Who may use public-interest data, for which purposes, and under whose authority?
A practical governance model for lawful reuse, Indigenous collective authority, proportionate access, disclosure control, and accountable cross-border cooperation.
How can institutions share useful data while retaining enforceable limits on purpose, protecting individual and collective interests, and distributing the benefits of reuse?
Publication
Policy Memo
Published
Pillar
Public Policy Development
Evidence base
8 primary sources
Review status
Foundation synthesis; not peer reviewed
Executive synthesis
Data governance allocates power: who can define a problem, inspect a population, combine records, authorize reuse, and challenge the resulting decision. A policy that merely inventories datasets or obtains a broad consent checkbox leaves these choices unresolved. This memo treats lawful authority, demonstrated public purpose, equitable benefit, and enforceable operating controls as separate requirements. A technically secure project can still be unjust; a socially valuable project can still lack lawful authority.
True Tomorrow proposes a purpose-specific permission record for every consequential data use. It would name the decision owner, beneficiaries and affected groups, necessary fields, permitted users, retention and onward-transfer rules, access mode, review route, and conditions for stopping. This is an original institutional design proposal, not a validated universal standard. The sources establish useful principles and operating examples; they do not show that this exact arrangement causes better social outcomes.
Start with one bounded public-service research use and a funded steward. Expand only after demonstrating usable access, reliable disclosure controls, and meaningful routes to contest misuse. Governance must finance the people who maintain data quality, represent affected communities, review applications, and investigate complaints. Otherwise safeguards become paperwork while access remains concentrated among organizations with money and technical expertise.
Findings
What the evidence supports.
Source markers link findings to the evidence below.
01
Public value requires a distributional account
The World Bank frames the data relationship around value, trust, and equity, while the OECD recommends accountable access arrangements, capacity building, and safeguards. These are policy frameworks, not causal estimates for a particular institution. Together they support asking who receives useful services or knowledge and who supplies the data, bears exposure, or lacks access. This memo therefore proposes a benefit statement alongside each permission record: name the intended beneficiaries, describe a plausible route from analysis to action, and identify who is responsible for acting. A publication or dashboard alone should not be counted as a delivered community benefit. [1][2]
02
Public-interest purpose is not a substitute for legal authority
The European Commission explains that public authorities processing personal data under the GDPR commonly rely on a legal obligation, public task, or official authority grounded in EU or Member State law. Its guidance also identifies purpose limitation, minimization, security, and information duties. These requirements concern processing within the GDPR’s scope; they are not a worldwide authorization template. Our design implication is to document authority for collection and each proposed reuse separately. Where a project needs additional authority, a memorandum between agencies cannot simply manufacture it. Consent, when relied upon, needs its own validity assessment rather than becoming the default label for compulsory public services. [3]
03
Collective authority must be addressed directly
The Global Indigenous Data Alliance explains that technical openness principles can overlook unequal power and historical context. Its CARE framework emphasizes collective benefit, authority to control, responsibility, and ethics. These are Indigenous-led governance principles, whose implementation depends on the relevant peoples, laws, and institutions. They do not confer authority on a foundation to decide who represents a community. The proposed permission process should identify legitimate Indigenous decision structures early, compensate participation, and record agreed conditions on interpretation, reuse, benefit, and withdrawal where applicable. An individual participant’s permission should not be presumed to settle all collective interests in a dataset. [4]
04
Useful access can be graduated instead of unrestricted
The UK Office for National Statistics operates a Secure Research Service using controls over researchers, projects, settings, data, and outputs. NIST’s de-identification guidance describes alternatives including protected environments, query interfaces, synthetic data, and released datasets. These are an operating example and technical guidance, not proof that every environment prevents harm. They demonstrate why access design should begin with the research need. A user needing aggregate estimates may not need row-level downloads. Conversely, a restricted environment that cannot support a valid analysis creates costs without delivering the intended benefit. The proposed review should document both disclosure risk and analytical utility. [5][6]
05
Removing direct identifiers does not finish the privacy assessment
