This project has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement no.732546.

DISCLAIMER By the European Commission, Directorate-General of Communications Networks, Content & Technology. The information and views set out in this publication are those of the author(s) and do not necessarily reflect the official opinion of the Commission. The Commission does not guarantee the accuracy of the data included in this study. Neither the Commission nor any person acting on the Commission's behalf may be held responsible for the use which may be made of the information contained therein.

© European Union, 2020. All rights reserved. Certain parts are licensed under conditions to the EU.

Reproduction is authorised provided the source is acknowledged.

This work is licensed under a Creative Commons AttributionNonCommercial-ShareAlike 4.0 International License.

Authors

Theo Bass and Rosalyn Old (Nesta).

Originally published in December 2019 as deliverable D1.12 for the European Commission funded Decentralised Citizens Owned Data Ecosystem (DECODE) project, grant number 732546.

Contributors, editors and reviewers

Francesca Bria (Project Coordinator), Antonio Calleja López (UOC), Guilia Rocchi and Stefano Lucarelli (CNRS), Max Kortlander, Sander van der Waal and Tom Demeyer (Waag), Oleguer Sagarra (Dribia), Pau Balcells and Javier Rodriguez (IMI BCN), Aik van Eemeren and Safia Akkus (AMS).

Acknowledgements

Thank you to all of those involved in the DECODE project and its pilots for their help with the research for this report. In particular Project Coordinator Francesca Bria that sets out the vision, objectives and direction for the project and Project CTO Jaromil Roio that drives its technical implementation. We are also grateful to other organisations working in the field who have contributed. Specifically, we would like to thank the following for taking the time to participate in an interview: Jaap-Henk Hoepman, Mara Balestrini, Andrea D'Intino, Max Kortlander, Antonio Calleja López, James Mansell, Giulia Rocchi, Stefano Lucarelli, Marco Ciurcina, Danny Brooke, Richard Beckwith, Jack Hardinges, Peter Wells, Jared Keller, Gavin Starks, Sean McDonald, Jeremy de Beer, Sophie Bloemen, Thomas de Groot, Colin Birchenall, Michel Vogler and Anja Boersma.

We'd like to give a special thank you to all the people who attended a workshop on data commons at Nesta in September, 2019: Camilla Bertoncin, Ed Parkes, Eirini Malliaraki, Jack Hardinges, Jennifer Pybus, Lewis Lloyd, Liz Harrison, Mark Coté, Sam Cannicott, Sara Mahmoud, Thea Snow and Tracey Gyateng.

Finally, thank you to the various members of the DECODE consortium and to our colleagues at Nesta for your valuable input and feedback on this report.

Executive summary

The types of value extracted from personal data will be one of the defining questions of the future digital economy. Currently too much data is either misused – hacked, exploited or used improperly - or under-used – restricted to very narrow financial conception of value. As data becomes more and more intimate, our ability to respond to these problems will become even more important. Taking the concept of the commons and applying it to data is a useful way of addressing these twin problems. Much of the practical application of DECODE's technology to date has focused on moving the idea of a data commons from theory to practice. This report is a summary of that work.

Commons provide a useful set of principles to support privacy-enhanced sharing of data for public value, with the aim of reconciling both personal and collective control, while maintaining transparent, accountable and participatory governance over data.

Commons come in many different shapes and sizes. Each will need careful design depending on the type of data and sector. We provide a range of examples which aim to show the different types of data commons that are emerging, from larger-scale sharing of research data, to more community-oriented forms of sharing (e.g. based upon citizen sensing). DECODE's pilots show how different types of data commons involving personal data can be supported, with the help of novel technologies and methods for community governance.

Three 'ready-to-implement' use cases for DECODE tools in cities:

• DECODE ABCs provide open standards for more robust identity systems that give users control and minimize data leakage.
• The DECODE-Decidim tool provides a ready-to-use app for more privacy preserving digital democracy applications.
• Smart Citizen Kits, the DECODE onboarding site, and BarcelonaNow dashboard provide tools for community data commons for citizen science, integrating into the wider city data infrastructure.

