrop of growing urbaniza- to improve public service delivery.h
tion worldwide.d
More inclusive decision-making about data collection a. Maddox (2015).
b. Copenhagen has created a public-private partnership with Hitachi
and use is being facilitated by bottom-up models of col- to assess how to monetize datasets. Abu Dhabi has partnered with a
laboration. Barcelona was one of the first cities to lever- Swiss telemedicine company to improve health care. And Singapore’s
Smart-Nation initiative is relying on a network of start-ups to provide the
age the analytical opportunities of the Internet of Things government with technology and data-driven services. See MGI (2019).
(IoT) and combine datasets to improve evidence-based c. Scassa and Vilain (2019).
d. According to Cisco Systems, more than 60 percent of the world’s popula-
policy making and service delivery. And it was one of tion will live in cities by 2050. See Mitchell et al. (2013).
the pilots for the European Union’s DECODE initiative. e. See DECODE, “Giving People Ownership of Their Personal Data,” Barce-
lona, https://decodeproject.eu/.
DECODE is exploring how to build data-centric digital f. See “Construïm la Barcelona que volem!” decidim.barcelona, Barcelona,
economies in which data generated and gathered by https://www.decidim.barcelona/.
g. Tannam (2018).
individuals, the IoT, and sensor networks are made avail- h. See e-Government Program, Kingdom of Morocco, “e-Participation Plat-
able for collective use, while making sure that individuals form: FIKRA,” http://www.egov.ma/en/e-participation-platform-fikra.
Assessing the institutional and processing, and technical capabilities in the

public sector are generally uneven. At best, certain
foundation through the lens of a
“islands of excellence” may be using data effectively
maturity model for decision-making or service delivery on an ad hoc
Recommendations for improving the institutional basis, but without a clear strategic orientation or
foundations of data governance at the national level executive-level leadership of the data governance
can be tailored to a country’s current level of insti- agenda. As a result, duplication of data is common,
tutional development. Based on the maturity model interoperability infrastructures are lacking, and the
introduced in chapter 1, recommendations for assess- institutions needed to ensure the security, integrity,
ing and improving institutions are presented in the quality, and protection of data are minimal.
sections that follow. Countries should begin by establishing a baseline
for assessing the capabilities of the existing institu-
Establishing fundamentals tions to facilitate the secure generation and flow of
Any gaps and weak links in a country’s institutional data among all data producers and users (recognizing
arrangement for data governance will be revealed that many actors are both producers and users of
by first taking stock. In many countries, especially data). This analysis should be purpose-driven, with
lower-income ones, infrastructure, data collection a view toward understanding the activities already

taking place—either inside or outside of govern- enforcement remain weak and fail to address the con-
ment—that may be development opportunities, cerns of data owners and data subjects. At the same
along with the risks. The analysis should distinguish time, institutional arrangements should be developed
between the stated function of institutions and what to encourage and enforce compliance with rules
they actually deliver. As one example, the African established to promote the dissemination and safe
Union Commission’s Malabo Convention supported use of data.
the harmonization of the regional policy and legal Signs of a maturing system will include adequate
framework for cybersecurity and data protection technical capacity, sufficient resources, clear roles
across Africa,133 but institutions working in support and responsibilities, and a high level of data literacy.
of the convention have often come up short, in part Extensive training—for both civil servants and citi-
because of the underrepresentation of local DPAs to zens—to overcome digital literacy barriers and enable
enforce agreements of the convention.134 data management and use will also be part of the
This stocktaking should examine institutional maturation process.135 To engender trust and increase
relationships as they interact with the private sector their transparency and accountability, institutions
and civil society. It would then serve as a spring- should also be required to publish annual plans and
board to developing institutional arrangements that reports on their activities. Furthermore, certain insti-
promote the production and flow of data between tutions, such as regulators, NSOs, and data protection
these actors. These institutions and initiatives can authorities, must be protected from undue political
provide market participants with the confidence in and commercial influences.
and certainty about the rules of the game, reduce risk,
and increase capacity and the incentives for firms Optimizing the system
to use data for economically and socially productive To maximize the value of data, institutions need
purposes. to support a whole-of-government approach to the
management of data. Capacity-building and com-
Initiating data flows munication efforts should be directed at training
Once it is clear how well the existing institutions are civil servants to use data for results, including better
promoting the secure production and flow of data, decision-making, performance monitoring, and ser-
work can begin to fill in gaps and strengthen their vice delivery. To strengthen a data-driven culture in
capabilities. Not all gaps have to be filled by public the public sector, reward mechanisms such as prizes
institutions. Domestic or international academic and performance-related pay can incentivize civil
institutions, CSOs, international organizations, and servants to pursue innovations and engage in collab-
research institutions could help fill capacity gaps in orative decision-making. With sufficient investments
government. Depending on the local context, a gov- in data institutions and the technical skills of civil ser-
ernment agency or unit (new or existing) could be vants, critical processes and service delivery channels
given responsibility for establishing a strategic plan can become automated and interconnected.
to promote greater use of data to improve public pol- Establishing processes for data quality assurance,
icy, the efficiency of the private sector, and the infor- data integration, and data synchronization should be
mational awareness of the population—all within the integral parts of data management at this stage. Insti-
agreed-on parameters of the social contract for data. tutions should similarly fully integrate stakeholder
This entity should have sufficient leverage across the feedback mechanisms into data flows, thereby help-
public sector agencies that govern or manage data ing to increase the transparency and quality of pro-
and should reside at the center of government under cesses. Ministries and agencies should share data via
high-level executive leadership. common platforms subject to robust data protection
Institutions should coordinate the development of safeguards, which limit consolidated access to and
standards to ensure data quality and data integration control over large volumes of personal data.
capabilities across government. This effort would Finally, institutions should be regularly moni-
include developing an integrated data management tored136 and evaluated, with the results informing
architecture for public intent data that curates, main- adjustments in resources and policies. Both should be
tains, and facilitates secure data sharing and reuse adapted to cope with disruptive technologies and ser-
across government. Data trusts or other contract- vices as data generation (and use) continues to grow
based mechanisms could continue to play an import- in both volume and variety.
ant role in promoting access to private intent data To meet the challenges from cross-border data
in areas in which public institutions, rules, and transfers associated with safeguarding and enabling
the use of both personal and nonpersonal data, that data are valued as a strategic asset. An example is
institutions should coordinate at the regional or the US Federal Data Strategy. See Office of Manage-
international level.137 Such global efforts toward data ment and Budget, “Federal Data Strategy: Leveraging
Data as a Strategic Asset,” Washington, DC, https://
governance should be recognized and promoted138
strategy.data.gov/.
and should enable convergence in the development of 12. The targets also include intermediate milestones and
high-level principles to guide the design and imple- measurable key performance indicators (KPIs) to sup-
mentation of national-level data governance frame- port monitoring and evaluation activities.
works (see spotlight 8.1).139 These efforts should pro- 13. OECD (2018).
tect the interests of poorer nations in international 14. Brown et al. (2019).
negotiations on data issues in which they may have 15. Quay (2010).
16. Blair (2011).
a limited voice.
17. Cheruiyot, Baack, and Ferrer-Conill (2019); Deloitte
No one-size-fits-all approach can be prescribed (2012); Garcia (2007); Gopal Jayal (2007); Grandvoinnet,
for every context. The maturity model is dynamic, Aslam, and Raha (2015); Hanna (2012); Hjalmarsson,
and institutions will need to continually learn and Johansson, and Rudmark (2015); Malena (2004); Paul
improve to move to the next level. This approach can (2011); Peruzzotti and Smulovitz (2006).
be applied equally to countries with low maturity and 18. Carson and Hartz-Karp (2005); He (2011).
low resources and those with high maturity and high 19. Kpundeh (2000); World Bank (2017).
20. World Bank (2002, 4).
resources.
21. The DGSS data on which figure 8.3 is based were col-
lected by visiting government, CSO, and other relevant
websites. Most governments have a substantial web
Notes
presence, and information on data governance is visi-
1. Harrison, Pardo, and Cook (2012). ble on their websites. However, the data do not capture
2. One class of platforms is software infrastructure, institutions without a web presence. See World Bank,
which can include civil registration and vital statistics DGSS (Digital Government/GovTech Systems and
systems, digital identification systems, population Services) (dataset), https://datacatalog.worldbank.org
registries, sectoral information management systems, /dataset/digital-governmentgovtech-systems-and
data catalogs, data architecture (one of the pillars of -services-dgss-dataset.
enterprise architecture), Government Service Bus, 22. These statistics are based on Data Governance System
interoperability frameworks, data lakes and ware- and Services (DGSS) data for 198 economies. See World
houses, webservices and application programming Bank, DGSS (Digital Government/GovTech Systems
interfaces, eTrust services, cybersecurity solutions, and Services) (dataset), https://datacatalog.worldbank
and privacy-enhancing technologies. These platforms .org/dataset/digital-governmentgovtech-systems-and
are essential components of soft infrastructure. -services-dgss-dataset.
3. Aghion and Tirole (1997). 23. Bertelli et al. (2020).
4. Bergstrom, Blume, and Varian (1986). 24. The national statistics office of Thailand, the Electronic
5. Arraiz et al. (2019); Brown et al. (2019). Transactions Development Agency, and CAT Telecom
6. Government of Mexico, Datos Abiertos de México Public Company Limited (a state-owned enterprise
(database), https://www.datos.gob.mx/. that runs the country’s international telecommuni-
7. See Shapiro and Varian (1998). cations infrastructure), among other agencies, were
8. See Abraham, Schneider, and vom Brocke (2019) for a consolidated under the Ministry of Digital Economy
review of this literature. and Society.
9. ASEAN (2012); OECD (2019b). 25. SGD (2020).
10. Many of the data governance functions included here 26. PARIS21 (2017).
coincide with those proposed by the British Academy 27. See, for example, Fölscher and Gay (2012); Sjoberg,
and the Royal Society (2017b). Their report “Data Man- Mellon, and Peixoto (2017).
agement and Use: Governance in the 21st Century” 28. Wilson (2019).
distills three groups of essential data governance func- 29. African Union (2020).
tions: (1) anticipate, monitor, and evaluate; (2) build 30. Martínez Pería and Singh (2014).
practices and set standards; and (3) clarify, enforce, and 31. Gunningham and Rees (1997); Gupta and Lad (1983).
remedy. The report also argues for a single body to act 32. Gunningham and Rees (1997); Gupta and Lad (1983).
as steward of the data governance landscape. 33. See the website of the International Organization for
11. Principles—such as certainty, transparency, account- Standardization, https://www.iso.org/about-us.html.
ability, nondiscrimination, fairness, inclusiveness, 34. UNSDG (2017).
openness, necessity, proportionality, and security— 35. Informal or internal mechanisms may be especially
need to be developed to link data management prac- effective if combined to provide multiple avenues for
tices to positive uses and behaviors to improve lives incentivizing compliance. This is one of the strengths
(see chapter 6). They also help identify practical steps of a multistakeholder approach to data governance.
for a data strategy along the data life cycle and ensure 36. United Nations (2014).

