Data protection by design: Building the foundations of trustworthy data sharing

Sophie Stalla-Bourdillon,Gefion Thuermer,Laura Carmichael,Johanna Walker,Elena Simperl

doi:10.1017/dap.2020.1

Abstract

AbstractData trusts have been conceived as a mechanism to enable the sharing of data across entities where other formats, such as open data or commercial agreements, are not appropriate, and make data sharing both easier and more scalable. By our definition, a data trust is a legal, technical, and organizational structure for enabling the sharing of data for a variety of purposes. The concept of the “data trust” requires further disambiguation from other facilitating structures such as data collaboratives. Irrespective of the terminology used, attempting to create trust in order to facilitate data sharing, and create benefit to individuals, groups of individuals, or society at large, requires at a minimum a process-based mechanism, that is, a workflow that should have a trustworthiness-by-design approach at its core. Data protection by design should be a key component of such an approach.

Highlights

Data protection by design (DPbD) was recently introduced into law via Article 25 of the General Data Protection Regulation (GDPR)
We address the question of how the requirements of DPbD should shape the development of data trusts
Data trusts, as legal, technical, and organizational structures to enable the sharing of data, are conceived as an important tool to engender trust as part of a wider response to data sharing barriers that may impede data-driven innovation

Summary

Introduction

Data protection by design (DPbD) was recently introduced into law via Article 25 of the General Data Protection Regulation (GDPR). Less emphasized is that the requirement has a vital organizational dimension— that is, Article 25(1) places a legal obligation on controllers to “implement appropriate organisational and technical measures [...] to protect the rights of data subjects.” For instance, organizational measures may refer to the adoption of particular procedures and the selection of particular individuals to decide and action various aspects of data processing, including the type of privacy-enhancing technologies (PETs) to be employed across the data sharing and reusage lifecycle (The Royal Society, 2019).

Results

Conclusion