The Global Data Governance Project: 52 case studies

May 05, 2021

By: Thomas Struett and Susan Ariel Aaronson 1

Executive Summary:

Data is the most collected, analyzed, shared, and/or traded goods or services around the
world. Despite its ubiquity, data governance is a relatively new governance responsibility for
many countries. We know little about how nations govern various types of data at the national
and international level and what that means for the achievement of other important policy goals.
Data governance, however, is a relatively new governance responsibility for many countries.
The OECD defines data governance as principles, policies, standards, laws, regulations, and
agreements designed to control, manage, share, protect, and extract value from various types
of data.2 The World Bank also notes that the data driven economy can only be sustained by a
robust legal and regulatory data governance framework.3 However, there is no roadmap for data
governance.
To provide greater insights into what governments are doing, the Data Governance
Mapping Project at the Digital Trade and Data Governance Hub aims to illuminate whether and
how countries govern three different types of data: personal, public, and proprietary, at the
national and international levels. The project was funded by grants from Tufts University’s IDEA
2030 research initiative supported by the Mastercard Impact Fund; the Institute for Data,
Democracy, and Politics at GW; and the GWU Center for International Business.
Methodology: The team developed a questionnaire that covers 45 different aspects of
public, proprietary, and personal data governance for each country, at the national and
international levels. We focused on hard law: domestic laws, regulations and executive orders
related to data as well as international agreements and treaties governing data. We did not
evaluate enforcement of these laws, regulations, agreements or treaties.

We found:

● Data governance is a work in progress for every one of our case studies. Almost
every case study nation has put in place laws, regulations, and/or executive orders to
govern all three types of data.

● No nation seems close to comprehensive data governance, which we define as a

systemic and flexible approach to govern different types of data use and reuse.
Such a system regulates government as well as private sector use of personal and
proprietary data and empowers users. Ultimately, it moves “individuals and firms from a

1
Struett is Research Director and Aaronson is Director of the Digital Trade and Data Governance Hub.
We were assisted by: Dr. Carolina Aguerre, Brookklin Brown, Jarred Byers, Evan Magallanes, Duncan
Mathewson, Celeste Norton, Siaka Togola, Tri Vo, and Adam Zable.
2
OECD, Regulatory Effectiveness in the Era of Digitalization, June 2019,
https://www.oecd.org/gov/regulatory-policy/Regulatory-effectiveness-in-the-era-of-digitalisation.pdf
3
World Bank, World Development Report: Data for Better Lives, 2021, p. 189,
https://www.worldbank.org/en/publication/wdr2021

1
 system based on risk avoidance and aversion to one based on confidence in data
processes governing various types of data.”4

● Researchers often correlate income with quality of governance but we don’t know
if that’s equally true for data governance.5 In general, the nations doing the most in
data governance tend to have high incomes and are more experienced in using data.
These nations are more reliant on data innovation to grow their economy. Policymakers
in these nations may also see greater public demands to govern data (as example to
protect privacy and freedom of expression online). However, so far we have not found
income always correlates with comprehensive personal data governance. The US, as an
example, is just beginning to discuss how best to govern personal data at the national
level and how to achieve a more coherent approach to data use and reuse, data sharing
and personal data protection.The EU, the UK, and Australia are moving from proposals
to data sharing platforms and regulatory sandboxes.

● Policymakers are just beginning to think about the spillover effects of data
governance on their economy and on the achievement of other policy goals (for
example how trade secrets rules may affect individuals’ ability to control reuse of their
data or how the governance of personal data may affect national security).

● Significant convergence on personal data protection laws: Fifty one (or 98%) of our
case study countries had a personal data protection law; only the UAE did not.
Moreover, 64 percent of our cases had adopted a comprehensive approach to personal
data protection, which we defined as covering private and government use of data,
informed consent, an agency to enforce the law and rules governing 3rd party transfer or
sale of personal data. However, higher income countries did not have the most
comprehensive approaches to personal data protection. Several high income countries
such as Taiwan and New Zealand do not mandate informing data subjects when their
data is transferred or sold to a third party. We also find that many of the mechanisms
used in personal data protection that were popularized by the EU are now being put into
law in other parts of the world.

● Major convergence on public data governance: Over 80 percent of our case studies
had an open data law, meaning that in general data collected, utilized, analyzed, and
funded by the case study government was made open for its citizens and others to
utilize. However, many nations, including low income developing countries, are still

4
Australian Government Productivity Commission, “Data Availability and Use, Productivity Commission
Inquiry Report: Overview and Recommendations, No. 82, (2017)
5
Herbert H. Werlin, Poor Nations, Rich Nations: A Theory of Governance, Public Administration Review
Vol. 63, No. 3 (May - Jun., 2003), pp. 329-342, Angus Deaton, How do we improve governance in poor
countries? World Bank Blog,
https://www.weforum.org/agenda/2015/10/how-do-we-improve-governance-in-poor-countries/; and World
Bank, World Bank Governance Indicators,
https://info.worldbank.org/governance/wgi/Home/Documents#wgiDataCrossCtry

2
 figuring out how to govern public data and make it useful to their constituents, whether
for research or business purposes. Consequently, 48 percent do not mandate such data
be provided in a machine readable format which makes it easier to use and reuse.

