As increasing access to and availability of data promises to revolutionise healthcare, it becomes exceedingly important to examine the foundations that underpin such innovation. Who has access to health data, how it is used, for what purposes and who benefits from it are critical questions that remain wholly unaddressed within existing mechanisms supporting data-driven innovation. To address such entrenched issues, Aapti proposes adopting a stewardship approach to health data governance -a framework that structures data flow according to community-centric imperatives, creating models of information exchange grounded in the promotion of societal value.

While it is evident that data sharing is indispensable for enhancing collective health outcomes, it is also complex and fraught with challenges. For instance, current cookie ‘consent’ notices are inadequate and manipulative because they fail to provide clarity on the downstream use of one’s data, including sensitive health information. To this end, an investigation by Financial Times demonstrated how top health websites in the UK track and sell users’ data about symptoms, diagnoses and drug names to third parties, including Google and Facebook. This compromises user agency and data rights as these cookie notices on websites fail to comply with GDPR standards for processing health data. Consequently, individuals and communities -producers of data -have little control over how their health information is used and are unilaterally divorced from decision-making over data exchange.

Additionally, patient concerns about trust, privacy and misuse of data are heightened in the context of the pandemic in which digital health solutions are promoted as a panacea to pervasive capacity and infrastructural issues in healthcare. The fundamental lack of transparency and flagrant disregard for user agency has emerged as dominant features of such solutions.

This is best illustrated through contact tracing applications used by public health authorities in various countries. Such applications often rely on unauthorised access to geolocation data from mobile network operators (without obtaining the explicit consent of users) to monitor population movements, as was discovered in the case of the Government of Pakistan. Closer to home, India’s model health agency, the National Health Authority (NHA) found itself at the receiving end of immense public criticism for similar reasons. The NHA rolled out its flagship vaccine registration platform -Cowin -that collects sensitive personal data (ex: unique identifiers) without outlining the privacy policy for the platform.

The above instances have contributed to a renewed awareness of the absence of safeguards to protect user rights over data. They have also magnified the need for inclusive, democratic approaches to data governance that place individuals and communities at the heart of the health data ecosystem. To this end, data stewardship–a human-centric mechanism for data governance –in healthcare presents an alternative paradigm that can inculcate trust in the process of sharing by expanding community engagement in the process of data exchange. Trusted intermediaries -data stewards -negotiate data-sharing arrangements between data providers and data requesters to enable the use of health information according to certain predefined terms and purposes, while upholding individual and collective rights and preferences regarding data access and use.

Aapti’s research surfaces two contrasting, but complementary mechanisms necessary to operationalise stewardship in the health sector. One, it emerged that bottom-up engagement on questions of data governance is crucial to redress power imbalances in the digital economy. Such bottom-up initiatives are focused on promoting the participation of individuals and communities in data decisions, in ways that protect their agency and interests as the producers of data. Examples include MIDATA -a health data cooperative whose members review medical research proposals and authorise data sharing for specific proposals that they consent to. The cooperative facilitates democratic decision-making over data through a general assembly of members accorded with one vote each.

Elsewhere, Citiizen is a private collaborative platform that allows individual patients and larger patient advocacy groups for cancer and rare neurologic disorders to collect, digitise, and share their health information for research with pharmaceutical companies as well as hospitals for the treatment management of individuals. The platform has introduced innovative modes of implementing user-centric health research wherein patients and advocacy groups are consulted while framing partnerships with third-party entities that would gain access to their data, deciding the terms of such collaborations.

Community mobilisation around data governance is meaningless without institutional affordances for the data rights of individuals. Accordingly, a set of top-down policy actions by the state is necessary to bolster community efforts directed towards operationalizing stewardship. This includes the creation of comprehensive data protection regimes, as well as support for mature data rights like the right to data portability which is necessary to produce an enabling environment for stewardship. More specifically, sector-specific guidelines for health data, the defined purposes for which it can be shared, the parties who can request data and the terms of the sharing arrangement.

Finland’s Data Permit Authority, called Findata, is a remarkable demonstration of top-down state action that not only enables health data stewardship but makes available quality well-being data for research, planning and policymaking. Elsewhere, Estonia’s experience with X-road data exchange layer and Canada’s foray into standards-setting for data governance serve as encouraging forerunners to operationalise stewardship in their respective jurisdictions.

The insights from Aapti’s use cases-led research draw attention to the value of supporting experimentation around initiatives on health data stewardship, the need for a robust regime of data protection and rights as well as health sector-specific guidelines to unlock data for research and innovation. Most crucially, this study marks a significant milestone in thinking about community-centred approaches to health data governance.

Incorporating the stewardship approach within a blueprint for global health data governance by the World Health Organisation can go a long way in actualising an equitable framework for data regulation, informed by the Health Data Governance Principles. This move is imperative as health data stewardship has the potential to subvert the extractive paradigm of current mechanisms for data sharing, by channelling health information in safe and effective ways to maximise social benefit, without undermining people’s data rights.