Four key areas to support data commons approaches:

• Open, trustworthy digital infrastructure.
• Sensitivity to power imbalances between beneficiaries, contributors, data subjects, and those participating in governance.
• Governance needs to be open and actively work to upskill those members of the community who cannot participate.
• Commons-based approaches need to align incentives to allow the commons to grow and be self-sustaining.

Recommendations

We make a series of practical recommendations to governments at various levels towards the creation of data commons in urban contexts:

In Appendix 1 we provide a more detailed evaluation of the four DECODE pilot projects, and in Appendix 2 share the Data Commons Manifesto (created as part of the DDDC pilot).

Introduction

The growth of digital technologies has produced a huge increase in opportunities to extract value from data. As the online economy has grown, we've seen companies and governments find increasingly sophisticated ways to gain value from personal information: from data brokers that buy and sell information about our online browsing habits, to smart cities that track passers-by and target them with personalised ads.

This report argues for radically new ideas about how the value of our personal information can be returned back to citizens that create that value in the first place, with a focus less on how money can be made from data, and more on how data can benefit society as a whole. We explore this through the idea of 'data commons' - which offer us both a useful conceptual and a practical model for achieving better, more inclusive outcomes for data governance.

In the current data economy value is collected from data generated passively by individuals, and used in ways which maximise economic value, with gains accruing disproportionately to a small number of firms. A commons-based approach to data would invert this approach, encouraging more active management and sharing of personal data for greater personal and value for the public good. Data commons can provide a useful set of principles for achieving this vision, with the aim of reconciling both personal and collective control, while maintaining transparent, accountable and participatory governance over data.

This report summarises work from the DECODE project which, for the past three years, has tried to give a precise meaning to the notion of data commons through a series of pilots in two European cities. The project tested commons-based approaches through the use of tools for decentralised identity and trusted data sharing among local communities. This report shares lessons learned during the DECODE pilots. We share insights from each one, provide an outline of their impacts and implications, and share an overview of how policymakers can continue to support the momentum built by the project in enabling common-based approaches to data governance in cities.

Twin challenges of data use

The governance of personal data of all kinds has recently moved from being a marginal, specialist issue to one of general concern. Too much data has been misused, lost, shared, sold or combined with little involvement of the people most affected, and little ethical consideration on the part of the organisations in charge.

Two main kinds of problems are coming to prominence. The first kind involves misuse and overuse of data; the second kind involves underuse of data.¹

The first problem is a lack of control and agency-individuals are unable to control data about their own lives (from Facebook links and Google searches to retail behaviour and health) and communities are unable to control their own public data (as in Sidewalk labs in Toronto and other smart city projects that attempted to privatise public data). Lack of control leads to the risk of abuses of privacy, and a wider problem of decreasing trust - which survey evidence from the Open Data Institute (ODI) shows is key in determining the likelihood consumers will share their personal data (although this varies across countries).² The lack of transparency regarding how personal data is then used to train algorithms making decisions (for example, in relation to Artificial Intelligence) only adds to the mistrust.

The second set of problems concern value. Flows of data promise a lot: better ways to assess and understand options, and to make decisions. But current arrangements make it hard for individuals and communities to realise the greatest value for the public good from their own data, and make it even harder for communities to safely and effectively aggregate, analyse and link data to solve pressing problems, from health to climate change, crime to mobility. This is despite the fact that many citizens are prepared to make trade-offs: to share data if it benefits themselves and others - a 2018 Nesta poll found, for example, that 73 per cent of people said they would share their personal data in an effort to improve public services if there was a simple and secure way of doing it. A key reason for the failure to maximise value for the public good is the lack of trusted institutions, technology, workable governance frameworks and awareness to enable active sharing in the public interest. Additionally, available smaller solutions may have faced difficulty in scaling.