● Some convergence on proprietary data governance: 76 percent of our cases had

enacted a trade secrets law and 80 percent of our cases participated in an international
trade agreement with trade secrets provisions. However, we found some evidence that
governments were pushing back against firm control of data use and reuse. For
instance, 47 percent of nations with a trade secret law did not give firms using data
analytics explicit control over data they analyzed using a mechanism protected under
trade secrets, while 52.9 percent of nations did give these firms such control.

● Significant convergence on data governance in trade agreements: 77 percent of our

cases participated in a trade agreement with provisions encouraging electronic
authentication and e-signatures; 71.2 percent participated in an agreement with
aspirational language to encourage interoperability of privacy regimes; and 78.8 percent
with aspirational language on cyber-security.

● We focused on four types of innovations in data governance to see if

governments were increasingly adopting these initiatives; investment reviews;6
corporate governance rules; data sharing and collective rights.

Investment Review: 19 percent of our case studies have enacted new laws that maintain
their countries' openness to foreign investment, but require a special review process to
ensure that such investment does not expose the nation to national security risks.

Corporate governance: 12 percent of our case studies require publicly held firms to use
financial reports to inform their stakeholders of breaches of personal data. Some 19
percent required a review of foreign investment in data-rich firms.

Data sharing: 67 percent of our cases encouraged sharing from business to government,
while 52 percent encouraged firms to share business confidential data with each other.

Collective rights: 30 percent of our case study nations had adopted personal data
protection rules that protected not just individual rights, but also encouraged individuals
to work with others to address collective harms caused by misuse of personal data.

6
Damien Van Pyvelde, Stephen Coulthart and M. Shahriar Hossa, Beyond the Buzzword: Big Data and
National Security Decision-making, Chatham House, 2017;
https://www.chathamhouse.org/sites/default/files/images/ia/INTA93_6_06_VanPuyvelde%20et%20al.pdf;
Susan Ariel Aaronson, Data is Dangerous, Comparing the Risks That the United States, Canada and
Germany See in Data Troves, CIGI Paper No. 241, 2020,
https://www.cigionline.org/publications/data-dangerous-comparing-risks-united-states-canada-and-germa
ny-see-data-troves

3
 Background

Selection of Case Studies7

We chose 52 countries from the 90 nations surveyed by the Tufts Digital Economy Index
(now the Digital Intelligence Index). The group of 90 nations includes many nations that have
some level of digital prowess, which we define as the ability to use data both to solve problems
and to create new and/or more efficient data driven goods and services. Nations with digital
prowess tend to be early innovators not only in the use of data, but also in the governance of
data.
To ensure that we created a balanced sample, we grouped countries by region and
income. Table 1 breaks down the sample by income and region. Table 2 illuminates the full set
of 52 countries. The 40 countries covered in this analysis include only one country from Africa
and we expect our statistics to change significantly when we present the full 52.

Table 1
Country Case Studies by Region and Income Using World Bank Metrics8

High income Upper middle income Lower middle income Low income Total

East Asia & Pacific 4 4 2 0 10

Europe & Central Asia 13 4 1 0 18

Latin America & Caribbean 1 4 1 0 6

Middle East & North Africa 3 2 1 0 6

North America 2 0 0 0 2
South Asia 0 0 3 0 3

Sub-Saharan Africa 0 1 3 2 6
Total 23 15 11 2

7
We received funding from Tufts/Mastercard to research 40 countries and two months later received
additional funds from GWU Center for International Business and Economic Research (funding from the
US Government) and GWU’s Institute for Data, Democracy, and Politics, funded by various US
foundations such as Knight and Ford.
8
The European Union is a case study “nation,” but it is not included in this table because the World Bank
does not include it in its regional or country specific income groupings.

