The Urgent Need to Reimagine Data Consent

In June 2023, the United Nations High Commissioner for Refugees (UNHCR) announced a grim milestone. The war in Ukraine, combined with upheaval in Afghanistan, Sudan, and other areas, had created a record 110 million forcibly displaced people globally. This situation, Filippo Grand, the head of UNHCR, announced, is “an indictment on the state of our world.”

2023’s upsurge in forced migration represents the intensification of an ongoing trend. Year after year, the world has witnessed unprecedented forcible movements of people. As policy makers struggle to respond to the unfolding human catastrophe, they have increasingly turned to the possibilities offered by technology, and data in particular. Civil society and humanitarian organizations are attuned to the reality that these streams of people generate massive amounts of data that can, for instance, help channel aid to the neediest, predict disease outbreaks, and much more.

Yet as is so often the case with technology, the potential for good is accompanied by certain risks. While data may be collected through individual consent, much of the refugee-associated data is used without the relevant populations being able to determine how, for what purpose, and for how long. The lack of agency on how their data is used means that migrant populations are susceptible to a variety of risks associated with group privacy, lack of autonomy, and personal security. These are exacerbated by the inherent power imbalances between migrants and those collecting the data, as well as by a frequent lack of data literacy among migrant populations.

Recognizing the significant benefits that can arise from the use and reuse of data to tackle contemporary challenges such as migration, it is worth exploring new approaches to collect and utilize data that empower individuals and communities, granting them the ability to determine how their data can be utilized for various personal, community, and societal causes. This need is not specific to migrants alone. It applies to various regions, populations, and fields, ranging from public health and education to urban mobility. There is a pressing demand to involve communities, often already vulnerable, to establish responsible access to their data that aligns with their expectations, while simultaneously serving the greater public good.

We believe the answer lies through a reimagination of the concept of consent. Traditionally, consent has been the tool of choice to secure agency and individual rights, but that concept, we would suggest, is no longer sufficient to today’s era of datafication. Instead, we should strive to establish a new standard of social license. Here, we’ll define what we mean by a social license and outline some of the limitations of consent (as it is typically defined and practiced today). Then we’ll describe one possible means of securing social license—through participatory decision -making.

What Is a Social License?

The concept of a social license—sometimes referred to as a social license to operate (SLO)—first emerged in the 1990s to describe the processes and authorizations necessary for extractive industries, such as mining companies, to commence their operations. The acquisition of these licenses required buy-in from and engagement with a range of relevant stakeholders, including residents, influential community members, organized interest groups, and government, all of whom might be impacted by the project’s operations. The practice has since been adopted in other sectors like agriculture, infrastructure, energy, and tourism to gain public support for a range of projects.

Today, the term social license is defined in multiple ways. While some sources use it to refer to the ongoing acceptance of a company’s standards, practices, and procedures by the general public, others highlight a perception among local stakeholders that a project or industry is socially acceptable or legitimate. Still others emphasize the importance of securing multiple licenses from across different levels of society, suggesting the necessity of gaining acceptance from various overlapping groups and communities.

For our purposes, we define a social license as the process of building trust and legitimacy from ongoing (i.e., constantly renewed) community or stakeholder engagement and acceptance of how data is being accessed and reused. The outcomes of such a process of engagement and negotiation can include an actual license, a data sharing agreement, a set of conditions for access, a preferred set of questions to be answered with their data, or a design framework for access, among others. In essence, obtaining a social license for data reuse provides a foundation for operationalizing self-determination in our data-driven society. To return to the example discussed at the start of this paper, a social license would, for instance, allow aid organizations to responsibly reuse data collected from individual migrants to channel aid or otherwise direct relief efforts for migrants as a collective group.

Limitations of Consent

To understand how such a license might be secured—and why it might be useful—we need to briefly consider some of the limitations of existing models of consent. The current theory and practice of consent have largely been shaped by concerns regarding privacy, protection, and profit. To address these concerns—which are entirely valid—practitioners and policymakers have turned to an increasingly outdated toolkit that includes, for instance, checkboxes and explicit opt-ins. Such methods may seem to offer a sense of control and safety; in truth, they reveal the shortcomings of existing consent practices.

One concern with current forms of consent is that it is typically binary—either opt-in or opt-out—which over simplifies the intricate realities of data collection, use, and reuse. While some frameworks allow for more granularity with multiple checkboxes, they still fall short of capturing the complex nuances associated with data practices. In addition, current consent practices often fail to provide the comprehensive information necessary for both individuals and communities to have true agency over how their data is managed. To truly empower data subjects, they must be made aware not only of the immediate uses of their data but also of potential future uses (even if in an aggregated and anonymized form). This level of detailed information is typically absent, thus undermining the potential for genuine informed consent.

