It had been seven years since the iPhone, hadoop and github added new dimensions to data governance, changing the course of entire professions, communities and societies for ever.

Seven years is one technology cycle, so in 2013-15 the data governance professions had the benefit of several years good study and analysis.

After establishing the basis for our dialogue, we thought these were the main data challenges, tensions and risks facing Aotearoa New Zealand over the next few years;

• invasion of privacy

• invasive uses of data

• discrimination and exclusion

• malicious use

• big brother

Our founding culture

We were people who collected and used data, or thought about how it was being used or will be used. Privacy and security professionals formed the core, with a bakers dozen of associated assurance or compliance professionals.

We worked in government, the private sector, and academia. Aotearoa New Zealand is fortunate to have been able to build strong and resilient links between these three groups.

We were citizens with children and families who were growing up, and who lived and worked here in Aotearoa New Zealand. Nothing much has changed and we don’t expect it to, as generations follow each other.

As it turns out, there is a Kiwi way of doing things, a way the respects tangata whenua and welcomes everyone who makes a habit of trying to get along and pull in the catch together.

The wellbeing zeitgeist

The attention focused by the Social Reports (2001-) describing the social state of the nation ended up preparing New Zealand professionals for a coming paradigm shift.

From 2008 the work Amartya Sen, Jean-Paul Fitoussi, and Joseph Stiglitz profoundly changed everyone’s idea of what was meant by ‘good’ data governance.

Aotearoa New Zealand already had its head in the socially aware data governance game: it’s one of our strengths. We were also reforming the way we met, discussed and decided; opting for forums by default.

This was part of a less visible demographic shift, as decisions began to pass to the generation who grew up amidst the divisions of the dawn raids, Bastion Point, the USS Truxtun, the Springbok Tour and the Rainbow Warrior.

How we formed

By 2014 enough people had cups of tea with each other that a consensus could form around enough energised people with enough good ideas and a Cabinet decision was made. GOVIS helped link people and meetings in Auckland, Rotorua, Wellington and Christchurch and the Data Futures Forum was born

In 2015

• The biggest data breach was ‘only’ 191m

• We put our national flag to a referendum

• We won the Rugby World Cup and lost Jonah Lomu

• We joined the Paris Climate Accord

• ISIS attacked soft targets across Europe

• The Syrian War produced a colossal human rights crisis that touched the whole world

We looked for four things…

Value: New Zealand should use data to drive economic and social value and create a competitive advantage

Inclusion: All parts of New Zealand society should have the opportunity to benefit from data

Trust: Data management in New Zealand should build trust and confidence in our institutions

Control: Individuals should have greater control over the use of data about them

We had a clear target

We estimated data-driven innovation had contributed $2.4 billion p/a to gross value added in New Zealand in 2014. This represented 1.4% of total economic activity across seven major sectors.

We thought that if New Zealand adopted data-driven innovation at the same average rate estimated for Australian businesses, then the value to New Zealand in 2015 would be $4.8 billion p/a gross value added

… and we found four things

We weren’t cooperating well enough to get collaborative value from data

We didn’t really know what to do with data, even if we did have it

It was hard to navigate the data ecosystem and there wasn’t a map

There wasn’t much trust and when it was gone, it was gone forever

In 2016

• The biggest data breach was 1.5bn, which broke the metric

• Mahe Drysdale won back to back Olympic gold

• We had some bad earthquakes and made a $450m meth bust

• Donald Trump won the US presidency amid Russian interference

• Great Britain chose to leave the EU via referendum

• The Trans-Pacific Partnership as we knew it came to an end

We co-commissioned a project to blueprint an alternative model to enable data sharing in Aotearoa New Zealand

This was the Aotearoa New Zealand Data Commons

What we came up with, we believed, was a safer, lower-cost and higher-value alternative to the then-current approaches to the challenge of data integration and reuse

This projects contribution to the global data governance conversation is our Data Commons Blueprint

We explored the data ecosystem with catalyst projects

Catalyst projects were data innovation projects focused on addressing real world problems, run and delivered in partnership with Government agencies, businesses and NGOs

Each project targeted our first principle (value) and supported at least one of the other principles of trust, inclusion and control

This was where we discovered how difficult data projects were, across the spectrum of scale and complexity

We looked at health

One thing all Kiwis seem to agree on is the the importance of healthy people and healthy communities

We wanted to know more about the sharing of personal health data, particularly with respect to the factors that influence people’s acceptance and approval of sharing the data

What we were interested in were the shared norms, rights and responsibilities between two parties in a data exchange relationship

In 2017

• The Equifax hack rewrote the data governance failure-at-scale paradigm

• The international balance of power shifted in unpredictable ways

• Global warming suddenly got real

• The economy picked up and everyone prayed

• Mosul was liberated from ISIS, bookending a black chapter in world history

• The Rohingya crisis showed how Facebook could be used to incite violence

• Jacinda Ardern joins the team and Aotearoa New Zealand is somehow different

We produced Our Data, Our Way

We’re really proud of this. We clocked the miles around Aotearoa New Zealand and had many enriching and sobering conversations

We found four shared norms, rights and responsibilities for data exchange:

• Avoid a deficit approach

• People’s needs come before data

• Produce evidence of sound practice

• Co-create with communities who want to make data work them

The big takeout? People wanted a mandate. They sought some form of personal data sovereignty

We produced our first serious look at trusted data use

From our 2015 work, we wanted something tangible to help people frame and decide their comfort with a proposed use of data (that described them)