4
 Table 2:
Country List

Country Region Income category

Japan East Asia & Pacific High income
Singapore East Asia & Pacific High income
South Korea East Asia & Pacific High income
Taiwan East Asia & Pacific High income
China East Asia & Pacific Upper middle income
Indonesia East Asia & Pacific Upper middle income
Malaysia East Asia & Pacific Upper middle income
Thailand East Asia & Pacific Upper middle income
Philippines East Asia & Pacific Lower middle income
Vietnam East Asia & Pacific Lower middle income
Australia Europe & Central Asia High income
Estonia Europe & Central Asia High income
Germany Europe & Central Asia High income
France Europe & Central Asia High income
Finland Europe & Central Asia High income
Hungary Europe & Central Asia High income
Ireland Europe & Central Asia High income
Netherlands Europe & Central Asia High income
New Zealand Europe & Central Asia High income
Norway Europe & Central Asia High income
United Kingdom Europe & Central Asia High income
Switzerland Europe & Central Asia High income
Sweden Europe & Central Asia High income
Azerbaijan Europe & Central Asia Upper middle income
Georgia Europe & Central Asia Upper middle income
Russia Europe & Central Asia Upper middle income
Turkey Europe & Central Asia Upper middle income
Ukraine Europe & Central Asia Lower middle income
European Union Europe & Central Asia
Uruguay Latin America & Caribbean High income
Argentina Latin America & Caribbean Upper middle income
Brazil Latin America & Caribbean Upper middle income
Chile Latin America & Caribbean Upper middle income
Mexico Latin America & Caribbean Upper middle income

5
Bolivia Latin America & Caribbean Lower middle income
Israel Middle East & North Africa High income
Saudi Arabia Middle East & North Africa High income
United Arab Emirates Middle East & North Africa High income
Iran Middle East & North Africa Upper middle income
Jordan Middle East & North Africa Upper middle income
Morocco Middle East & North Africa Lower middle income
Canada North America High income
United States North America High income
Bangladesh South Asia Lower middle income
India South Asia Lower middle income
Pakistan South Asia Lower middle income
South Africa Sub-Saharan Africa Upper middle income
Côte d’Ivoire Sub-Saharan Africa Lower middle income
Kenya Sub-Saharan Africa Lower middle income
Nigeria Sub-Saharan Africa Lower middle income
Ethiopia Sub-Saharan Africa Low income
Uganda Sub-Saharan Africa Low income

Development of Questionnaire

During the summer and fall of 2020, Hub staff were asked to review the World Bank’s
questionnaire for the World Development Report which focused on data as a tool for
development and the role of data governance in that process. That questionnaire served as the
foundation for the World Bank’s Digital Business Indicators.9 We used that questionnaire as a
baseline for our own approach. However, we adopted a different analytical strategy and took a
broader scope in examining data governance. Instead of mailing a questionnaire to government
officials, we performed a desk study. We also added questions to cover both the three types of
data as well as investment and corporate governance laws, regulations, and executive orders
that directly govern various types of data.

We used an iterative process to develop the questionnaire. First, we asked several scholars of
data governance to review and critique the questionnaire and we revised the draft based on

9
Digital Business Indicators measure the laws, regulations, and bureaucratic processes that affect digital
businesses in 21 pilot countries. They cover: connectivity, data privacy and security, logistics, payment,
and digital market regulations. The indicators are based on information collected through questionnaires
administered to experts in the private sector and public sector authorities,in each country. Once the data
were collected, the study team analyzed the information in conjunction with publicly available data on
agency websites and the texts of relevant laws and regulations. The data are current as of June 30, 2018,
and do not reflect any changes to the laws or administrative procedures after that date.
https://pubdocs.worldbank.org/en/581091563808671795/Digital-Business-Indicators-Methodology-Notes.
pdf

6
their comments.10 Next, as we began to use the questionnaire, we discarded or revised
confusing questions. Ultimately, we narrowed the research to 45 key questions that assess:

1. Where data governance occurs:

- domestic law (we do not cover state or provincial law)
- international agreements, treaties, etc.
2. What type of data is being governed:
- Personal data
- Generic data (all types of data)
- Public data - info created/collected/processed/ disseminated/ disposed of for/by public
sector information bodies (all branches of government produce and commission huge
quantities of data and information. Governments increasingly encourage the use, reuse,
and free distribution of data to stimulate innovation and better service delivery.
- Proprietary data; data governed under trade secrets law or regulations. Firms often use
trade secrets (such as algorithms to reuse data they have collected and/or analyzed.
3. When the data is governed, e.g. when it is:
-collected, stored, processed, and/or transferred
4. Who are the government entities governing data
5. How: An analysis of the approach governments take to data governance. The how will be
reflected in our analysis of innovative and comprehensive data governance.

Findings

We have divided our findings into 5 groups:

● Personal data
● Public data
● Trade secrets governance of data
● Governance of data in trade agreements
● National data governance innovation

Findings related to the Governance of Personal Data

Nations have developed different approaches to protecting personal data. As a result, our
questionnaire included 17 questions which identify key elements of personal data governance.

10
Reviewers included Dr. Carolina Aguerre, University of St. Andrews, Argentina; Stefaan Verhulst, NYU;
and Dr. Kristina Irion, University of Amsterdam, the Netherlands.

7
First we sought to examine if the country had a basic personal data protection law governing
public use of personal data; and a law governing private sector use of personal data. Ninety
percent of our case study nations had a law (laws) governing personal data used by both public
and private entities.

Eighty-five percent of our cases had a law requiring the creation of an agency tasked with
enforcing personal data protection.