Attempts to answer these problems sometimes point in opposite directions - the one towards less free flow, less linking of data, the other towards more linking and combination. But any credible policy responses have to address both simultaneously. The key challenge will be how to balance the increasing opportunities of pooling data against the increasing risk of harm caused by misuse.

New commons for data

In response, DECODE, among others, is exploring methods to solve the privacy problem and the value problem simultaneously. This requires more democratic mechanisms for harnessing data's value, where groups of people can pool and leverage their digital footprints on terms decided collectively. This is where it is useful to think less about data as a commodity to be bought and sold, and more as a shared resource or common good.

So far, these ideas have been well developed and applied to natural, physical resources. Elinor Ostrom, the Nobel Prize-winning theorist of commons, spent much of her career researching their governance and developing principles that could be applied to the successful governance of common-pool resources like fisheries or woodlands. And although a number of people have applied these ideas to intangible resources like information and knowledge, not many have explored the notion of 'data commons' more specifically.

This report explores the concept of data commons in more detail, as defined in the context of the DECODE project.³ It starts with an overview of the concept, and what it might mean compared to other emerging approaches to data governance. We then provide a range of examples of different types of data commons that are emerging across sectors, according to the type of data and actors involved.

This approach itself raises significant new challenges - it requires new ways of thinking about how we govern access to data, new technologies that make it possible for people to volunteer data, on their terms, without disclosing unnecessary or sensitive personal information. Over the last three years, the DECODE project has researched and tested these questions through a series of pilots, and through the development of policies and technical tools that try to reconcile control over personal data and the ability to share it on the citizens' own terms. These have been conducted in partnership with communities in two of the most advanced digital cities in Europe Amsterdam and Barcelona. The second section of the report shares findings from these pilots, and how these have contributed to our understanding of how to build data commons, and what needs to happen next to support their continued growth and adoption.

We summarise four areas for enabling data commons to emerge out of this research, while providing policy recommendations with suggestions for how governments at different levels may support data commons approaches, from pilots at the community level to supporting new international digital infrastructure.

New municipal policies for data sovereignty: learning from Barcelona

Authored by Francesca Bria, DECODE Coordinator and former Barcelona CTO.

One of the key contributions of the DECODE project has been helping to accelerate the implementation of a novel approach to municipal data policies centred around data sovereignty for citizens, tested in Barcelona and Amsterdam. Following the DECODE approach outlined by Barcelona CTO and DECODE coordinator Francesca Bria,⁴ data can be considered a new meta-utility, a public infrastructure, like electricity, water, roads, and clean air. City data is critical to run future smart Al-driven and data-intensive public services in transportation, healthcare and education.

This also means that the immense economic value that such data represents should be returned back to citizens that produce that value in the first place. In order to achieve this objective, the City of Barcelona revised the procurement deals between city hall and its private sector providers and included 'data sovereignty' clauses in public procurement contracts, in a way that any supplier that works for the city of Barcelona must give back the data they gather to deliver services to the City in machine readable format. In this way the data was turned into a public good and placed in the public domain, while at the same time preserving privacy, ethics and security by design via the use of strong cryptography.

On top of this public privacy-enhancing data infrastructure, DECODE enabled the demonstration of how data can then be governed and managed as a common good, shifting agency and control to citizens themselves that have the right to decide what data they want to share, with whom and on what terms. The terms and conditions for data access and sharing are in this way set by citizens themselves using the DECODE cryptography tools and smart contracts. Citizens, via the use of the DECODE app, are able to set the anonymity level, so that they can't be identified without explicit consent. In this way they can keep control over data once they share it for the common good. This common data infrastructure remains open to local companies, coops, social organizations that can build data-driven services and create long-term public value. The data shared by citizens in the DECODE pilots integrates with the Barcelona City Hall digital infrastructures: the data lake CityOS, the IoT open sensor network Sentilo, Barcelona open data portal and the digital democracy platform Decidim.⁵

This strategy was possible only after the Barcelona City Council released a new Digital City Plan,⁶ with an ethical data strategy⁷ that has transparency, privacy, security, and ethics for innovation at its core, together with ethical digital standards⁸ that inform the overall digitalisation process and that are now shared amongst cities in an open source platform⁹, as part of the Cities Coalition for Digital Rights¹⁰ joined by more than 60 cities and backed by the UN-Habitat.