37. Turianskyi et al. (2018). 61. Rodian (2018).
38. This delistment was accompanied by an invitation to 62. GS1, “How GDSN Works,” Ewing Township, NJ, https://
return to EITI when implementation obstacles had www.gs1.org/services/gdsn/how-gdsn-works.
been removed (which as of this writing has occurred). 63. Lundqvist (2018).
39. See Latin American Open Data Initiative (Iniciativa 64. World Bank (2021).
Latinoamericana de Datos Abiertos), GDB (Global Data 65. Grossman (2019); Grossman et al. (2016); Hardinges and
Barometer) (dashboard), https://globaldatabarometer.org/. Tennison (2020).
40. The Moroccan Data Protection Law of 2009 provides 66. See the Open Commons Consortium website, https://
for fines of up to DH 300,000, depending on the sever- www.occ-data.org/.
ity of the violations. In certain cases, prison sentences 67. See the UK Biobank website, https://www.ukbiobank
can be issued for between three months and two years .ac.uk/learn-more-about-uk-biobank.
(Kettani 2017). 68. Pentland and Hardjono (2020).
41. Kin (2020). 69. See the LunaDNA website, https://www.lunadna.com
42. See Commission Nationale de l’Informatique et des /about/.
Libertés, “What You Should Know about Our Standard 70. Wylie and McDonald (2018).
on Data Protection Training Programmes,” https:// 71. Bernholz (2016); Hardinges (2018).
www.cnil.fr/en/what-you-should-know-about-our 72. MeitY (2020).
-standard-data-protection-training-programmes. 73. Delacroix and Lawrence (2019).
43. Bundeskartellamt (2019). A plug-in is a piece of add-on 74. Hardinges (2020).
software that helps make the base software do what it 75. Delacroix and Lawrence (2019); ODI (2019).
does not normally do by itself. Plug-ins (also known as 76. Bengio (2020).
extensions or add-ons) are downloaded and installed 77. Platform Info Exchange is a UK-based nonprofit trade
to make the software being used more feature-rich union for rideshare drivers such as Uber. The organi-
(O’Neill 2020).
zation helps these “gig workers” access, analyze, and
44. Richardson, Hendrickson, and Boussina (2018).
inform decisions using the personal data collected
45. Gauri (2011).
about them while they are working, through class action
46. A CSIRT is known, among other designations, as
data requests. This work is designed to create a worker-
a Computer Emergency Response Team (CERT);
led data trust downstream. Platform Info Exchange
Incident Response Team (IRT); Computer Security
is funding this pilot through a fellowship received
Incident Response Capability or Center (CSIRC); Com-
in January 2021 by Mozilla’s Data Futures Lab. See
puter Incident Response Capability or Center (CIRC);
https://foundation.mozilla.org/en/blog/announcing-3
Computer Incident Response Team (CIRT); Incident
-new-awards-to-fuel-better-data-stewardship/.
Handling Team (IHT); Incident Response Center or
78. WiredGov (2019).
Incident Response Capability (IRC); Security Emer-
79. Microsoft News Center India (2016).
gency Response Team (SERT); or Security Incident
80. OECD (2019b).
Response Team (SIRT).
81. Bhargava and D’Ignazio (2015).
47. See chapter 6 for data on cybersecurity legislation col-
lected through the Global Data Regulation Survey. 82. Skills should be developed to support the collection or
48. See Data Governance Network, IDFC Institute, acquisition of data (purpose-driven data collection), the
Research (document and data repository), Mumbai, management and curation of data (managing the data
India, https://datagovernance.org/research. life cycle and promoting interoperability), and the anal-
49. British Academy and Royal Society (2017a). ysis, visualization, and other uses of data across their
50. Examples are the Centre for Data Ethics and Innova- life cycle.
tion in the United Kingdom; the Ethics of AI Lab at the 83. Egle and Zahuranec (2020); OECD (1997).
University of Toronto in Canada; and the Ethics and 84. OECD (1997).
Governance of Artificial Intelligence Initiative at the 85. See Governance Lab, Tandon School of Engineering,
Massachusetts Institute of Technology and Harvard New York University, “Solving Public Problems with
University in the United States. Data,” Brooklyn, NY, http://sppd.thegovlab.org/.
51. Examples are the Global Partnership for Sustainable 86. Apolitical has a number of resources and courses on
Development Data and the World Data Forum. using data better in the public sector. See the Apolitical
52. O’Donnell and Keller (2020). website, https://apolitical.co/home.
53. Wylie and McDonald (2018). 87. Williams and Yecalo-Tecle (2020).
54. Hill, Stein, and Williams (2020). 88. Brown et al. (2019).
55. Shkabatur (2012). 89. Management Concepts (2016).
56. FTC (2014). 90. Campbell and Sandino (2019).
57. WebFX Team (2020). 91. See, for example, Nauheimer (2015); UNDP (2006).
58. Deichmann et al. (2016). 92. Economist (2013).
59. See Governance Lab, Tandon School of Engineering, 93. Ibarra and Hansen (2011).
New York University, “Data Collaboratives,” Brooklyn, 94. CL4D (2016).
NY, https://datacollaboratives.org/. 95. See Open Government Partnership program, “A Work-
60. Bernholz (2016). shop for Representatives of Public Structures on the
Open Data Order Project,” Tunis, Tunisia, http://www 121. Effective multistakeholder approaches to policy design
.ogptunisie.gov.tn/?p=226. and implementation can increase the responsiveness of
96. These efforts were supported closely by the World government, compared with the traditional top-down
Bank as part of technical assistance under the Mous- approaches or rule making that tend to lag behind the
sanada Multi-Donor Trust Fund. pace of technological change and may become obsolete
97. Weiss and Hughes (2005). by the time the legislative process is completed and
98. Carr and Walton (2014). Social accountability commit- regulations are adopted.
tees can be a helpful vehicle to promote legitimacy and 122. Multistakeholder approaches can also increase buy-in
impact through multistakeholder decision-making among stakeholders, so long as they are adequately
(World Bank 2020). represented, their interests are considered, and their
99. For example, see EDPB (2020). preferences are reflected (to the extent possible) in
100. eHealth Network (2020); EU (2020). policy setting, design, and implementation.
101. Mazzucato (2018). 123. In bringing divergent interest groups together, multi
102. Camera, Casari, and Bigoni (2013). stakeholder approaches to data governance can bal-
103. Recent applications or services that have won awards ance differing priorities to broker agreement on the
include the geoportal for the Urban Agency of systems to be adopted for the use, reuse, and sharing
Errachidia-Midelt, the e-upgrade for Royal Air Maroc of data for development. For example, the multistake-
(the national airline), and the online portal for the holder approach can facilitate convergence on (1) the
Moroccan pension fund (Caisse Marocaine des principles, norms, and standards for data collection
Retraites). See Ministry of Economy, Finance, and and use; (2) the tools and mechanisms (technical, legal,
Administrative Reform, “Prix National de l’Adminis- and procedural) to enable responsible and trustworthy
tration Electronique e-mtiaz,” Rabat, Morocco, https:// data use and sharing; and (3) the types of institutions
www.mmsp.gov.ma/fr/decline.aspx?m=4&r=218. or functions required to effectively implement these
104. The hackathon was supported by the World Bank principles, norms, standards, tools, and mechanisms.
through the Moussanada Multi-Donor Trust Fund. In For example, stakeholders may differ in their views
addition to the main competition, teams that did not of data minimization (that is, acquiring only the data
proceed to the final still had an opportunity to pres- necessary to achieve the limited and disclosed purpose
ent their solutions to the Court of Accounts for the for which those data are necessary); protecting data;
following challenges: decentralization and local gov- or creating or identifying the institutions tasked with
ernance; citizen participation in the audit process; and extracting the maximum public value from data.
simplification of, disclosure of, and follow-up on audit 124. Strickling and Hill (2017).
recommendations. 125. Dutton (2015).
105. Bach (2016). 126. WGIG (2005).
106. For a useful definition of autonomy in the public 127. At ICANN, civil society is represented in the at-large
sector, see the autonomy index developed by Rasul, mechanisms for participation in decision-making;
Rogger, and Williams (2018). It captures “the extent in management and address registries; and in the
to which bureaucrats of all levels are empowered to Internet Architecture Board. It also participates in the
make meaningful contributions into policy formula- selection of board members. Business representatives
tion and implementation processes, and the flexibility participate in their own business constituency group.
with [which] bureaucrats can use their discretion in More broadly, ICANN supports transparent and inclu-
responding to project peculiarities and introducing sive decision-making by providing unrestricted access
innovations” (Rasul, Rogger, and Williams 2018, 3). to its meetings and encourages public debate through
107. Gilardi and Maggetti (2011); World Bank (2017). public forums, including representation from low- and
108. OECD (2012). middle-income countries. See WGIG (2005).
109. OECD (2017). 128. Dutton (2015); Strickling and Hill (2017).
110. Blackman and Srivastava (2011). 129. Rubinstein (2018).
111. OECD (2017). 130. Strickling and Hill (2017).
112. Peters (2018). 131. WGIG (2005).
113. Peters (2018). 132. For example, a study by Maurer and Morgus (2014)
114. See the Foundations for Evidence-Based Policymaking found that two-thirds of the countries that favored
Act of 2018, Pub L. No. 115–435, 132 STAT. 5529 (2019), intergovernmental (multilateral) control over the
which applies to 24 agencies identified in the Chief internet regulate political, social, or religious content
Financial Officers Act of 1990 (CFO Act) in 31 U.S.C. on the internet within their borders, constraining
§901(b). For more information, see DOJ (2020). freedom of expression. The study analyzed state voting
115. See OMB (2020). records at the ITU’s World Conference on International
116. Johns and Saltane (2016). Telecommunications (WCIT) in Dubai, Saudi Arabia,
117. Arizti et al. (2020). in 2012.
118. NHSA (2020). 133. African Union (2014).
119. WGIG (2005). 134. Information communicated during the World
120. DeNardis and Raymond (2013). Bank and German Federal Ministry of Economic