8
Ninety percent of our cases had a law requiring informed consent--that data subjects must be
informed as to how their personal data was being used.

Finally, 83 percent had a law or regulations requiring data controllers to inform data subjects
when their data is transferred or sold to third parties.

9
Next we provide a more country specific overview of these key elements of personal data
protection in Table 3. A ✓ means the law has these attributes, a ∅ means it does not.

Table 3: Overview of Comprehensive Personal Data Governance

Must inform
Personal data subjects when
protection their data is
private and Agency for Informed transferred or
Country Region Income category public enforcement consent sale to third party
Japan East Asia & Pacific High income ✓ ✓ ✓ ✓
Singapore East Asia & Pacific High income ✓ ✓ ✓ ✓
South Korea East Asia & Pacific High income ✓ ✓ ✓ ✓
Taiwan East Asia & Pacific High income ✓ ✓ ✓ ∅
China East Asia & Pacific Upper middle income Private only ∅ ✓ ✓
Indonesia East Asia & Pacific Upper middle income ✓ ✓ ✓ ✓
Malaysia East Asia & Pacific Upper middle income Private only ✓ ✓ ✓
Thailand East Asia & Pacific Upper middle income ✓ ✓ ✓ ∅
Philippines East Asia & Pacific Lower middle income ✓ ✓ ✓ ✓
Vietnam East Asia & Pacific Lower middle income ✓ ✓ ✓ ✓
European Union Europe & Central Asia ✓ ✓ ✓ ✓
Australia Europe & Central Asia High income ✓ ✓ ✓ ✓
Estonia Europe & Central Asia High income ✓ ✓ ✓ ✓
Germany Europe & Central Asia High income ✓ ✓ ✓ ✓
France Europe & Central Asia High income ✓ ✓ ✓ ✓

10
Finland Europe & Central Asia High income ✓ ✓ ✓ ✓
Hungary Europe & Central Asia High income ✓ ✓ ✓ ✓
Ireland Europe & Central Asia High income ✓ ✓ ✓ ∅
Netherlands Europe & Central Asia High income ✓ ✓ ✓ ✓
New Zealand Europe & Central Asia High income ✓ ✓ ✓ ∅
Norway Europe & Central Asia High income ✓ ✓ ✓ ✓
United Kingdom Europe & Central Asia High income ✓ ✓ ✓ ✓
Switzerland Europe & Central Asia High income ✓ ✓ ✓ ✓
Sweden Europe & Central Asia High income ✓ ✓ ✓ ✓
Azerbaijan Europe & Central Asia Upper middle income ✓ ✓ ✓ ✓
Georgia Europe & Central Asia Upper middle income ✓ ∅ ✓ ✓
Russia Europe & Central Asia Upper middle income ✓ ✓ ✓ ✓
Turkey Europe & Central Asia Upper middle income ✓ ✓ ✓ ✓
Ukraine Europe & Central Asia Lower middle income ✓ ✓ ✓ ✓
Uruguay Latin America & Caribbean High income ✓ ✓ ✓ ✓
Argentina Latin America & Caribbean Upper middle income ✓ ✓ ✓ ✓
Brazil Latin America & Caribbean Upper middle income ✓ ✓ ✓ ✓
Chile Latin America & Caribbean Upper middle income ✓ ∅ ✓ ∅
Mexico Latin America & Caribbean Upper middle income ✓ ✓ ✓ ∅
Bolivia Latin America & Caribbean Lower middle income ✓ ∅ ✓ ✓
Israel Middle East & North Africa High income ✓ ✓ ✓ ✓
Saudi Arabia Middle East & North Africa High income ✓ ∅ ∅ ✓
United Arab
Emirates Middle East & North Africa High income ∅ ✓ ∅ ✓
Iran Middle East & North Africa Upper middle income ✓ ∅ ✓ ✓
Jordan Middle East & North Africa Upper middle income ✓ ∅ ∅ ∅
Morocco Middle East & North Africa Lower middle income ✓ ✓ ✓ ✓
Canada North America High income ✓ ✓ ✓ ∅
United States North America High income ✓ ✓ ✓ ✓
Bangladesh South Asia Lower middle income ✓ ✓ ∅ ✓
India South Asia Lower middle income ✓ ∅ ✓ ✓
Pakistan South Asia Lower middle income ∅ ✓ ✓ ✓
Ethiopia Sub-Saharan Africa Low income Public only ✓ ∅ ✓
Uganda Sub-Saharan Africa Low income ✓ ✓ ✓ ✓
South Africa Sub-Saharan Africa Upper middle income ✓ ✓ ✓ ∅
Côte d’Ivoire Sub-Saharan Africa Lower middle income ✓ ✓ ✓ ✓
Kenya Sub-Saharan Africa Lower middle income ✓ ✓ ✓ ✓
Nigeria Sub-Saharan Africa Lower middle income ✓ ✓ ✓ ✓

To our surprise, most countries at all income levels took a comprehensive approach. Moreover,
income did not directly correlate with the comprehensiveness of personal data protection. Some

11
high income countries such as the UAE have no law protecting personal data; Several high
income countries such as Taiwan and New Zealand do not mandate informing data subjects
when their data is transferred or sold to a third party.