This model can be scaled at EU level while creating a strong competitive environment at the service level, regulating data access and imposing data sharing mandates of 'public interest data' for over the top players, as defined in the national French Al strategy.¹¹ This promotes the sharing of anonymised data and algorithms so that cities can create open and shared services that can be used by all European SMEs, public administrations, and non-profits. The DECODE app¹² could evolve towards a digital wallet to hold all citizen data - from basic demographic information to health, transport, and employment data - that citizens can release for any transaction that requires it. Whoever wants to build new services on top of that data would need to do so in a competitive, heavily regulated environment while paying a corresponding share of their profits for using it. Following this plan, enforcing privacy via the use of decentralised and privacy-enhancing tools like DECODE also means enforcing economic justice, by unlashing the potential of collectively produced data to create public value.

Section 1: Data commons – what and why?

The rationale

Big tech's control over data has given a few large companies extraordinary power and influence over human behaviour and societies. This has important implications for the future of Artificial Intelligence, which depend on these data. We know that Al will play a huge role in the delivery of services, yet a small number of players have now accrued huge market advantage in shaping how this develops. They raise the barriers to entry for new start-ups (who often have to rely on their infrastructure), and snatch up talent or acquire companies that pose competition.

In response, some have proposed that we rely on more state-controlled infrastructure like public alternatives to Google and Facebook, or national data funds, upon which new public digital infrastructures can be built. Yet public control over data raises similar challenges, like how to avoid centralisation of power, and ensure its use is genuinely in the public interest rather than being exploited or used for surveillance.

In recent years we've witnessed a flurry of activity and innovation in developing tools and platforms that take a more people-centred approach - giving people individual control, to protect, encrypt or even be remunerated for their data. These have resonated with a lot of people, yet many have shown a fundamental misunderstanding of the nature of data and how it provides value. Data needs to be linked and shared across different platforms and silos in order to unlock value. Giving people 'ownership' - akin to property rights - could have the opposite effect, encouraging people to protect, withdraw or hoard their data. It could lead to a world where we see significantly less data used to deliver services or research like helping predict diseases, responding to pollution or crime, optimising transport or improving educational outcomes.

What's needed are alternatives that bridge the gap, reconciling personal control and public benefit and addressing the twin problems of misuse and underuse as previously highlighted.

One way of doing this is to think about what more democratic forms of data governance might look like. Indeed, individuals by themselves don't have much bargaining power over how their data is used (which is why most people just click 'I agree' when faced with draconian T&Cs). Data needs to be aggregated and processed in large volumes to yield significant rewards, so there is a need for platforms that enable groups of people to leverage their data's collective value.

What are commons?

These may be built on top of technologies that give people control in the first instance, but provide trustworthy mechanisms to share personal data. In turn, these may give rise to new, democratic data sharing arrangements where people can decide collectively the terms by which data is accessed and used, potentially enabled by new institutions for collective decision-making. These are what we refer to in this report as 'data commons'.

Building new services on these principles raises many challenges, and it will not work instantly for all types of data. Indeed, a key challenge in developing data commons is a practical one of providing ways for data to be shared without undermining individual control – two seemingly contradictory tasks. A useful place to start will be to look at a range of sectors to see how examples of data commons are emerging, and how individuals and groups are developing mechanisms to govern access to data and consent according to shared rules.