Cooperation and Development’s Online Consultation, in Europe and Central Asia: Lessons from the Region. With
“Data for Better Lives: Enablers and Safeguards,” June contributions of William Gallagher and Patricia Rogers.
9–10, 2020. Washington, DC: World Bank.
135. Bruhn, Lara Ibarra, and McKenzie (2014); Bruhn et al. Arraiz, Irani, Miriam Bruhn, Benjamin N. Roth, Claudia Ruiz
(2016); Frisancho (2020); Lührmann, Serra-Garcia, and Ortega, and Rodolfo Mario Stucchi. 2019. “Free Riding in
Winter (2018). Loan Approvals: Evidence from SME Lending in Peru.”
136. For example, the CSO Privacy International tracks Policy Research Working Paper 9072, World Bank,
extraordinary measures adopted by governments, inter- Washington, DC.
national organizations, and technology companies in ASEAN (Association of Southeast Asian Nations). 2012.
response to COVID-19 to ensure these measures do not “Framework on Digital Data Science.” Document
lead to data exploitation and violate human rights. See endorsed at 12th ASEAN Telecommunications and Infor-
Privacy International, “Tracking the Global Response mation Technology Ministers Meeting (TELMIN), Cebu,
to COVID-19,” London, https://privacyinternational.org the Philippines, November 15–16, 2012. https://asean.org
/examples/tracking-global-response-covid-19. /storage/2012/05/6B-ASEAN-Framework-on-Digital-Data
137. OECD (2013). -Governance_Endorsed.pdf.
138. According to a survey conducted by the Pathways Bach, Tobias. 2016. “Administrative Autonomy of Public
to Prosperity Commission in 2019, policy makers in Organizations.” In Global Encyclopedia of Public Adminis
lower-income countries emphasized that the areas in tration, Public Policy, and Governance, edited by Ali
which “global efforts” were most needed were taxa- Farazmand, 171–79. Cham, Switzerland: Springer.
tion; cybercrime and cybersecurity; privacy and data Bengio, Yoshua. 2020. “Peer-to-Peer AI-Tracing of COVID-19.”
protection; market competition; intellectual property; Yoshua Bengio (blog), March 23, 2020. https://yoshua
and data sharing and interoperability. Within these bengio.org/2020/03/23/peer-to-peer-ai-tracing-of-covid-19/.
priority areas, international cooperation and coordina- Bergstrom, Theodore, Lawrence Blume, and Hal Varian.
tion were considered the most needed to support the 1986. “On the Private Provision of Public Goods.” Journal
development of regulatory and technical standards. of Public Economics 29 (1): 25–49.
International regulatory cooperation in these six areas Bernholz, Lucy. 2016. “Workshop Summary: Trusted Data
can have positive externalities, including improving Intermediaries.” Stanford Center on Philanthropy and
regulatory predictability, reducing compliance burdens Civil Society, Stanford University, Stanford, CA. https://
and the risks of regulatory arbitrage, and potentially pacscenter.stanford.edu/wp-content/uploads/2018/05
encouraging investment flows. See Pathways for Pros- /TDI-Workshop-Summary.pdf.
perity Commission (2019). Bertelli, Anthony M., Mai Hassan, Dan Honig, Daniel
139. Carter and Yayboke (2019). Rogger, and Martin J. Williams. 2020. “An Agenda for
the Study of Public Administration in Developing Coun-
tries.” Governance 33 (4): 735–48.
References Bhargava, Rahul, and Catherine D’Ignazio. 2015. “Designing
Abraham, Rene, Johannes Schneider, and Jan vom Brocke. Tools and Activities for Data Literacy Learners.” Paper
2019. “Data Governance: A Conceptual Framework, presented at Workshop on Data Literacy, Web Science
Structured Review, and Research Agenda.” International 2015 Conference, Oxford, UK, June 30, 2015.
Journal of Information Management 49 (December): 424–38. Blackman, Colin, and Lara Srivastava, eds. 2011. Telecommu-
African Union. 2014. “African Union Convention on Cyber nications Regulation Handbook. Washington, DC: World
Security and Personal Data Protection.” Document EX. Bank, InfoDev, and International Telecommunication
CL/846(XXV), June 27, 2014 (adopted), African Union, Union.
Addis Ababa, Ethiopia. https://www.opennetafrica.org Blair, Harry. 2011. “Gaining State Support for Social Account-
/?wpfb_dl=4. ability.” In Accountability through Public Opinion: From Iner-
African Union. 2020. “The Digital Transformation Strategy tia to Public Action, edited by Sina Odugbemi and Taeku
for Africa (2020–2030).” African Union, Addis Ababa, Lee, 37–51. Washington, DC: World Bank. https://elibrary
Ethiopia. https://au.int/sites/default/files/documents .worldbank.org/doi/10.1596/9780821385050_CH04.
/38507-doc-dts-english.pdf. British Academy and Royal Society. 2017a. “Data Governance:
Agesic (Agencia de Gobierno Electrónico y Sociedad de la Public Engagement Review.” British Academy and Royal
Información y del Conocimiento, Agency for Electronic Society, London. https://royalsociety.org/-/media/policy
Government and Information and Knowledge Society, /projects/data-governance/data-governance-public
Uruguay). 2019. “Agenda Uruguay Digital 2020: Trans- -engagement-review.pdf.
forming with Equity.” Agesic, Office of the President of British Academy and Royal Society. 2017b. “Data Manage-
the Republic, Montevideo, Uruguay. ment and Use: Governance in the 21st Century; A Joint
Aghion, Philippe, and Jean Tirole. 1997. “Formal and Real Report by the British Academy and the Royal Society.”
Authority in Organizations.” Journal of Political Economy British Academy and Royal Society, London. https://royal
105 (1): 1–29. society.org/topics-policy/projects/data-governance/.
Arizti, Pedro, Daniel J. Boyce, Natalia Manuilova, Carlos Brown, Walter, Daniel Rogger, Ella Spencer, and Martin
Sabatino, Roby Senderowitsch, and Ermal Vila. 2020. Williams. 2019. “Information and Innovation in the
Building Effective, Accountable, and Inclusive Institutions Public Sector.” IGC Growth Brief 019, International
Growth Center, London. https://www.theigc.org/wp Deichmann, Johannes, Kersten Heineke, Thomas Rein-
-content/uploads/2019/10/Brown-et-al-2019-Growth-Brief bacher, and Dominik Wee. 2016. “Creating a Successful