This piece of work got picked up by enterprising data governance professionals and we ended up revising it in 2020

We saw the parallel between the extractive minerals industry and the data technology industry, and became interested the social license body of work that emerged from local activism around improving the accountability of the mining industry

We looked at risk

The complexity of our digital and data infrastructure was starting to produce some serious harms. There was a lot of uncertainty in the data governance world as problem after problem kept emerging

The exposed GoP database, the Uber hack and spying Roomba’s showed a massively expanding risk surface that seemed to touch every aspect of daily life

The big risk at this time was re-identification (aka de-anonymisation), which we saw as being tightly coupled with a wide array of potential threats and misuses of personal information

In 2018

• We got a new Privacy Bill to take our place on the global stage for data protection

• Aotearoa New Zealand got into the space industry with Rocket Lab

• Everyone held their breath while a group of Thai kids were rescued from deep caves

• The Government said, yes, it’s going back into Pike River

• We were so sad for Grace Millane, and surprised at ourselves in the spotlight

• We had Taika Waititi saying New Zealand is racist, then a blackface prizegiving

New York gave us algorithmic accountability toolkits

The New York research institute AI Now showed everyone how it was done with their algorithmic accountability toolkit

This provided legal and policy advocates with a framework to understand basic understanding of government use of algorithms

“Algorithms are fallible human creations, so they are embedded with errors and bias like human processes”

This was part of the infrastructure of trust in data that Aotearoa New Zealand was looking for

The EU produced a wide swathe of excellent findings and recommendation

There are too many to count, but the key papers included;

• The EU High Level Expert Group on AI

• Mittelstadt, Russell and Wachter ‘Explaining Explanations in AI’

• Wachter, Mittelstadt and Russell ‘Counterfactual Explanations Without Opening the Black Box: Automated Decisions and the GDPR' (revised)

• The prolific, masterful and wide reaching work of the Oxford Internet Institute

The Aussies enabled crucial infrastructure with a consumer data right

Data portability is one of the fundamental dimensions of effective data governance. One of the ways to introduce it sustainably in society is through the mandate of a consumer data right

It is innovation such as this which will provider finer control over both value seeking and cost avoiding market behaviour

“The Consumer Data Right should be consumer focused. It should be for the consumer, be about the consumer, and be seen from the consumer’s perspective”

In 2019

• A white nationalist live streamed his murder of 50 New Zealanders on the world's biggest social media website

• Our Privacy Commissioner stood against Facebook, something that all Kiwis can be proud of

• We ushered a new era of reckoning economic value in with a Wellbeing Budget

• A huge amount of the Amazon was burnt

• Donald Trump was impeached for the first time

• Hong Kong headlined a year of protest

We advised on board leadership

To us, governance of data means thinking about the strategic issues of data, rather than the day-to-day operational running of an organisation

We think Boards must provide leadership, because governance is about leadership. Boards must develop and promote a data culture which demonstrates high levels of ethical standards, underpinned by the entity’s values

A Board has to mandate an infrastructure of trust in data, while mitigating data risks to optimise the value of the organisation’s data assets

We advised on data strategy

A data strategy deliberately maximises the value and manages the risk inherent in an organisations data

The strategy should articulate how data acquisition, management, use and analysis, and sharing relate to the organisations vision, purpose and values

A data strategy needs to cover four broad areas – data acquisition, data management (including storage, maintenance, integration and disposal), data use and analysis, and data sharing

We learned about purpose and value

Everything starts from here. Without a clearly defined purpose, an organisation will wander from one 'fashion of the moment' to another. Without a sense of direction, value creation becomes a random event

There are many organisational purposes. Values are likely to be specified in terms of ethical principles or behavioural expectations

Purpose and values define the territory which an organisation is willing to explore, and they help to define its vision — what it seeks to accomplish

In 2020

• Covid-19 flattens the world and everything is different

• Public servants get a model for the ages in Director General of Health Ashley Bloomfield

• We get to five million Kiwis and realise how lucky we are

• Parts of the country is orange from the ferocity of the Australian bush fires

• Joe Biden wins the US presidency amid false accusations from the incumbent

• The man who carried out the mosque attacks in Christchurch is sentenced to life in prison without the possibility of ever leaving jail

A politically motivated and social media manipulated mob stormed the US Capitol

For the first time since 1814, the US Capitol fell to a violent assault. Twitter, Facebook and Parler all had parts to play. Suddenly, no one could stand on the sideline anymore

As we had identified, the Boards of Aotearoa New Zealand companies were confronted with a wide range of data governance issues to make decisions on

That data issues quickly become democratic issues was known for several years, but this one event showed many more people what bad looked like

High profile algorithm failures across the world in education, health and policing

In the UK there was the exam problem. There were the facial recognition problems seemingly everywhere. We stooped lower with the mass face scraping by Clearview AI. Covid-19 revealed a whole swathe of data governance problems in health we’d never even considered before

There will no doubt be more to come, but how many there will be comes down to how motivated Aotearoa New Zealand are to identify what is no longer acceptable and work together to take it out our data ecosystem. Like we did with plastic bags

The resignation of Timnit Gebru electrified the wider data profession

The data governance profession got a sudden, sharp shock with the dramatic exit from Google of the deeply respected Dr Timnit Gebru and Margaret Mitchell

This was in the context of the wider technology profession confronting issues of race and gender bias, which was also enriching the data and AI ethics conversation

One of the main reasons why this topic will continue to burn hot is because, as we’ve seen since starting our journey, the issue at hand is nothing less than the truth