What's more, our experience in DECODE over the last few years has shown there are a number of fruitful areas for experimentation at the local level for testing new types of collective governance arrangements (many of which are enabled by new privacy-enhancing technologies) including democratic data governance with the active participation of the municipal government that acts as custodian of citizens' data rights, local social networks and citizen science projects. As critical local infrastructure is increasingly digitized and relies on data collected and maintained by private companies, alternative, democratic models like these for governing access to data will become more and more important. Indeed, big tech companies are starting to pick up on some of the ideas promoted by DECODE, and so it is important that in EU projects such as this, the distinction between market-oriented economic value and commons-orientated economic value is made explicit. It is also important to stress that municipal governments can play a critical role in regaining democratic control of data and digital infrastructures. As in the Barcelona and Amsterdam cases, the city government actively shaped and co-created new ethical and democratic data policies that enabled the creation and governance of data as commons. It is specifically in this hybrid public-common partnership that we see the most potential to nourish and grow data commons.

This report considers what these new data commons might look like, how we might start to build them, as well as the technology, methods, policies, regulatory frameworks and tools we'll need to get there.

As digital information has become a more and more central driving force in our economy, it's become clear that we lack many of the skills, roles and institutions for thinking through the complex trade-offs needed for governing data.

In response to this challenge, a wide range of new methods and approaches for managing access to personal data are emerging. Data collaboratives are an increasingly common method - a new type of public-private partnership for exchanging data to unlock value for the public good, often involving ad hoc agreements between companies, researchers or public institutions.¹³ We've also seen increasing application of data trusts, a legal tool which could help to establish a more equitable data relationships between data beneficiaries and data owners via 'trustees' who are assigned duties to manage the data on agreed upon terms.

We set out some of the more common data-sharing arrangements, with a short description and a number of case studies, below.

Source: Adapted from Nesta and Smart Dubai's Data Sharing Toolkit: Approaches, guidance & resources to unlock the value of data (forthcoming - expected January 2020)

While it can be useful to assign labels to these different approaches, in reality no clear-cut boundary exists between each of the models, and many of the models may overlap. For instance, data commons may include a trust or a co-operative-like structure, or the term 'data trust' may be used to refer to something resembling a commons model to others. Agreement within the community around language would be useful going forward. Nonetheless, the concept of commons is useful because it gives us much more specific set of values and principles to work with. It highlights the importance of trust and democratic participation in the governance of a communal resource, which are described as core principles for designing effective governance (there is nothing specific about a data trust that automatically implies these values, for instance).

Of all of these different models, perhaps the least amount of attention has been given to data commons. There have been relatively few attempts to apply specific principles from other writings on commons and apply them to data, while pointing to specific examples of what this looks like in the real world. This section provides a more substantive explanation about what data commons are, what makes this approach unique, and why they might be a useful way of thinking about how we govern data.

What are commons?

Elinor Ostrom's seminal work Governing the Commons responds to a challenge famously outlined by Garett Hardin's Tragedy of the Commons.²⁵ This argued that unrestricted access to land, forests and other depletable resources leads to their inevitable exploitation and overuse, even when this is against the individual interests of those responsible for over-consumption of the resources. In response, Ostrom developed an alternative vision describing different means of access, and how each changes the nature of goods to be governed.

Ostrom outlined a distinct category of goods known as 'common-pool resources', distinguishing them from pure public goods (which anyone can use at any time) and private goods. What makes common-pool resources unique is the fact that they have low excludability (that it is harder to prevent people from using them),²⁶ but also more rival or 'subtractable', meaning one person's use can undermine another's (say if the resource runs out or is spoilt). These types of goods require altogether different kinds of approaches to management: one where people using the resource do so on terms which ensure its continued preservation. A central claim against Hardin was therefore that he conflated commons with 'open-access' regimes where there is little to no restriction on use.

Source: Hess and Ostrom.²⁷

What Ostrom showed is that, in many cases, neither the state, nor the private sector can provide sufficient support to govern these resources, but rather communities evolve rules for managing access, often self-organising and self-governing. Her work showed multiple examples of these commons, often with reference to environmental resources such as woodlands, fisheries and groundwater basins. A good illustration includes Nepalese Community Forests. In the early 1990s, the Nepalese government guaranteed local communities' right to forest management. As of 2015 more than 130,000 user groups are involved in community forestry, and ceding management to local communities has been shown to increase biodiversity and as well as improve participation and incomes of the rural poor.²⁸

There are other resources which share the characteristics of commons, but which are not necessarily governed as one. These include things like clean air or social media (which may appear non-rival but depend on costly servers, cables, spectrum and so on). Although this report focuses on examples of commons that are self-governing, many of these so-called 'value commons' show that not all commons are completely independent of public or private actors.²⁹ This is a useful reminder that the boundaries commons is never clear and they may be supported by a variety of institutions, whether through direct subsidies or regulation.

