Beyond State vs. Corporate: Community Data Governance Models from the Global Majority

Shumaila Shahani welcomed in-person and online participants and introduced the session as a discussion on what “community-centric data governance” should mean in practice, especially in Global Majority and Global South contexts where people face risks from both state surveillance and private-sector extraction . She stressed that digital public infrastructure is expanding through systems people often cannot opt out of and may not meaningfully access . She explained that she, Fernanda Campagnucci and Bridgette Ndlovu were developing a policy brief that was still in progress and wanted to test its principles against practical realities through expert discussion and a hypothetical case study . Bridgette introduced herself as being from Paradigm Initiative in Zimbabwe, and Fernanda introduced herself as being from InternetLab in São Paulo, Brazil .

Shumaila then framed the discussion as a question of power rather than privacy alone. With AI systems and digital public infrastructures spreading into everyday life, she said the key questions are who owns data, who benefits from it, and who bears the risks . She said the draft brief was organised around three pillars: data ownership and stewardship, participatory decision-making, and benefit sharing .

Bridgette Ndlovu presented the first pillar, data stewardship and community agency. She argued that data should be treated as a collective asset rather than an individual commodity, and that communities and not corporations or states must hold legal authority over it . She described the core idea as keeping the community at the centre of all decisions concerning its data . She defined stewardship as collective authority over data generated within a community’s boundaries, with community decision-making on use, sharing and the distribution of benefits .

Bridgette pointed to existing and emerging governance models including sectoral stewardship codes, community data commons, participatory data scout models and data trust models . In the African context, she highlighted the African Union Data Policy Framework, which recognises data trusts as one model for countries to adopt, while noting implementation gaps because many governments have not followed that framework consistently . She added that Mozambique has adopted national data governance policies alongside data protection laws, and that South Africa’s POPIA framework allows representative bodies to submit codes dealing with data quality, consent and redress, which she linked to sectoral stewardship codes .

Her policy asks made this pillar more concrete. She called for recognition of a right to self-determination grounded in broader international standards . She proposed prohibitions on harmful and unfair market practices in extractive contexts where communities face unequal bargaining power . She also called for free, prior and informed consent so that communities can decide whether they want to participate in data processes at all . She repeated the need for sector-specific codes of conduct to guide responsible sharing, reuse and repurposing of personal data . Finally, she called for mandatory transparency and accountability for key platform services, including recommendation systems, especially as governments increasingly adopt AI policies and AI-driven systems .

Fernanda Campagnucci presented the second pillar, participatory decision-making. She argued that communities must have enforceable power to shape projects from beginning to end, rather than being offered only symbolic or discretionary consultation . She distinguished between performative participation and genuine participation, saying that consultation is often episodic, discretionary and non-binding, whereas real participation requires institutional arrangements that let communities shape the terms of collection, use and sharing before implementation begins . She added that participation must continue during implementation through monitoring, and after deployment through the ability to trigger review or even suspension when harms emerge .

Fernanda said there was no perfect one-size-fits-all example, but cited Brazil’s CGI and a preceding discussion on stakeholder guidelines as inspirations . She also referred to a repository of public algorithms in Chile, Kenya’s Huduma Namba litigation and later DPIA guidance, Amsterdam’s pause in an AI programme, and the Philippines’ free, prior and informed consent procedures .

Her policy proposals followed directly from these examples. She argued that projects affecting identifiable communities should be subject to free, prior and informed consent procedures . She also called for permanent community oversight boards for high-impact data systems . Another practical measure was public funding, including potentially from states and large technology firms, for independent community-based technical intermediaries so communities have the expertise to participate effectively . Finally, she argued that trade-secret and commercial-confidentiality protections should not apply in public systems or systems affecting communities where visibility into how the system operates is necessary .

Shumaila Shahani presented the third pillar, benefit sharing, as a matter of justice in the global political economy of data. She argued that data from billions of people in the Global Majority powers digital systems, but much of the resulting value flows to companies headquartered elsewhere rather than back to the communities that supplied the data and carried the risks . She said that if communities bear the risks of sharing data, they should also share in the value created from it . She was explicit that this should not be treated as charity or corporate social responsibility, but as a duty on the part of companies and a right of communities .

To illustrate the principle, Shumaila pointed to extractive industries. She noted that mining codes across Africa already require benefit-sharing agreements and that oil revenue funds in places such as Alaska and elsewhere distribute direct dividends to residents . At the same time, she acknowledged that data differs from traditional resources because the value derived from it is harder to define, measure and time .

She then unpacked what “value” should mean in data governance. In her view, value is not just money; it also includes infrastructure, capacity building, access to data, access to insights generated from data, and improved services . She warned that these forms of value are not currently being audited, making it difficult to judge whether what communities receive is fair or adequate . She also stressed that fairness cannot mean only a token share of very large profits, especially when data collected today may continue generating value many years later . For that reason, she suggested lifecycle-long agreements and renegotiable rights .

Her specific policy asks followed from this view of value creation. She proposed binding benefit-sharing agreements as a condition for data licensing, while stressing that licensing was only one part of the broader governance picture . She also called for public disclosure and registries of all such agreements so communities can compare terms and benchmark what others have received . A further principle was that any resulting funds should be community-controlled . Finally, she proposed repeated, audited data value impact reports to track when and how much value has been generated from community data over time .

