Data Equity Principle 2

Description

Data privacy policies protect the right of individuals to maintain control over their data. They include a combination of federal, state, and local laws—including the Family Educational Rights and Privacy Act (FERPA)—and institutional policies. Most policies focus on protecting personal information—or information that is important to an individual (even if it does not personally identify them)—and regulating data access and use, thereby limiting emotional, financial, and even physical harm that can result from data privacy breaches. Although privacy considerations are critical, it is also important to understand and honor data ownership. Data users must acknowledge that data providers are data owners that consent to the use of their data.

Data privacy policies have evolved in recent years to better reflect that data systems do not “own” data more than the people whose lives are represented in them. In 2018, the European Union passed the General Data Protection Regulation, which gives European residents the right to know, access, update, erase, and restrict the types of data collected on them. Since 2020, the California Consumer Privacy Act (CCPA) requires businesses (including for-profit education service providers and for-profit universities) to obtain parent or guardian consent before collecting data from California’s children and to delete data upon request, among other things (CCPA has inspired similar laws in other states). A common feature of these laws is that they grant individuals the ability to update, delete, or opt out of all or specific applications of their data at any point during or after collection. Even if not mandated by law, E-W data systems should have a clear process for accepting these requests and clear guidelines around honoring them.

Data users should consult community members to determine data access guidelines and practices, weighing the risks and benefits of both restricting and opening access to data. Data access refers to who can securely obtain, view, or use data, and for what purposes. There are legal, practical, and equity considerations for determining data access, which can range across contexts. For example, sharing administrative data with E-W system partners or researchers can increase the risk of a data breach, yet not sharing data can make it more difficult to understand and address a problem of practice, at least without duplicating data collection efforts that burden communities. At a minimum, communities should have access to their own data (abiding with any privacy or confidentiality rules). But access is different from ownership. To shift power dynamics and honor communities’ own goals and visions, communities should have the right to govern the collection, ownership, and use of their data. This is a key principle of Indigenous data sovereignty, for example.^xxxii

E-W data systems should establish a participatory governance structure that includes representation from the affected communities to determine which data are open, restricted, or unavailable and—as with requests from individuals about their own data—develop a clear process for accepting and approving requests from potential data users. After a project ends, data users should consider secure methods by which they can return data (for example, in aggregate form) to the communities, the data owners, to allow continued or future use of their data for other purposes.

^{xxxii See this 2018 resolution from the National Congress of American Indians: “Support for U.S. Indigenous Data Sovereignty and Inclusion of Tribes in the Development of Tribal Data Governance Principles.”}