Rules and Regulations Governing Public Data

In this next section, we provide an overview of whether the government has made public data
open for review, use, and reuse.

We first examined if our case studies have enacted a law or regulation requiring that it do so
with certain exceptions such as for national security data. Eighty-one percent of our case
studies had such a law.

Fifty-two percent of our case studies had a law requiring that various types of data should be
made available in a machine readable format. Such a law makes it easier for non-governmental
entities to reuse public data and/or mix it with other data sets.

12
Seventy-one percent of our cases required that publicly funded datasets should be made
available and accessible to the public at large.

Table 5 summarizes our case studies’ governance of public data. It reveals that many nations
are still figuring out how to govern public data and make it useful to their constituents, whether
for research or business purposes. A ✓ means the government has such a law, a ∅ means they

13
do not. As you can see, many nations, including high income nations do not have public data
laws and or require such openness.

Table 5: Governance of Public Data

Machine Open publicly

Country Region Income category open data act Readable funded datasets
Japan East Asia & Pacific High income ✓ ∅ ✓
Singapore East Asia & Pacific High income ∅ ∅ ∅
South Korea East Asia & Pacific High income ✓ ✓ ✓
Taiwan East Asia & Pacific High income ✓ ∅ ✓
China East Asia & Pacific Upper middle income ✓ ✓ ∅
Indonesia East Asia & Pacific Upper middle income ✓ ∅ ✓
Malaysia East Asia & Pacific Upper middle income ✓ ✓ ∅
Thailand East Asia & Pacific Upper middle income ✓ ✓ ✓
Philippines East Asia & Pacific Lower middle income ✓ ✓ ✓
Vietnam East Asia & Pacific Lower middle income ✓ ✓ ✓
European Union Europe & Central Asia ∅ ∅ ✓
Australia Europe & Central Asia High income ✓ ✓ ✓
Estonia Europe & Central Asia High income ✓ ✓ ✓
Germany Europe & Central Asia High income ✓ ✓ ✓
France Europe & Central Asia High income ✓ ✓ ✓
Finland Europe & Central Asia High income ✓ ✓ ✓
Hungary Europe & Central Asia High income ✓ ✓ ✓
Ireland Europe & Central Asia High income ∅ ∅ ✓
Netherlands Europe & Central Asia High income ✓ ∅ ✓

14
New Zealand Europe & Central Asia High income ✓ ✓ ✓
Norway Europe & Central Asia High income ✓ ✓ ∅
United Kingdom Europe & Central Asia High income ∅ ∅ ✓
Switzerland Europe & Central Asia High income ✓ ∅ ✓
Sweden Europe & Central Asia High income ✓ ✓ ✓
Azerbaijan Europe & Central Asia Upper middle income ✓ ✓ ✓
Georgia Europe & Central Asia Upper middle income ∅ ∅ ∅
Russia Europe & Central Asia Upper middle income ✓ ∅ ∅
Turkey Europe & Central Asia Upper middle income ∅ ∅ ∅
Ukraine Europe & Central Asia Lower middle income ✓ ∅ ✓
Uruguay Latin America & Caribbean High income ✓ ✓ ✓
Argentina Latin America & Caribbean Upper middle income ✓ ✓ ✓
Brazil Latin America & Caribbean Upper middle income ✓ ✓ ✓
Chile Latin America & Caribbean Upper middle income ✓ ∅ ✓
Mexico Latin America & Caribbean Upper middle income ✓ ∅ ∅
Bolivia Latin America & Caribbean Lower middle income ✓ ∅ ∅
Israel Middle East & North Africa High income ✓ ∅ ✓
Saudi Arabia Middle East & North Africa High income ✓ ∅ ✓
United Arab Emirates Middle East & North Africa High income ∅ ∅ ∅
Iran Middle East & North Africa Upper middle income ✓ ∅ ∅
Jordan Middle East & North Africa Upper middle income ✓ ✓ ∅
Morocco Middle East & North Africa Lower middle income ✓ ∅ ✓
Canada North America High income ✓ ✓ ✓
United States North America High income ✓ ✓ ✓
Bangladesh South Asia Lower middle income ✓ ✓ ✓
India South Asia Lower middle income ✓ ✓ ✓
Pakistan South Asia Lower middle income ✓ ✓ ✓
Ethiopia Sub-Saharan Africa Low income ✓ ∅ ✓
Uganda Sub-Saharan Africa Low income ∅ ∅ ∅
South Africa Sub-Saharan Africa Upper middle income ✓ ✓ ✓
Côte d’Ivoire Sub-Saharan Africa Lower middle income ✓ ✓ ✓
Kenya Sub-Saharan Africa Lower middle income ∅ ∅ ∅
Nigeria Sub-Saharan Africa Lower middle income ∅ ∅ ∅