More recently, Ostrom turned her attention to the digital realm, in order to understand how knowledge or information might be managed as a common. Indeed, we see many successful examples of this today including so-called 'digital commons' such as free and open software or Creative Commons. These digital commons include examples where "the community of people building them can intervene in the governing of their interaction processes and of their shared resources."³⁰

However, applying these principles to personal data brings unique challenges. While Ostrom focused on non-urban, tangible assets, with a close-knit group collectively managing them, in the case of data, we have a non-tangible resource which may affect many people a small amount, rather than relate to a core group of people. Additionally, data ownership may be contested in relation to data subjects, owners and systems by which data value is generated, and regarding where ownership boundaries fall. In this respect it is inevitable that some of Ostrom's principles need to be adapted or changed to accommodate these differing properties.

Most people refer to data as a non-rivalrous resource, because multiple parties can simultaneously use copies of the same information at the same time.³¹ This implies that data is best conceived as a pure public good or a club good in the previous diagram. However, some authors have pointed out that there are certain 'rival-like qualities' to data which suggest that alternative governance arrangements may be necessary in some scenarios.³²

In their article Data Flow in the Smart City: Open Data Versus the Commons, Beckwith et al. describe the value in establishing commons for personal data where data needs to be somewhere between open and closed. They suggest that "in rivalry, the value of the resource is key", and that data has many different forms of value (including economic, sociological or related to identity). Any of these may be diminished if a collective resource is exploited or misused.³³

They provide an example of a community in the US affected by flooding, who began to access local maps, collecting photographs and other data about upstream drainage and the watershed during flooding events. When considering whether to share the information with the federal government, they decided it was too risky as the information could fall into the wrong hands, or be used to recalculate monthly mortgage payments and reduce the value of homes in the area. As a result, data, and insights from it, were made available to the local community (e.g. through public meetings) but on terms set by those who had participated in their collection.³⁴ Similar issues came up in DECODE's citizen sensing pilot in Barcelona, where participants expressed concerns about decreasing house prices, or repercussions from their landlord, when sharing noise data from their balconies on a publicly accessible dashboard.³⁵

Beckwith et al. also raise an example from Aragon's study of an Indonesian community that manufactures textile goods, and shares information internally about the different ways those goods are handled and produced. The community feared that if outsiders shared knowledge how they produce their goods, then they might steal relationships with customers and the community would be diminished.

These illustrations show how the value of data is constantly shifting for different people. It can be extremely precious to one person and less so to another, and this changes according to the context.³⁶ This means it's not always easy to tell who is affected, excluded or harmed by data sharing arrangements.

They also show the value in stewardship models that give communities more collective control over data, involving groups coming together and deciding on shared rules by which a communal resource is accessed and used. A tension in these scenarios is in balancing both the opportunities and the potential harms caused, both of which are likely to increase the more widely the data is circulated. Another crucial element here is participants' trust, without which the whole system may collapse as people decide to withhold information or withdraw from the commons entirely.

Additionally, consideration needs to be taken to the level of governmental involvement in commons models. While many proposed solutions focus on alternative voluntary citizen-led models, there are limitations to the impact of such initiatives in cities, without the support or involvement of the state (especially, for example, in sectors such as health or transport), and the associated democratic accountability. There is nothing about the Commons model per se which would prohibit some form of state involvement and this could be a means of increasing the scale, reach and impact of the model. The DECODE pilots attempted to bridge this by generating citizen participation in projects which engage with responsibilities and accountabilities of urban municipalities.