The hypothetical case study, Windfall Valley, was then introduced to test the three pillars . Shumaila described the valley as a rural region of about 400,000 people in a lower-middle-income country, with an ethnically mixed population, a majority farming community, a smaller indigenous group in the uplands, and seasonal migrant agricultural workers . Mobile phone penetration was high, but formal healthcare was weak, consisting of one understaffed district hospital and a network of community health workers . A foreign company, VitalReach, proposed deploying an AI-driven diagnostic and disease-surveillance system in partnership with the national Ministry of Health, which was enthusiastic and had signalled it would sign . Community health workers would collect symptom, location and biometric data through a mobile app, while VitalReach’s models would detect outbreak patterns and suggest diagnoses .

The proposed arrangement raised several governance issues. VitalReach would train the system on the valley’s data, retain all rights to the resulting models, and license them abroad to other countries . In return, the valley would receive five years of free use of the app, training for fifty community health workers, and a new cold-storage facility for vaccines at the district hospital; no money would change hands directly . The data, including indigenous health information and migrant workers’ biometric records, would be transferred to VitalReach servers abroad and governed under the law of the country where those servers were located . Shumaila highlighted three tensions in the scenario: the valley genuinely needed better diagnostics and refusal had real human costs; the indigenous group had not been separately consulted and the migrant workers had no representation; and the models would likely generate significant commercial value abroad while the valley was offered only unassessed services in return .

Bridgette opened discussion of the case by asking who the legitimate steward of the valley’s data would be, whether there could be more than one steward, and how representation should work in such a mixed community . Shumaila also made clear that the session aimed to hear practical responses rather than simply present a finished framework .

The first audience intervention focused on differing understandings of valid knowledge. The speaker argued that different communities do not necessarily share the same understanding of valid knowledge, particularly in medicine, citing Ayurveda, Chinese medicine, Western medicine and Indigenous healing traditions . The comment raised an additional question about who defines valid knowledge and evidence across medical traditions .

Another audience participant proposed a more institutional and economic response. They suggested a fundamental right to data at both individual and community levels, so governments could not negotiate away data as if it were ownerless . They also recommended model templates for data-sharing agreements to help governments and communities negotiate fairer terms . Finally, they argued that because single data points become highly valuable through aggregation, AI firms may need to be taxed through an internationally coordinated regime that can compensate communities for the global value generated from their data . Bridgette connected this to competition concerns and cited a recent Nigerian competition decision against Meta, Facebook and WhatsApp as an example of data-sharing practices being treated as anti-competitive .

An online participant, Angelica Saldana, asked where to learn more about international standards on data self-determination, and referred to related issues such as digital identity, social safety nets and mobile network governance . Bridgette said the organisers would share their thoughts later and continue the conversation beyond the event .

When the conversation moved to the second pillar and the question of meaningful participation in the valley case, Fernanda asked what genuine participation would look like before the Ministry signed the deal and whether existing multi-stakeholder or oversight bodies in other sectors might be adapted to data governance . An audience member responded that current governance remains trapped in a post-Westphalian nation-state model that does not fit the global nature of the internet . They criticised both centralised systems and anarchic decentralisation, and proposed governance structures that connect individuals, families and communities directly into systems while still maintaining legal compliance and interoperability . They also floated tokenomic and programmable-money mechanisms as possible ways to route benefits back to data contributors when models built from their data are monetised .

Fernanda responded that even if the goal is to move beyond a simple government-versus-corporate model, states would still be needed to legitimise and enforce any new governance arrangement, because companies are unlikely to respect community validation processes without legal authority behind them . She then raised another challenge: community governance discussions often presume an organised community, such as an indigenous or traditional group, but data governance also affects many individuals who are not organised at community level, especially in cities . She said community data should be treated respectfully and governed with strong collective rights, but that there were unresolved questions about how to represent dispersed individuals who do not belong to clear community structures .

Abhinav, a researcher from IT for Change, then contributed a technically grounded intervention. He argued that individual informed consent, while central in liberal democracies, is inadequate for health AI because such systems do not function on isolated individual data points . Diagnostic AI requires high-quality datasets about a whole community, especially if the model is meant to make decisions about that community . For that reason, he argued there is real value in collective governance and that representative structures such as data cooperatives or councils could be involved at every stage of the process, from collection through model training and use . He referred to examples from India, where indigenous and community decision-making traditions already exist in climate and forest-rights contexts, and linked this to the idea of collective data as an asset .

In the final minutes, Shumaila returned to the benefit-sharing problem in the case and asked how anyone could judge whether the offered services were enough, not enough, and against what baseline such adequacy should be measured . Angel Akunle from the Internet Society argued that the answer begins with a data governance framework establishing common rules and a baseline for how data is defined and handled . He suggested that such a framework would help different agencies align their data practices and combine data more seamlessly, which in turn would allow a clearer baseline for evaluating value and adequacy .

A final audience speaker cautioned against too-simple analogies with mining or forestry. They said that data is far more amorphous than timber or mineral extraction, and that communities around data may also be more fluid and difficult to define . They argued that data can later generate implications in other domains, such as the environment, and that legal frameworks therefore need to be flexible and creative rather than copied directly from older extractive-sector models .

The session ended without formal conclusions because time ran short . Still, several themes recurred throughout the discussion. Speakers framed data governance as a question of power, ownership, benefit and risk rather than privacy alone . Across the three pillars, they argued for collective or community authority over data, meaningful participation throughout a project’s lifecycle, and binding benefit-sharing arrangements backed by transparency and auditability . The discussion also surfaced unresolved questions about who can legitimately represent mixed or unorganised populations, how to include indigenous groups and migrant workers, what counts as valid knowledge in health systems, and how to judge whether non-monetary benefits are fair . Because time was running short, Shumaila closed by inviting participants to continue sharing resources and ideas after the forum or bilaterally .