_Web.pdf. Internet of Things Data Marketplace.” Our Insights
Bruhn, Miriam, Luciana de Souza Leão, Arianna Legovini, (blog), October 7, 2016, McKinsey and Company, New
Rogelio Marchetti, and Bilal Zia. 2016. “The Impact York. https://www.mckinsey.com/business-functions
of High School Financial Education: Evidence from a /mckinsey-digital/our-insights/creating-a-successful
Large-Scale Evaluation in Brazil.” American Economic -internet-of-things-data-marketplace.
Journal: Applied Economics 8 (4): 256–95. Delacroix, Sylvie, and Neil D. Lawrence. 2019. “Bottom-Up
Bruhn, Miriam, Gabriel Lara Ibarra, and David McKenzie. Data Trusts: Disturbing the ‘One Size Fits All’ Approach
2014. “The Minimal Impact of a Large-Scale Financial to Data Governance.” International Data Privacy Law 9 (4):
Education Program in Mexico City.” Journal of Develop- 236–52.
ment Economics 108 (May): 184–89. Deloitte. 2012. “Open Growth: Stimulating Demand for Open
Bundeskartellamt. 2019. “Bundeskartellamt Prohibits Data in the UK.” Briefing note, Deloitte Analytics, Lon-
Facebook from Combining User Data from Different don. https://www2.deloitte.com/content/dam/Deloitte
Sources.” News, February 7, 2019, Bundeskartellamt, Bonn, /uk/Documents/deloitte-analytics/open-growth.pdf.
Germany. https://www.bundeskartellamt.de/SharedDocs DeNardis, Laura, and Mark Raymond. 2013. “Thinking
/Meldung/EN/Pressemitteilungen/2019/07_02_2019 Clearly about Multistakeholder Internet Governance.”
_Facebook.html. Paper presented at GigaNet, the Eighth Annual Global
Camera, Gabriele, Marco Casari, and Maria Bigoni. 2013. Internet Governance Academic Network Symposium,
“Money and Trust among Strangers.” PNAS, Proceedings Bali, Indonesia, October 21, 2013.
of the National Academy of Sciences 110 (37): 14889–93. DOJ (Department of Justice, United States). 2020. “Roles and
Campbell, Dennis, and Tatiana Sandino. 2019. “Sustaining Responsibilities under the Foundations for Evidence-
Corporate Culture in a Growing Organization.” Harvard Based Policymaking Act.” Open Government. https://
Business School Technical Note 119–109, Harvard Busi- www.justice.gov/open/roles-and-responsibilities
ness School, Boston, MA. -under-foundations-evidence-based-policymaking-act.
Carr, Priyanka B., and Gregory M. Walton. 2014. “Cues of Dutton, William H. 2015. “Multistakeholder Internet Gov-
Working Together Fuel Intrinsic Motivation.” Journal of ernance?” Background paper, World Development Report
Experimental Social Psychology 53 (July): 169–84. 2016: Digital Dividends, World Bank, Washington, DC.
Carson, Lyn, and Janette Hartz-Karp. 2005. “Adapting and EC (European Commission). 2020. “Trust Services and
Combining Deliberative Designs: Juries, Polls, and Electronic Identification (eID).” Shaping Europe’s Digital
Forums.” In The Deliberative Democracy Handbook: Strate- Future: Policy. https://ec.europa.eu/digital-single-market
gies for Effective Civic Engagement in the Twenty-First Century, /en/policies/trust-services-and-eidentification.
edited by John Gastil and Peter Levine, 120–38. San Fran- Economist. 2013. “How Did Estonia Become a Leader in Tech-
cisco: Jossey-Bass. nology?” The Economist Explains, July 31, 2013. https://www
Carter, William A., and Erol Yayboke. 2019. “Data Gov- .economist.com/the-economist-explains/2013/07/30/how
ernance Principles for the Global Digital Economy.” -did-estonia-become-a-leader-in-technology.
Report, Center for Strategic and International Studies, EDPB (European Data Protection Board). 2020. “Guidelines
Washington, DC. https://www.csis.org/analysis/data 03/2020 on the Processing of Data Concerning Health
-governance-principles-global-digital-economy. for the Purpose of Scientific Research in the Context
Cavoukian, Ann. 2011. “PbD, Privacy by Design, the 7 Founda- of the COVID-19 Outbreak.” Guidelines, EDPB, Brussels.
tional Principles: Implementation and Mapping of Fair https://edpb.europa.eu/our-work-tools/our-documents
Information Practices.” Information and Privacy Com- /ohjeet/guidelines-032020-processing-data-concerning
missioner of Ontario, Toronto. https://iapp.org/resources -health-purpose_en.
/article/privacy-by-design-the-7-foundational-principles/. Egle, Danuta, and Andrew J. Zahuranec. 2020. “How to Build
Cheruiyot, David, Stefan Baack, and Raul Ferrer-Conill. 2019. the Data Skills Toolkit Public Employees Need.” Data
“Data Journalism beyond Legacy Media: The Case of Stewards (blog), June 24, 2020. https://medium.com/data
African and European Civic Technology Organizations.” -stewards-network/how-to-build-the-data-skills-toolkit
Digital Journalism 7 (9): 1215–29. -public-employees-need-6af3af43e627.
CL4D (Collaborative Leadership for Development). 2016. eHealth Network. 2020. “Mobile Applications to Support
“CL4D Portfolio of Unblocking Project Implementation Contact Tracing in the EU’s Fight against COVID-19:
Challenges and Accelerating Progress.” World Bank, Common EU Toolbox for Member States.” Version 1.0,
Washington, DC. https://www.leadfordev.org/Data/gpl4d eHealth Network, Brussels. https://ec.europa.eu/health
/files/field/documents/cl4d_portfolio_brochuresoftcopy /sites/health/files/ehealth/docs/covid-19_apps_en.pdf.
version.pdf. Elliot, Mark James, Elaine Mackey, Kieron O’Hara, and
Danezis, George, Josep Domingo-Ferrer, Marit Hansen, Caroline Tudor. 2016. The Anonymisation Decision-Making
Jaap-Henk Hoepman, Daniel Le Métayer, Rodica Tirtea, Framework. Manchester, UK: UKAN Publications.
and Stefan Schiffner. 2014. “Privacy and Data Protec- EU (European Union). 2014. “Regulation (EU) No 910/2014 of
tion by Design.” European Union Agency for Network the European Parliament and of the Council of 23 July
and Information Security, Heraklion, Greece. https:// 2014 on Electronic Identification and Trust Services
www.enisa.europa.eu/publications/privacy-and-data for Electronic Transactions in the Internal Market and
-protection-by-design. Repealing Directive 1999/93/EC.” Official Journal of the