Rules Governing Trade Secrets

Firms can use trade secret laws to protect algorithms, techniques, and other mechanisms.
These firms rely on trade secrets rather than other forms of intellectual property protection in
several conditions: when a firm is working with a technology that can’t be easily reverse
engineered or independently developed, when the technology is characterized by rapid

15
development, and when technologies cannot easily be described. Hence, data driven
technologies such as AI technologies are particularly well suited to protection by trade secrets.
In addition, firms that use trade secrets to protect proprietary data can also control the use and
reuse of personal data sets that they have analyzed using these techniques.11 Finally, many
governments have enhanced their trade secrets protection in the wake of rising trade secret
theft.12 For these reasons, we sought to see how such rules affected data governance and
control and ownership of data.

We first asked if the country had a trade secrets law and found 76.9 percent had enacted such a
law.

11
Stacey Collett, How to protect algorithms as intellectual property CSO, July 13, 2020,
https://www.csoonline.com/article/3565195/how-to-protect-algorithms-as-intellectual-property.html; and
Jessica M. Meyers, Artificial Intelligence and Trade Secrets, ABA Webinar Feature, January/February
2019,
https://www.americanbar.org/groups/intellectual_property_law/publications/landslide/2018-19/january-febr
uary/artificial-intelligence-trade-secrets-webinar/
12
Curiak, Dan and Ptashkina, Maria, Quantifying Trade Secret Theft: Policy Implications (April 9, 2021).
CIGI Paper 253. Waterloo: Centre for International Governance Innovation., Available at SSRN:
https://ssrn.com/abstract=3706511 or http://dx.doi.org/10.2139/ssrn.3706511

16
We next sought to understand if under trade secrets law, firms could claim control over data that
was analyzed by proprietary datasets and/or algorithms. While some 46.2 percent did not grant
such control, 53.8 percent of our cases did.

We were surprised to see some countries did not have a trade secrets law yet agreed to
language governing trade secrets in trade agreements. We hypothesize that these countries
may be signaling their respect for less formal IPR protections without officially including these
practices in domestic law.

17
 Table 6: Comprehensive Governance of Trade Secrets

Has the country

agreed to trade
Does it grant firms secret rules in
Trade control over data international
Country Region Income category secrets law use and reuse agreements
Japan East Asia & Pacific High income ✓ ✓ ✓
Singapore East Asia & Pacific High income ∅ ∅ ✓
South Korea East Asia & Pacific High income ✓ ✓ ✓
Taiwan East Asia & Pacific High income ✓ ✓ ✓
China East Asia & Pacific Upper middle income ✓ ✓ ✓
Indonesia East Asia & Pacific Upper middle income ✓ ✓ ✓
Malaysia East Asia & Pacific Upper middle income ✓ ∅ ✓
Thailand East Asia & Pacific Upper middle income ✓ ✓ ✓
Philippines East Asia & Pacific Lower middle income ✓ ✓ ✓
Vietnam East Asia & Pacific Lower middle income ✓ ✓ ✓
European Union Europe & Central Asia ✓ ✓ ✓
Australia Europe & Central Asia High income ✓ ✓ ✓
Estonia Europe & Central Asia High income ∅ ∅ ✓
Germany Europe & Central Asia High income ✓ ✓ ✓
France Europe & Central Asia High income ✓ ✓ ✓
Finland Europe & Central Asia High income ✓ ✓ ✓
Hungary Europe & Central Asia High income ✓ ✓ ✓
Ireland Europe & Central Asia High income ✓ ✓ ✓
Netherlands Europe & Central Asia High income ✓ ✓ ✓
New Zealand Europe & Central Asia High income ∅ ∅ ✓
Norway Europe & Central Asia High income ✓ ✓ ✓
United Kingdom Europe & Central Asia High income ✓ ✓ ✓
Switzerland Europe & Central Asia High income ✓ ∅ ✓
Sweden Europe & Central Asia High income ✓ ✓ ✓
Azerbaijan Europe & Central Asia Upper middle income ✓ ∅ ∅
Georgia Europe & Central Asia Upper middle income ∅ ∅ ✓
Russia Europe & Central Asia Upper middle income ✓ ∅ ✓
Turkey Europe & Central Asia Upper middle income ✓ ✓ ✓
Ukraine Europe & Central Asia Lower middle income ✓ ✓ ✓
Uruguay Latin America & Caribbean High income ✓ ∅ ∅
Argentina Latin America & Caribbean Upper middle income ✓ ∅ ∅
Brazil Latin America & Caribbean Upper middle income ✓ ∅ ✓