NIST recommends considering release risks, choosing a sharing model, and assessing re-identification rather than assuming that masking information is sufficient. Our extension is to make the threat model specific: who could link the records, what auxiliary data could they obtain, and what harms could follow? Review should include rare combinations, repeated queries, and linkage across separately approved projects. Synthetic data should also receive a disclosure and utility assessment. The point is not to promise zero risk, but to make residual risk explicit, assign acceptance authority, and explain why the proposed access is necessary. [6]
06
Cross-border trust needs reviewable safeguards
The EDPB’s final transfer recommendations set out a sequence of mapping transfers, identifying the transfer tool, examining its effectiveness, applying supplementary measures where needed, and reassessing. This is guidance about EU data-protection requirements, particularly relevant to Article 46 transfers, rather than a single rule for all international cooperation. The memo proposes attaching a transfer schedule to each permission record: recipients, onward access, applicable instruments, practical safeguards, and suspension triggers. Locating a server domestically should not be treated as the whole analysis; remote access and the actual actors able to obtain data also matter. [7]
The UN Fundamental Principles of Official Statistics emphasize professional independence, confidentiality, transparent methods, and impartial access. This normative foundation matters when the same state collects service records and evaluates its own performance. Our proposal separates the operational owner from the person approving analytical release and requires a documented correction process. Public summaries should explain coverage, missingness, definitions, and revisions. An administrative dataset records encounters with an institution; it should not automatically be interpreted as a complete picture of need, exclusion, or the underlying population. [8]
Institutional Implications
What this changes in practice.
These are design implications drawn from the synthesis, not claims that one institutional model will fit every jurisdiction.
01
Approve a use, not an indefinite stockpile
Create an original permission record with a concrete question, necessary variables, authorized recipients, and expiry or review date. Classify later linkage, model training, and commercial reuse as changes requiring review. Preserve legally required records while ending permissions that no longer have a valid purpose. Publish a non-sensitive summary that lets people understand what the institution has authorized.
02
Give community participation an actual decision role
Specify which decisions community representatives can influence, which require consent or agreement under applicable rules, and how disputes are handled. Provide accessible materials, independent advice where needed, payment, and sufficient time. Record disagreement rather than converting attendance into endorsement. A single advisory meeting should not be described as community governance.
03
Fund access and stewardship together
Budget application support, metadata, translation, secure computing, review staff, and output checking. Offer proportionate assistance to small public-interest teams and under-resourced institutions. Publish reasons for refusal and a review channel. Otherwise an apparently equal application procedure can favor well-funded applicants who know how to navigate it.
04
Keep enforcement and research boundaries explicit
Where the law and institutional mandate permit, define whether research outputs may be used for individual enforcement, eligibility decisions, or commercial targeting. Any exception should have a named authority, justification, and audit trail. People should not discover after contributing data that an unrelated adverse use was silently permitted.
05
Treat complaints as evidence about the framework
Provide routes for individuals and communities to report harmful reuse or inaccurate interpretation. Investigate the data lineage and all downstream recipients, not only the first collector. Record correction, access restriction, notification, and remedial action, including cases in which the institution disagrees with a complaint and its reasons.
04 / Policy options
Choices and their tradeoffs.
Foundation analysis of the options. Evidence informs the choices; it does not remove their costs or uncertainty.
1
A shared stewardship service
Original option: smaller agencies could share security, disclosure-review expertise, and application support while retaining their own lawful decision authority. This reduces duplicated specialist work but creates a concentration risk. A service agreement should prevent the shared operator from approving new purposes or assuming ownership of participating agencies’ data. [5][2]
2
A federated access arrangement
Original option: keep sensitive records with their custodians and coordinate approved analysis across institutions. This may reduce unnecessary copying, but it can increase coordination cost, obscure inconsistent definitions, and leave disclosure risks in outputs. Choose it only where the proposed analysis remains valid and responsibilities remain inspectable. [6]
3
Open publication for demonstrably suitable information
Original option: publish reusable non-sensitive data with definitions, provenance, licensing information, and accessible formats when disclosure and collective-interest review support it. Restricted access should not become a blanket excuse to conceal public performance. Equally, an open-data target should not force release of sensitive records. [8][4]
05 / Implementation
From a proposal to a working system.
