A theme consistently stressed throughout the Forum’s multi-year engagement on personal data, and reflected within this document, is the inherent dynamism of the personal data economy. Complex and iterative, it needs approaches to governance which operate at the same clock speed and can be applied across the entire data value chain. There is a risk that by moving at such dramatically different speeds, policy frameworks that progressively lag behind innovation will not work.

Also constantly evolving is the position of the individual in the personal data ecosystem. From active participants who “volunteered” data, individuals are increasingly becoming passive data subjects. From providing relatively few details on an occasional basis, individuals in the modern economy are constantly producing data of a variety of types. Their capacity for meaningful influence and control over the disposition and use of data related to them has declined. Perhaps not coincidentally, their perception of the threats posed to them by data use has also grown.

Strengthening the principles of transparency, accountability and individual empowerment will serve as the cornerstones of a trusted and sustainable personal data economy. A central tension is the way that information correlates with power. The personal data environment is founded upon maintaining information differentials between individuals and institutions. One-sided notice and consent agreements, crafted to protect institutional interests and comply with regulatory requirements, are the vehicle for maintaining this gap. The incentives to change this are still limited. 

While the growth of data volumes is increasing exponentially, progress is occurring incrementally. One area where this is most evident is the gradual shift away from exclusively focusing on data collection and notice and consent as the exclusive points of data control. Usage-based approaches that complement existing frameworks for governing personal data are gaining wider recognition and support. Similarly, efforts to understand the expectations and explore the rights of individuals regarding personal data are gaining speed.

Overwhelmingly, approaches that start small, “fail fast” and focus on direct input from individuals are the most informative. The complex challenge of personal data must be broken into manageable component parts and progress made in an incremental fashion. “Stop trying to solve the overall problem and start focusing on fixing a problem” was advice heard on multiple occasions during the global dialogue.

The proposals outlined in this report are the first steps towards strengthening trust by regaining transparency, accountability and empowerment. In the near term, data taxonomies can streamline discussions and help establish a common understanding of data policies, providing a foundation for transparent and accountable use. Managing uses by measuring risks and benefits represents a tractable approach to accountability that re-orients data governance around individuals. At the same time, research and innovation into supporting technological and business infrastructure can, over time, drive the necessary scale and efficiencies for sustainability. Finally, thinking through the implications on data governance in the context of smart environments keeps the discussion on the leading edge of emerging issues rather than lagging behind.

However, as has been stressed in this report, many aspects of the personal data economy are inherently unknowable in an a priori sense. The proposed actions listed above must be executed in an applied context rather than an ivory tower. Appendix II of this document outlines three domains where new approaches can be explored for strengthening transparency, accountability and individual empowerment. 

In 19th-century Britain, the Locomotive Act of 1865 stipulated that self-propelled vehicles on public highways must be accompanied by a man with a red flag walking 60 yards ahead of the vehicle. The transportation policy sensibilities of one era (in which people principally travelled on foot or horseback) were applied to an emerging technology in a way that seems unthinkable to the modern observer. 

Although restrictive, this policy allowed for the use of early automobiles as the sector developed. However, it was only later that policy shifted from a prescriptive restriction (the man with the flag) and adopted a set of principles (traffic signals, speed limits, etc.) that relied on a highly distributed and human-centred coordination. What allowed the ecosystem to truly transform society were flexible approaches and small actions taken by millions of individuals. Red lights by themselves did not make cars stop and intersections safe. It was the shared agreement by everyone to put their foot on the brake that made the system work.  

The hope is that data governance policies follow a similar path – from prescriptive restrictions to flexible, accountable and human-centred principles. But this transformation cannot take the decades that were afforded previous generations. All stakeholders in the personal data economy – policy-makers, industry and civil society – need to move forward in ways that are efficacious rather than ideal. Through significant effort, ongoing dialogue and trial-and-error stakeholders can collectively remove the person with the red flag and begin to see personal data through a new lens for strengthening trust.