18
Chile Latin America & Caribbean Upper middle income ✓ ∅ ∅
Mexico Latin America & Caribbean Upper middle income ✓ ✓ ∅
Bolivia Latin America & Caribbean Lower middle income ∅ ∅ ∅
Israel Middle East & North Africa High income ✓ ∅ ✓
Saudi Arabia Middle East & North Africa High income ✓ ∅ ✓
United Arab Emirates Middle East & North Africa High income ✓ ✓ ✓
Iran Middle East & North Africa Upper middle income ✓ ✓ ∅
Jordan Middle East & North Africa Upper middle income ✓ ∅ ✓
Morocco Middle East & North Africa Lower middle income ∅ ∅ ✓
Canada North America High income ∅ ∅ ✓
United States North America High income ✓ ✓ ✓
Bangladesh South Asia Lower middle income ✓ ∅ ✓
India South Asia Lower middle income ∅ ∅ ✓
Pakistan South Asia Lower middle income ∅ ∅ ✓
Ethiopia Sub-Saharan Africa Low income ∅ ∅ ✓
Uganda Sub-Saharan Africa Low income ✓ ✓ ✓
South Africa Sub-Saharan Africa Upper middle income ✓ ✓ ∅
Côte d’Ivoire Sub-Saharan Africa Lower middle income ✓ ✓ ✓
Kenya Sub-Saharan Africa Lower middle income ∅ ∅ ∅
Nigeria Sub-Saharan Africa Lower middle income ∅ ∅ ∅

Governance of Data in Trade Agreements

Many but not all of our case studies participated in digital trade or e-commerce agreements.We
focused here on 3 aspects. First, 76.9 percent of our case study nations participated in trade
agreements with language facilitating the use of electronic authorization and e-signatures. Such
provisions can build trust and facilitate trade relations.

19
Most of these trade agreements say “enforce your own laws” on privacy, spam, and consumer
protection. But some trade agreements use aspirational language to promote cooperation and
interoperability for personal data protection regimes. 71.2 percent of our case study nations
participated in a trade agreement with such language.

20
Finally, we sought to see if the government agreed to a trade agreement with aspirational
language promoting cyber-security and found 76.9 percent participated in an agreement with
such language.

The table below reveals that countries of all income levels participated in a trade agreement
with a wide range of provisions on e-signatures, cooperation on interoperability for data
protection regimes, and on cybersecurity. While 87 percent of high income countries agreed to
each of these provisions, only 43 percent of upper middle income to low income countries has

21
these provisions. Lower income countries (countries with a relatively small data-driven economy
and data exports were less likely to participate in such agreements.)

Table 6: Case Study Participation in Trade Agreements with Comprehensive Language

on Data Governance

Personal data
e-signature/ protection cybersecurity
Country Region Income category authentication cooperation cooperation

Japan East Asia & Pacific High income ✓ ✓ ✓

Singapore East Asia & Pacific High income ✓ ✓ ✓
South Korea East Asia & Pacific High income ✓ ✓ ✓
Taiwan East Asia & Pacific High income ✓ ✓ ✓
China East Asia & Pacific Upper middle income ✓ ✓ ✓
Indonesia East Asia & Pacific Upper middle income ✓ ✓ ✓
Malaysia East Asia & Pacific Upper middle income ✓ ✓ ✓
Thailand East Asia & Pacific Upper middle income ✓ ✓ ✓
Philippines East Asia & Pacific Lower middle income ✓ ✓ ✓
Vietnam East Asia & Pacific Lower middle income ✓ ✓ ✓
European Union Europe & Central Asia ✓ ✓ ✓
Australia Europe & Central Asia High income ✓ ✓ ✓
Estonia Europe & Central Asia High income ✓ ✓ ✓
Germany Europe & Central Asia High income ✓ ✓ ✓
France Europe & Central Asia High income ✓ ✓ ✓
Finland Europe & Central Asia High income ✓ ✓ ✓
Hungary Europe & Central Asia High income ✓ ✓ ✓
Ireland Europe & Central Asia High income ✓ ✓ ✓
Netherlands Europe & Central Asia High income ✓ ✓ ✓
New Zealand Europe & Central Asia High income ✓ ✓ ✓
Norway Europe & Central Asia High income ✓ ∅ ✓
United Kingdom Europe & Central Asia High income ✓ ✓ ✓
Switzerland Europe & Central Asia High income ✓ ✓ ✓
Sweden Europe & Central Asia High income ✓ ✓ ✓
Azerbaijan Europe & Central Asia Upper middle income ∅ ∅ ∅
Georgia Europe & Central Asia Upper middle income ✓ ✓ ✓
Russia Europe & Central Asia Upper middle income ✓ ∅ ✓
Turkey Europe & Central Asia Upper middle income ✓ ✓ ∅

