Private sector access to public sector personal data: exploring data value and benefit-sharing

Executive Summary

The aim of this review is to enable the Scottish Government to explore the issues relevant to the access of public sector personal data (as defined by the European Union General Data Protection Regulation, GDPR) with or by the private sector in publicly trusted ways, to unlock the public benefit of this data. This literature review will specifically enable the Scottish Government to establish whether there are

(I) models/approaches of costs/benefits/data value/benefit-sharing, and

(II) intellectual property rights or royalties schemes regarding the use of public sector personal data with or by the private sector both in the UK and internationally.

In conducting this literature review, we used an adapted systematic review, and undertook thematic analysis of the included literature to answer several questions central to the aim of this research. Such questions included:

• Are there any models of costs and/or benefits regarding the use of public sector personal data with or by the private sector?
• Are there any models of valuing data regarding the use of public sector personal data with or by the private sector?
• Are there any models for benefit-sharing in respect of the use of public sector personal data with or by the private sector?
• Are there any models in respect of the use of intellectual property rights or royalties regarding the use of public sector personal data with or by the private sector?

For all questions our inquiry focused on both the UK and internationally but was limited to literature available in English. Our literature review returned 7,715 items. We carried out additional citation tracing and also took on board literature suggestions by the commission team. After applying agreed inclusion and exclusion criteria, 55 sources were included in this study (Appendix I).

Our key findings can be summarised as follows:

• In the literature reviewed, notions are not understood in a straightforward way and their nuances should be embraced and disclaimed as appropriate.
• Public-sector bodies generally lag behind in developing and implementing data sharing regimes and data analytics as compared to the private sector; however, there are existing good practices in specific policy areas – such as in public health – where governments' sharing of personal data with the private sector is becoming a component of many governments' health and economic strategies.
• Studies demonstrate that ordinary people are supportive of health and social care data being used for public benefit but wish those public benefits to outweigh private profits and interests.
• When assessing costs and benefits of data sharing with the private sector, the studies assessed indicate that such costs and benefits should not be conceived of as solely financial but understood in broader, more social terms. In a related sense, while governments often conceptualise public benefit in economic terms, the public itself may not share this view and there is a need to distinguish between the framing of public benefit espoused by governments, with that understood by a plurality of public(s).
• The term public benefit is not well defined in the literature and is often used interchangeably with other terms such as the public interest and the common good. Where attempts are made to define public benefit, the literature indicates that this may include direct benefits – such as an income stream to the UK National Health Service (NHS) – and indirect benefits.
• There were prerequisites for achieving public benefit identified in the literature with values such as transparency that are very much connected to public benefit. By extension, public engagement in terms of data assessment is necessary as an input for public benefit, and to ensure a social license such that data is shared for the common good.
• There is some concern within the literature that a lack of a definition of public benefit may enable the concept to be exploited to facilitate access to, and commercialisation of, government-held personal data. Accordingly, the lack of a definition for public benefit could leave room for exploitation of the concept to promote government economic interests, which may not align with public conceptions of public benefit.
• There is a vast literature on data value in general. In relation to understandings of the 'value' of personal data, some of the literature surveyed indicated that this is jurisdiction specific and informed by the underlying context and socio-technical settlement. An additional theme in the literature surveyed was that the value of publicly held personal data cannot simply be defined in economic terms. Where the value of publicly held personal data is conceptualised in narrow economic terms, this is not sustainable in the long term, particularly in the healthcare domain.
• There were concerns that the so-called 'assetisation' of personal data may influence conceptions of value, thereby potentially resulting in a lack of public scrutiny and inequity in terms of access to knowledge. To overcome issues with 'assetisation' - and taking account of the socio-technical underpinnings of conceptions of value - value co-creation and exchange beyond the market was suggested as a way to take such issues out of the economic arena and re-contextualizing them to embrace co-creative approaches to how value is conceived of.
• Benefit-sharing is a concept typically associated with international environmental law and in particular, international biodiversity law to deliver commutative and distributive justice. Benefit-sharing is thus linked to justice and emphasises the optimisation of benefits to society, together with the minimisation of harm, and the achievement of equity.
• If data has the potential to benefit the public, it should be shared. Public benefit cannot be obtained in the absence of such sharing. However, the absence of common principles for trusted government-to-businesses (G2B) personal data sharing may lead to undue restrictions on data flows resulting in detrimental economic impacts. The literature surveyed identifies this and constraints for promoting G2B data sharing. Legal certainty was hence identified as required for such sharing to take place.
• Creative and fruitful collaboration schemes are being established between civic organisations and private actors (at times also engaging the public sector) to share personal data, as occurs for certain citizen science activities,with creative commons licensing schemes, value co-creation, and the reality of 'data cooperatives'.
• There is a growing attention in the literature for the concept of 'data altruism'as also incorporated in the European Union Data Governance Act; this reflects a tendency to embrace a fair and open sharing of personal data for public benefit.
• In the literature surveyed, we identified several guiding principles that could be of help for designing an appropriate framework for public sector personal data (benefit) sharing, among the others key principles are of proportionality, transparency, public engagement, co-creation of the concept of value, legal certainty and respect for ethical values and norms.
• Cross-national initiatives are being set up to provide options for the operational framework and governance models for the exchange and secondary use of personal data between countries and actors, respecting the principles of transparency, trust, FAIRness, citizen empowerment and common good.

Based on our findings, we recommend the following steps:

• When using certain terms in a policy document or official recommendations, remember that notions are not understood in a straightforward way in the literature and their nuances should be embraced and disclaimed as appropriate;
• Start with pilot sharing in those fields where studies demonstrate that ordinary people are supportive of health and social care data being used for public benefit but make sure that public benefit outweigh private profits and interests;
• Assess costs and benefits of data sharing with the private sector not only from a financial but also broader perspective, including broader social dimensions;
• Be aware of how framings from government as well as other dominant actors (such as market actors) can erode or undermine 'true' public benefit and engage the public via processes of public engagement on the assessment of public benefit and in the co-creation of the notion of value;
• Emphasise principles of commutative and distributive justice in considering benefit-sharing arising from the use of publicly held personal data;
• Implement effective strategies that tackle the identified constraints for promoting G2B data sharing, for example the absence of common principles on the matter;
• Turn to creative and fruitful collaboration schemes and initiativesexisting between research centres, civic organisations and private actors (at times also engaging the public sector) to share personal data, taking for example certain citizen science activities and the reality of data cooperatives and of creative commons licensing schemes;
• Respect key principles such as that of proportionality, transparency, accountability, and respect for ethical values and norms in designing frameworks for public sector personal data (benefit) sharing. Value co-creation should also be promoted in the construction of benefits.
• Seek to build social licence as a fundamental resource to ensure that private data sharing with businesses operates as a trigger for public good.

In terms of further work and studywhich could be undertaken to enhance understanding and knowledge in this area of focus;

• While beyond the scope of this literature review, it may be useful for the Scottish Government to define key terms to facilitate discussions in this field with a view to ensuring shared understandings of such terms.

• While also largely beyond the scope of this literature review, there may be much to learn from surveying benefit-sharing arrangements in the biodiversity worldwhere benefit-sharing is firmly embedded as both a principle and an outcome of access to certain forms of 'information. While such arrangements were included in this review to the extent they fell within our search focus, a broader review would arguably do greater justice to the potential commonalities across these areas.
• Our study, by necessity, focused on the sharing of personal data by public bodies and reviewed the literature within this context. There would be merit, however, to elicit further studies specifically focused on concepts such as value within data more generally. This would arguably yield a wider, and potentially more rounded, approach to the concept of value.