European Union L 257/73. https://ec.europa.eu/futurium Hardinges, Jack. 2018. “Defining a ‘Data Trust.’” Knowledge
/en/system/files/ged/eidas_regulation.pdf. and Opinion (blog), October 19, 2018, Open Data Institute,
EU (European Union). 2020. “Communication from the London. https://theodi.org/article/defining-a-data-trust/.
Commission: Guidance on Apps Supporting the Fight Hardinges, Jack. 2020. “Data Trusts in 2020.” Knowledge
against COVID 19 Pandemic in Relation to Data Pro- and Opinion (blog), March 17, 2020, Open Data Institute,
tection.” Official Journal of the European Union C 124 I/1. London. https://theodi.org/article/data-trusts-in-2020/.
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF Hardinges, Jack, and Jeni Tennison. 2020. “What Do We
/?uri=CELEX:52020XC0417(08)&from=EN. Mean by Data Institutions?” Knowledge and Opinion
Floridi, Luciano, and Mariarosaria Taddeo. 2016. “What (blog), February 10, 2020, Open Data Institute, London.
Is Data Ethics?” Philosophical Transactions of the Royal https://theodi.org/article/what-do-we-mean-by-data
Society A: Mathematical, Physical, and Engineering Sciences 374 -institutions/.
(2083): 20160360. https://doi.org/10.1098/rsta.2016.0360. Harrison, Teresa M., Theresa A. Pardo, and Meghan Cook.
Fölscher, Alta, and Emilie Gay. 2012. “Fiscal Transparency 2012. “Creating Open Government Ecosystems: A
and Participation in Africa: A Status Report.” Collabora- Research and Development Agenda.” Future Internet 4 (4):
tive Africa Budget Reform Initiative, National Treasury, 900–28.
Pretoria, South Africa. He, Baogang. 2011. “Deliberation and Institutional Mech-
Frisancho, Verónica C. 2020. “The Impact of School-Based anisms for Shaping Public Opinion.” In Accountability
Financial Education on High School Students and Their through Public Opinion: From Inertia to Public Action, edited
Teachers: Experimental Evidence from Peru.” IDB Work- by Sina Odugbemi and Taeku Lee, 203–14. Washing-
ing Paper IDP-WP-871, Inter-American Development ton, DC: World Bank. https://elibrary.worldbank.org
Bank, Washington, DC. /doi/10.1596/9780821385050_CH14.
FTC (Federal Trade Commission, United States). 2014. Hill, Ryan, Carolyn Stein, and Heidi Williams. 2020. “Inter-
Data Brokers: A Call for Transparency and Accountability. nalizing Externalities: Designing Effective Data Policies.”
Washington, DC: FTC. https://www.ftc.gov/reports/data AEA Papers and Proceedings 110 (May): 49–54. https://doi
-brokers-call-transparency-accountability-report-federal .org/10.1257/pandp.20201060.
-trade-commission-may-2014. Hjalmarsson, Anders, Niklas Johansson, and Daniel Rud-
Garcia, Helen R. 2007. “Perspectives on Communication mark. 2015. “Mind the Gap: Exploring Stakeholders’
and Social Accountability: A Qualitative Survey of World Value with Open Data Assessment.” In Proceedings of
Bank Practitioners.” Paper presented at World Bank’s the 48th Annual Hawaii International Conference on System
Communication for Governance and Accountability Sciences, HICSS 2015, edited by Tung X. Bui and Ralph H.
Program Workshop, “Generating Genuine Demand with Sprague, Jr., 1314–23. Los Alamitos, CA: Institute of Elec-
Social Accountability Mechanisms,” World Bank Office, trical and Electronics Engineers. https://doi.org/10.1109
Paris, November 1–2, 2007. /HICSS.2015.160.
Gauri, Varun. 2011. “Redressing Grievances and Complaints Ibarra, Herminia, and Morten T. Hansen. 2011. “Are You a
Regarding Basic Service Delivery.” Policy Research Collaborative Leader?” Harvard Business Review 89 (7–8):
Working Paper 5699, World Bank, Washington, DC. 68–74.
Gilardi, Fabrizio, and Martino Maggetti. 2011. “The Inde- Johns, Melissa, and Valentina Saltane. 2016. “Citizen Engage-
pendence of Regulatory Authorities.” In Handbook on the ment in Rulemaking: Evidence on Regulatory Practices
Politics of Regulation, edited by David Levi-Faur, 201–14. in 185 Countries.” Policy Research Working Paper 7840,
Cheltenham, UK: Edward Elgar Publishing. World Bank, Washington, DC.
Gopal Jayal, Niraja. 2007. “New Directions in Theorising Kettani, Mehdi. 2017. “Régime Juridique de la Protection
Social Accountability?” IDS Bulletin 38 (6): 105–10. des Données Personnelles.” Client Brief, DLA Piper,
Grandvoinnet, Helene, Ghazia Aslam, and Shomikho Raha. New York.
2015. Opening the Black Box: The Contextual Drivers of Social Kin, Yeong Zee. 2020. “Enabling Data Innovation through
Accountability. New Frontiers of Social Policy Series. Accountability: Singapore’s Approach.” Paper presented
Washington, DC: World Bank. at seminar organized in Singapore by the Office of the
Grossman, Robert L. 2019. “Data Lakes, Clouds, and Com- Chief Economist, Middle East and North Africa Region,
mons: A Review of Platforms for Analyzing and Sharing World Bank, April 7, 2020.
Genomic Data.” Trends in Genetics 35 (3): 223–34. Kpundeh, Sahr J. 2000. “Corruption and Corruption Control in
Grossman, Robert L., Allison Heath, Mark Murphy, Maria Africa.” Paper prepared for Gulbenkian Foundation work-
Patterson, and Walt Wells. 2016. “A Case for Data Com- shop, “Democracy and Development in Africa,” Lisbon,
mons: Toward Data Science as a Service.” Computing in June 23–24, 2000. http://citeseerx.ist.psu.edu/viewdoc
Science and Engineering 18 (5): 10–20. /download?doi=10.1.1.595.4791&rep=rep1&type=pdf.
Gunningham, Neil, and Joseph Rees. 1997. “Industry Lührmann, Melanie, Marta Serra-Garcia, and Joachim
Self-Regulation: An Institutional Perspective.” Law and Winter. 2018. “The Impact of Financial Education on
Policy 19 (4): 363–414. Adolescents’ Intertemporal Choices.” American Economic
Gupta, Anil K., and Lawrence J. Lad. 1983. “Industry Self- Journal: Economic Policy 10 (3): 309–32.
Regulation: An Economic, Organizational, and Political Lundqvist, Björn. 2018. “Data Collaboration, Pooling, and
Analysis.” Academy of Management Review 8 (3): 416–25. Hoarding under Competition Law.” Stockholm Fac-
Hanna, Nagy K. 2012. “Open Development: ICT for Gover- ulty of Law Research Paper 61, Stockholm University,