22
Ukraine Europe & Central Asia Lower middle income ✓ ✓ ✓
Uruguay Latin America & Caribbean High income ✓ ∅ ✓
Argentina Latin America & Caribbean Upper middle income ✓ ✓ ✓
Brazil Latin America & Caribbean Upper middle income ∅ ∅ ∅
Chile Latin America & Caribbean Upper middle income ✓ ✓ ✓
Mexico Latin America & Caribbean Upper middle income ✓ ∅ ✓
Bolivia Latin America & Caribbean Lower middle income ∅ ∅ ∅
Israel Middle East & North Africa High income ✓ ✓ ✓
Saudi Arabia Middle East & North Africa High income ✓ ∅ ∅
United Arab Emirates Middle East & North Africa High income ✓ ✓ ✓
Iran Middle East & North Africa Upper middle income ∅ ∅ ∅
Jordan Middle East & North Africa Upper middle income ✓ ✓ ✓
Morocco Middle East & North Africa Lower middle income ✓ ✓ ✓
Canada North America High income ✓ ✓ ✓
United States North America High income ✓ ✓ ✓
Bangladesh South Asia Lower middle income ∅ ∅ ∅
India South Asia Lower middle income ∅ ∅ ✓
Pakistan South Asia Lower middle income ✓ ✓ ∅
Ethiopia Sub-Saharan Africa Low income ∅ ✓ ✓
Uganda Sub-Saharan Africa Low income ∅ ✓ ✓
South Africa Sub-Saharan Africa Upper middle income ∅ ∅ ∅
Côte d’Ivoire Sub-Saharan Africa Lower middle income ∅ ∅ ∅
Kenya Sub-Saharan Africa Lower middle income ∅ ∅ ∅
Nigeria Sub-Saharan Africa Lower middle income ∅ ∅ ∅

Innovation in Data Governance

To better understand how data governance innovation is adopted by various countries, we

focused on 4 types of innovative approaches to the governance of data. We looked at corporate
governance rules; investment reviews; data sharing strategies; and a broader vision of personal
data protection which covers collective as well as individual rights.

Corporate governance

Several nations use corporate governance rules to directly regulate how their firms govern,
protect, and utilize data. Nearly ten percent of our case studies require publicly held firms to use

23
financial reports to inform their stakeholders of breaches of personal data. Such corporate
reporting could act as a further incentive to firms to protect personal data.

Data sharing strategies

Governments increasingly understand that they can use policies to encourage data sharing
among different entities. Governments that share data with the public and civil society sectors
may unlock or expose new information. Meanwhile, firms that share data with governments and
or other firms and researchers may discover new efficiencies, develop new or improve existing
products, create new or better services, solve problems, or find new collaborators. However,
without trust mechanisms, entities are often reluctant to share data. Sixty-nine percent of our
cases had established rules or policies to encourage businesses to share their data with
government bodies. Fifty-two percent had established policies or rules to encourage business to
share data with other firms. But the road between business and government seems to flow from
government to business; few had rules encouraging firms to share their business confidential
data with government entities in the public interest, as the EU plans.13

13
https://digital-strategy.ec.europa.eu/en/policies/strategy-data

24
Investment reviews of Data Rich Firms

In recent years, policymakers in several states have come to recognize that personal data sets
can be stolen from both public and private sources and cross-referenced to reveal individual as
well as national security secrets. As a result, some countries have enacted laws restricting
foreign investment in data-rich firms or they mandated that such investments must undergo a

25
special review process. While the bulk of countries had not done so, 19.2 percent had enacted
such a law.

Advance Collective as Well as Individual Rights in Personal Data Protection Laws

Big data analytics often requires a huge supply of personal data (both individual and collective
data), which is collected, anonymized, grouped, and then analyzed to make decisions,
correlations, and predictions. Individuals categorized by such techniques often don’t know that
they have been “sorted.”

However, recent history is rife with examples of bias and individual as well as collective
data-driven harms (harms to groups of individuals). For example, a 2019 study, published by
Science found that some U.S. hospitals and insurers managed care by utilizing an algorithm14
that discriminated against people of color with complex medical needs. Thirty-one percent of our
case study nations, including the EU, had updated their data protection laws to allow individuals
to band together to collectively challenge misuse of their data.15

14
https://science.sciencemag.org/content/366/6464/447/tab-pdf
15
https://data.consilium.europa.eu/doc/document/ST-9573-2020-REV-1/en/pdf

26
 Next steps:

We are beginning to draft our analysis of innovative data governance and comprehensive data
governance due June 1.

We are trying to get a better understanding of convergence and divergence in approaches to

data governance.

Meeting on May 11 to discuss findings.

As we analyzed the data, we are mindful that we are missing the role of soft law: government
strategies (AI plans; data sharing platforms and data trusts), smart manufacturing plans,
standards, and the norm setting clubs (the D-10 and the International Grand Committee, G-7
etc). We would welcome a discussion of whether and how we might include these aspects in a
future project proposal.

27