Furthermore, the current emphasis on individual consent overlooks the broader impacts on groups or communities, as datasets are frequently combined and repurposed in ways that can significantly affect these larger entities. Existing mechanisms of consent also struggle to address the ethical and policy debates surrounding data repurposing and the scope of the original consent.

Despite the development of more open-ended consent models and attempts by organizations like the World Economic Forum to refine consent methods, these approaches still face many ethical constraints. Therefore, to truly harness the potential of data for the public good, it is crucial to move beyond the limitations of current consent practices towards a more comprehensive, inclusive, and responsible framework for data use and reuse.

Securing Social License Through Innovation in Participation

Social license can be acquired through a process of engaging and negotiating with and gaining the trust and acceptance of communities, stakeholders, and the broader public. So far, there are several different participatory methods that have been experimented with to allow for more inclusive and democratic governance of data reuse. They include:

• Deliberative discussion groups: The Scottish government commissioned a project that sought to explore public accessibility of cross-sectoral data linkage for research and statistical purposes. A deliberative approach was used to understand the public’s attitudes towards data sharing. This approach specifically allowed researchers to understand the areas in which the public was supportive (i.e. data linkage in health research) and areas in which the public was concerned (i.e. the private sector having access to public sector data and the commercial gains that could arise from data linkage).
• Round tables, citizen juries, and surveys: Also in the UK, Understanding Patient Data, National Health Service England, and the Ada Lovelace Institute conducted research investigating citizens’ viewpoints regarding the NHS allowing third parties to access data to inform policy development being led by the Office for Life Sciences (OLS), a government agency that supports innovation in the health sector. A public engagement program was implemented to specifically identify the level and method of engagement needed for different levels of stakeholders. The project used a mixed method approach to identify these elements. This included: (1) Three round tables involving patient representatives in Oxford, Manchester, and London; (2) Citizens juries, or deliberative juries, involving a group of ordinary citizens, often chosen randomly or through a stratified sampling process, in Taunton, Leeds, and London; and (3) A nationally representative survey of the UK.
• Citizen Assemblies: In 2020 a Data Assembly was developed by The GovLab, in collaboration with New York City libraries, to ensure that decision makers in NYC had a transparent understanding of the expectations that public stakeholders held regarding the responsible reuse of data from the COVID-19 pandemic. This investigation included remote deliberations with three “mini-publics” consisting of data holders, policymakers, representatives of civic rights, advocacy organizations, and citizens where they discussed and created recommendations.
• Public consultation and community participation: In Spain, The Digital Rights Governance Framework was fabricated to propose a governing digital right at the local level with city governments. For this project the methods for public engagement and community participation that were recommended included but were not limited to: (1) Establishing civil society groups and representatives who are willing to engage in consultations and actively participate in initiatives; (2) For short-term projects, arranging public consultations and focus groups to involve city residents which involve designing and implementing new strategies; (3) For long term projects, arranging for representatives and civil society organizations to be involved in policy developments to ensure marginalized voices are heard.

Establishing a Social License Lab for Data (Re)Use

These are but some examples of how policymakers and other stakeholders are today working to secure social license. In order to build on these examples and help systematize the field, The Data Tank, a new do and think tank focused on serving the common good by transforming the way we reuse data, has proposed the establishment of a Social License Lab. This lab would serve as a platform for designing and implementing innovative processes and methodologies that empower communities and individuals to determine the purpose and conditions of data reuse. As part of the International Digital Self Determination Network, the Lab would seek to operationalize the emergent principle of digital self-determination through the concept of social license. Drawing inspiration from existing initiatives such as the GovLab's Data Assembly and its Responsible Data Reuse Framework, the lab will seek to design dialogue, co-creation, and stakeholder engagement, ensuring that data reuse practices are trusted and align with community aspirations and societal values.

In our data-driven society, where the very real risks associated with data reuse must be balanced with the equally real potential benefits of data reuse, we urgently need to move beyond existing methods of consent and establish a new theory and practice of social license to unleash the power of data in a sustainable, equitable, and responsible way. By embracing more ethical data reuse practices, operationalizing self-determination, and applying participatory decision-making to the data space, we have the power to create a more inclusive, equitable, and transparent data ecosystem. Through the establishment of a Social License Lab for Data (Re-)Use, we can collectively shape the future of data reuse, respecting individual rights, fostering societal trust, and driving meaningful innovation for the greater good.