nance in Africa.” World Bank, Washington, DC. Stockholm.
Maddox, Teena. 2015. “The World’s Smartest Cities: What and Opinion (blog), April 15, 2019, Open Data Institute,
IoT and Smart Governments Will Mean for You.” London. https://theodi.org/article/huge-appetite-for-data
TechRepublic, November 10, 2015. https://www.tech -trusts-according-to-new-odi-research/.
republic.com/article/smart-cities/. O’Donnell, Fionntán, and Jared Robert Keller. 2020. “Build-
Malena, Carmen. 2004. “Social Accountability: An Introduc- ing Trust in Alternative Data Ecosystems.” Knowledge
tion to the Concept and Emerging Practice.” With Reiner and Opinion (blog), April 16, 2020, Open Data Institute,
Forster and Janmejay Singh. Social Development Paper: London. https://theodi.org/article/building-trust-in
Participation and Civic Engagement, World Bank. Wash- -alternative-data-ecosystems/.
ington, DC. OECD (Organisation for Economic Co-operation and
Management Concepts. 2016. “Successful Change Manage- Development). 1997. “Public Service Training in OECD
ment Practices in the Public Sector: How Governmental Countries.” SIGMA Paper 16, OECD, Paris. https://doi
Agencies Implement Organizational Change Manage- .org/10.1787/5kml619ljzzn-en.
ment.” Management Concepts, Tysons Corner, VA. OECD (Organisation for Economic Co-operation and Devel-
Martínez Pería, María Soledad, and Sandeep Singh. 2014. opment). 2012. “Recommendation of the Council on Reg-
“The Impact of Credit Information Sharing Reforms on ulatory Policy and Governance.” Council on Regulatory
Firm Financing.” Policy Research Working Paper 7013, Policy and Governance, OECD, Paris. https://www.oecd
World Bank, Washington, DC. .org/governance/regulatory-policy/49990817.pdf.
Maurer, Tim, and Robert Morgus. 2014. “Tipping the Scale: OECD (Organisation for Economic Co-operation and
An Analysis of Global Swing States in the Internet Gov- Development). 2013. The OECD Privacy Framework. Paris:
ernance Debate.” Internet Governance Paper 7, Center OECD. http://www.oecd.org/sti/ieconomy/oecd_privacy
for International Governance Innovation, Waterloo, _framework.pdf.
Ontario, Canada. OECD (Organisation for Economic Co-operation and Devel-
Mazzucato, Mariana. 2018. “Mission-Oriented Research and opment). 2017. “Creating a Culture of Independence:
Innovation in the European Union: A Problem-Solving Practical Guidance against Undue Influence.” OECD,
Approach to Fuel Innovation-Led Growth.” European Paris. https://www.oecd.org/gov/creating-a-culture-of
Commission, Brussels. https://ec.europa.eu/info/sites -independence-9789264274198-en.htm.
/info/files/mazzucato_report_2018.pdf. OECD (Organisation for Economic Co-operation and
MeitY (Ministry of Electronics and Information Technol- Development). 2018. “OECD Regulatory Enforcement
ogy). 2020. “Report by the Committee of Experts on and Inspections Toolkit.” OECD, Paris. https://doi.org
Non-Personal Data Governance Framework.” Report /10.1787/9789264303959-en.
111972/2020/CL&ES, MeitY, New Delhi. https://www OECD (Organisation for Economic Co-operation and
.huntonprivacyblog.com/wp-content/uploads/sites/28 Development). 2019a. Digital Government Review of
/2020/08/mygov_159453381955063671.pdf. Argentina: Accelerating the Digitalisation of the Public Sec-
MGI (McKinsey Global Institute). 2019. “How Can the Pri- tor. OECD Digital Government Studies Series. Paris:
vate and Public Sectors Work Together to Create Smart OECD. https://www.oecd-ilibrary.org/governance/digital
Cities?” McKinsey, New York. -government-review-of-argentina_354732cc-en.
Microsoft News Center India. 2016. “Microsoft, L V Prasad OECD (Organisation for Economic Co-operation and
Eye Institute, and Global Experts Collaborate to Launch Development). 2019b. The Path to Becoming a Data-Driven
Microsoft Intelligent Network for Eyecare.” Microsoft Public Sector. OECD Digital Government Studies Series,
Stories India, December 19, 2016. https://news.microsoft November 28. Paris: OECD. https://doi.org/10.1787
.com/en-in/microsoft-l-v-prasad-eye-institute-and-global /059814a7-en.
-experts-collaborate-to-launch-microsoft-intelligent OMB (Office of Management and Budget). 2020. “Federal
-network-for-eyecare/. Chief Data Officers Council Holds Inaugural Meet-
Mitchell, Shane, Nicola Villa, Martin Stewart-Weeks, ing.” OMB, Washington, DC. https://strategy.data.gov
and Anne Lange. 2013. “The Internet of Everything for /news/2020/01/31/federal-chief-data-officers-council
Cities: Connecting People, Process, Data, and Things -holds-inaugural-meeting/.
to Improve the ‘Livability’ of Cities and Communities.” O’Neill, Mark. 2020. “What Is a Plugin?” Technology Trends
Point of View, Cisco Systems, San Jose, CA. https://www (blog). January 7, 2020 (updated). https://smallbiztrends
.cisco.com/c/dam/en_us/solutions/industries/docs/gov .com/2014/07/what-is-a-plugin.html.
/everything-for-cities.pdf. PARIS21 (Partnership in Statistics for Development in the 21st
Nauheimer, Holger. 2015. The Change Management Toolbook: Century). 2017. “National Strategies for the Development
A Collection of Tools, Methods, and Strategies. Stellenbosch, of Statistics.” PARIS21 Consortium, Paris. https://paris21
South Africa: ChangeWright Consulting. .org/national-strategy-development-statistics-nsds.
NHSA (Northern Health Science Alliance). 2020. “Con- Pathways for Prosperity Commission. 2019. “Digital Diplo-
nected Health Cities: Impact Summary 2016–2020.” macy: Technology Governance for Developing Coun-
NHSA, Manchester, UK. https://www.thenhsa.co.uk/app tries.” Pathways for Prosperity Commission, Oxford, UK.
/uploads/2020/03/Connected-Health-Cities-Impact https://pathwayscommission.bsg.ox.ac.uk/sites/default
-Report-Summary.pdf. /files/2019-10/Digital-Diplomacy.pdf.
ODI (Open Data Institute). 2019. “Huge Appetite for Data Paul, Samuel. 2011. “Stimulating Activism through Champi-
Trusts, According to New ODI Research.” Knowledge ons of Change.” In Accountability through Public Opinion:

From Inertia to Public Action, edited by Sina Odugbemi Scassa, Teresa, and Merlynda Vilain. 2019. “Governing Smart
and Taeku Lee, 347–57. Washington, DC: World Bank. Data in the Public Interest: Lessons from Ontario’s
https://doi.org/10.1596/9780821385050_CH23. Smart Metering Entity.” CIGI Paper 221, Center for Inter-
Pentland, Alex, and Thomas Hardjono. 2020. “Data Coop- national Governance Innovation, Waterloo, Ontario,
eratives.” In Building the New Economy: Data as Capital, Canada. https://www.cigionline.org/publications
edited by Alex Pentland, Alexander Lipton, and Thomas /governing-smart-data-public-interest-lessons-ontarios
Hardjono, chap. 2. Cambridge, MA: MIT Press. Published -smart-metering-entity.
ahead of print, April 30, 2020. https://wip.mitpress.mit SGD (Digital Government Secretariat, Brazil). 2020.
.edu/pub/pnxgvubq/release/2. “Central Data Governance Committee.” Digital Govern-
Peruzzotti, Enrique, and Catalina Smulovitz, eds. 2006. ment, June 22, 2020, SGD, Brasília. https://www.gov.br
Enforcing the Rule of Law: Social Accountability in the New /governodigital/pt-br/governanca-de-dados/comite
Latin American Democracies. Pitt Latin American Studies -central-de-governanca-de-dados.
Series. Pittsburgh: University of Pittsburgh Press. Shapiro, Carl, and Hal R. Varian. 1998. Information Rules:
Peters, B. Guy. 2018. “The Challenge of Policy Coordination.” A Strategic Guide to the Network Economy. Brighton, MA:
Policy Design and Practice 1 (1): 1–11. Harvard Business Review Press.
PI (Privacy International). 2018. “Why We’ve Filed Com- Shkabatur, Jennifer. 2012. “Check My School: A Case Study
plaints against Companies That Most People Have on Citizens’ Monitoring of the Education Sector in the
Never Heard of, and What Needs to Happen Next.” Philippines.” World Bank Institute, Washington, DC.
Advocacy, November 8, 2018, PI, London. http://privacy Sjoberg, Fredrik M., Jonathan Mellon, and Tiago Peixoto.
international.org/advocacy/2434/why-weve-filed 2017. “The Effect of Bureaucratic Responsiveness on
-complaints-against-companies-most-people-have-never Citizen Participation.” Public Administration Review 77 (3):
-heard-and-what. 340–51.
Polonetsky, Jules, Omer Tene, and Kelsey Finch. 2016. “Shades Strickling, Lawrence E., and Jonah Force Hill. 2017.
of Gray: Seeing the Full Spectrum of Practical Data “Multi-Stakeholder Internet Governance: Successes and
De-Identification.” Santa Clara Law Review 56 (3): 593–629. Opportunities.” Journal of Cyber Policy 2 (3): 296–317.
Porrúa, Miguel A. 2013. “E-Government in Latin America: Tannam, Ellen. 2018. “How Can Smart Cities Make Data
A Review of the Success in Colombia, Uruguay, and a Public Good before Time Runs Out?” Silicon Republic,
Panama.” In The Global Information Technology Report July 26, 2018. https://www.siliconrepublic.com/enterprise
2013: Growth and Jobs in a Hyperconnected World, edited /decode-nesta-smart-cities.
by Beñat Bilbao-Osorio, Soumitra Dutta, and Bruno Thompson, Stuart A., and Charlie Warzel. 2019. “Twelve
Lanvin, 127–36. Insight Report. Geneva: World Economic Million Phones, One Dataset, Zero Privacy.” New York
Forum. http://www3.weforum.org/docs/WEF_GITR Times, December 19, 2019. https://www.nytimes.com
_Report_2013.pdf. /interactive/2019/12/19/opinion/location-tracking-cell
Quay, Ray. 2010. “Anticipatory Governance: A Tool for -phone.html.
Climate Change Adaptation.” Journal of the American Turianskyi, Yarik, Terence Corrigan, Matebe Chisiza, and
Planning Association 76 (4): 496–511. https://doi.org/10.1080 Alex Benkesnstein. 2018. “Multi-Stakeholder Initiatives:
/01944363.2010.508428. What Have We Learned? An Overview and Literature
Ram, Aliya, and Madhumita Murgia. 2019. “Data Brokers: Review.” United States Agency for International Devel-
Regulators Try to Rein In the ‘Privacy Deathstars.’” Finan- opment, Washington, DC. https://www.saiia.org.za/wp
cial Times, January 7, 2019. https://www.ft.com/content -content/uploads/2018/08/2018-MSI-overview-literature
/f1590694-fe68-11e8-aebf-99e208d3e521. -review.pdf.
Rasul, Imran, Daniel Rogger, and Martin J. Williams. UNDP (United Nations Development Programme). 2006.
2018. “Management of Bureaucrats and Public Service “Institutional Reform and Change Management: Man-
Delivery: Evidence from the Nigerian Civil Service.” aging Change in Public Sector Organisations.” Confer-
Policy Research Working Paper 8595, World Bank, Wash- ence Paper 5, UNDP, New York.
ington, DC. United Nations. 2014. “Resolution Adopted by the General
Richardson, Harriet, Steve Hendrickson, and Houman Assembly on 29 January 2014: Fundamental Principles
Boussina. 2018. “ERP Planning: Information Technology of Official Statistics.” Document A/RES/68/261, United
and Data Governance.” Audit Report (rev.), Office of the Nations, New York. https://unstats.un.org/unsd/dnss/gp
City Auditor, Palo Alto, CA. https://www.cityofpaloalto /FP-New-E.pdf.
.org/civicax/filebank/documents/66250. UNSDG (United Nations Sustainable Development Group).
Rodian, Justine. 2018. “Master Data Management Defini- 2017. “Data Privacy, Ethics, and Protection: Guidance
tions: The Complete A-Z of MDM.” Master Data Manage- Note on Big Data for Achievement of the 2030 Agenda.”
ment (blog), April 19, 2018. https://blog.stibosystems.com UNSDG, New York. https://unsdg.un.org/sites/default
/the-complete-a-z-of-master-data-management. /files/UNDG_BigData_final_web.pdf.
Rubinstein, Ira S. 2018. “The Future of Self-Regulation Is Vermont Office of the Attorney General. 2018. “Guidance
Co-Regulation.” In The Cambridge Handbook of Consumer on Vermont’s Act 171 of 2018: Data Broker Regulation.”
Privacy, edited by Evan Selinger, Jules Polonetsky, and Office of the Attorney General, Montpelier, VT. https://
Omer Tene, 503–23. Cambridge Law Handbooks Series. ago.vermont.gov/wp-content/uploads/2018/12/2018-12-11
Cambridge, UK: Cambridge University Press. -VT-Data-Broker-Regulation-Guidance.pdf.
WebFX Team. 2020. “What Are Data Brokers, and What Is Food Waste.” Press release, January 31, 2019, WiredGov,
Your Data Worth? [Infographic].” Internet (blog). March 16, Stockport, UK. https://www.wired-gov.net/wg/news.nsf
2020. https://www.webfx.com/blog/internet/what-are /articles/Digital+revolution+to+use+the+power+of
-data-brokers-and-what-is-your-data-worth-infographic/. +data+to+combat+illegal+wildlife+trade+and+reduce
Weiss, Jeff, and Jonathan Hughes. 2005. “Want Collabora- +food+waste+01022019081000?open.
tion? Accept and Actively Manage Conflict.” Harvard World Bank. 2002. World Development Report 2002: Building
Business Review 83 (3): 92–101. Institutions for Markets. Washington, DC: World Bank;
WGIG (Working Group on Internet Governance, United New York: Oxford University Press.
Nations). 2005. “Background Report.” Château de Bossey, World Bank. 2016. World Development Report 2016: Digital
Bogis-Bossey, Switzerland. https://www.itu.int/net/wsis Dividends. Washington, DC: World Bank.
/wgig/docs/wgig-background-report.pdf. World Bank. 2017. World Development Report 2017: Governance
Williams, Martin J., and Liah Yecalo-Tecle. 2020. “Innova- and the Law. Washington, DC: World Bank.
tion, Voice, and Hierarchy in the Public Sector: Evidence World Bank. 2020. Enhancing Government Effectiveness and
from Ghana’s Civil Service.” Governance 33 (4): 789–807. Transparency: The Fight against Corruption. Global Report
Wilson, Christopher. 2019. “Civil Society.” In The State of (revised October 3). Washington, DC: World Bank.
Open Data: Histories and Horizons, edited by Tim Davies, World Bank. 2021. Unraveling Data’s Gordian Knot: Enablers
Stephen B. Walker, Mor Rubinstein, and Fernando and Safeguards for Trusted Data Sharing in the New Economy.
Perini, 355–66. Ottawa, Canada: International Devel- Washington, DC: World Bank.
opment Research Center; Cape Town, South Africa: Wylie, Bianca, and Sean McDonald. 2018. “What Is a Data
African Minds. Trust?” Big Data, Platform Governance (blog). October 9,
WiredGov. 2019. “Digital Revolution to Use the Power 2018. https://www.cigionline.org/articles/what-data
of Data to Combat Illegal Wildlife Trade and Reduce -trust.