A proposed sequence for local adaptation. These stages are not a claim of funded or completed Foundation activity.
1
Map one service and its authority
Select a bounded use with an identified public beneficiary. Map collection, linkage, storage, access, output, and disposal. Record unresolved legal authority and stop those uses from proceeding until resolved.
2
Negotiate the operating conditions
Convene the accountable public owner, data steward, security and privacy specialists, service staff, researchers, and legitimate affected-community representatives. Agree a permission record, access tier, cost model, and complaint procedure.
3
Run a supervised pilot
Test access, analytical utility, permission expiry, output review, and a simulated misuse complaint. Document where the pilot excludes legitimate users or exposes sensitive information. Approve expansion only after the accountable owner accepts the findings.
4
Review benefits and renew permissions
Compare delivered benefits with the initial statement, publish a protected audit summary, and revisit transfers and linkage risks. Renewal should be an affirmative decision with reasons, not an automatic extension because a dataset remains useful.
06 / Measurement
What progress would mean.
Proposed measures for evaluation. Baselines, thresholds and reporting responsibilities must be agreed before implementation.
Permission completeness
Share of active uses with verified authority, owner, purpose, recipients, access conditions, and review date.
Interpretation: Document completeness does not establish lawful or beneficial practice; inspect a sample against actual access logs.
Equitable access
Application outcomes and time to usable access, disaggregated by applicant capacity and institution type.
Interpretation: Compare similar requests; slower decisions may reflect necessary safeguarding rather than discrimination.
Delivered public benefit
Specific service, knowledge, or community outcomes attributable or plausibly connected to an approved use.
Interpretation: Do not substitute publication counts or projected economic value for observed benefits.
Correction and containment
Time to investigate substantiated errors, restrict misuse, and correct relevant downstream records.
Interpretation: Low complaint numbers can indicate inaccessible reporting rather than absence of harm.
Research Programme
What the foundation should test next.
Have independent reviewers reconstruct one data use from the permission record and access log; record any recipient, purpose change, or transfer they cannot explain.
Compare two feasible access modes for the same research question using analytical utility, review workload, researcher burden, and a documented disclosure-risk assessment.
Run paid deliberative sessions with affected groups, including relevant Indigenous authorities where applicable, and publish which design decisions changed and why.
Conduct a controlled end-to-end correction exercise from an inaccurate source record through linked analysis, released outputs, and notifications; establish what cannot be recalled.
Method & Limits
How to read this brief.
Method
Targeted primary-source policy synthesis completed 23 September 2026. Sources were selected for authority over the claimed rule or practice: the World Bank, OECD, GIDA, NIST, ONS, UN Statistics Division, European Commission, and EDPB. The synthesis distinguishes normative principles, legal guidance, technical recommendations, and an operational service description. It contains no new causal estimate, dataset analysis, stakeholder consultation, or compliance audit. Permission records, operating options, and measures are original proposals for testing.
Limitations
The evidence base is weighted toward institutions with established legal and technical capacity. GDPR and EDPB statements apply only within their legal scope; other jurisdictions need separate analysis. Indigenous governance cannot be standardized without the authority of the peoples concerned. Security, legitimacy, scientific usefulness, and equitable benefit are related but separate outcomes. No cited source establishes that the complete proposed framework has been implemented or validated.
Unresolved evidence
Comparative evidence on the cost and fairness of governance models in low-capacity public institutions is limited.
Community benefit-sharing arrangements need locally legitimate definitions and independent follow-up.
Privacy-preserving access can alter research validity; utility loss and unequal access require empirical testing.