Franco World Data

Uploaded by

Copyright:

Available Formats

Franco World Data

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Franco World Data

Uploaded by

Copyright:

Available Formats

CHA

Institutions for data governance:

2 Nongovernmental institutions and mechanisms such as data interme-

3 Public institutions must have sufficient resources, adequate autonomy,

4 A multistakeholder, purpose-driven approach to data management and

Box 8.1 Uruguay’s whole-of-government approach to data governance

(Box continues next page)

266 | World Development Report 2021

Figure 8.1 Data governance and data management, working seamlessly together

Source: WDR 2021 team.

268 | World Development Report 2021

Box 8.2 The importance and complexity of data governance

Rule making and implementation

270 | World Development Report 2021

countries and 10 percent of lower-middle-income of development of a national data system in support

272 | World Development Report 2021

In progress or planned Established Separate data governance agency

274 | World Development Report 2021

Share of countries with

antitrust authority (%)

276 | World Development Report 2021

from civil society, the private sector, and academia.49

and the number and range of technicians and skills

In progress or planned Established Data intermediation and

278 | World Development Report 2021

280 | World Development Report 2021

Figure 8.7 Features of well-functioning institutions for eﬀective data governance

Performance- Coordination Leadership Multistakeholder governance

Transparency Functional autonomy Data literacy

Source: WDR 2021 team.

282 | World Development Report 2021

284 | World Development Report 2021

Assessing the institutional and processing, and technical capabilities in the

286 | World Development Report 2021

288 | World Development Report 2021

290 | World Development Report 2021

292 | World Development Report 2021

294 | World Development Report 2021

296 | World Development Report 2021

You might also like