We now provide an outline a range of different examples of data commons, along with some principles for their creation and use, showing what a governance arrangement based around these ideas might look like.

Different types of data commons

Different approaches to designing data governance will vary widely depending on the context, and overly generic approaches are likely to fail.³⁷ Commons-like structures are emerging as a solution to governing data across four different categories. The recurring theme in each of these examples is that they involve groups benefiting from sharing data, and deciding collectively on rules or mechanisms for how best manage access, in turn improving trust and the sustainability of the resource.

Many of the examples below are embryonic, especially when held up against the standards set by Ostrom for successful governance of common-pool resources. For instance, three of Ostrom's design principles include the need for graduated sanctions, swift conflict resolution mechanisms, and recognition by the wider political and legal system.³⁸ Many of the examples below haven't achieved this level of maturity. Nonetheless they are useful as a means of informing how this nascent concept can evolve in the future.

1. Academic and research data commons

The most frequent set of commons today don't involve individuals as data owners, but rather institutions pooling data. Academic and research data commons are usually made up of institutions who wish to share research data, or large-scale population data from public bodies, for public benefit.

In these examples organising the data as commons ensure that the resource can grow and become more valuable as more people use it, while also ensuring that data is accessed by trustworthy actors who agree to use the data for specific purposes and meet relevant security standards. For instance, the Open Commons Consortium (OCC) brings together over 30 partner organisations from universities to private companies. One working group within the OCC includes the Open Science Data Cloud, which invites universities to share their data into a petabyte-scale science cloud for researchers.

Another example is the NCI Genomic Data Commons - a commons used by over 100,000 researchers, containing over 2.5 petabytes of cancer genomics and other clinical and imaging data. According to one of its architects Bob Grossman, a key principle is that it can interoperate with other platforms. There's also a strong emphasis on building trusted partnerships with organisations who agree to security standards and principles for making data searchable and easy to integrate (e.g. FAIR principles which ensure that data is tagged and machine-readable, shared Application Programming Interfaces (APIs), and so on).³⁹ By co-locating data and inviting researchers to contribute data according to shared standards, the data commons builds economies of scale which in turn reduce costs for researchers, who no longer have to host data, and can easily integrate and analyse across many different datasets.

A commons-based approach can also help reconcile challenges of sharing research data where researchers may want to retain some level of ownership over their work. The Dataverse project is a global network of researchers and institutions who have set up a federated network for sharing research data from all disciplines. The network was created by Harvard University, but actively involves community members in platform governance from all around the world via Slack, community calls, technology sprints or contributions via Github.

Dataverse solves a problem that has long dissuaded researchers from contributing data to professional archives where they risk losing control over their research data, or are not adequately credited for its use.⁴⁰ Researchers share their data into a 'dataverse', which are containers that store datasets, documentation, code and metadata. Researchers then can track scholarly citations and have full control over their datasets, from who they share data with to when they publish it. Researchers can set permissions on the data using a system called Datatags, which is a way of assigning access requirements on sensitive datasets. Datatags may be used to say if there is personal data included in the dataset, who may access it, how long the data should be stored for, or what kind of encryption is required. These are updated over time, often

---

Footnotes

2. 'Public-private' data commons

from requests by members of the community.⁴¹ Dataverse now hosts more than 70,000 datasets and has around 60,000 downloads per month.⁴² in this example the commons provides a shared set of rules which help to align incentives between data contributors and consumers, ensuring that a wider community can benefit from research data in a way that builds trust and in turn improves the value of the resource over time.

Another category of data commons will be data around specific fields, linking public and commercial data, and involving institutional partnerships across the public and private sectors in cities. Mobility is a good example. Some commons-like arrangements are emerging whereby cities and private sector companies enter into agreements to share data with one another on agreed upon terms. Here commons may be an answer to friction or lack of trust, or where there is a need for collaboration and compromise between different partners who may benefit from sharing data.

This will be particularly useful when it comes to sharing mobility data between, say, local ridesharing companies and city governments, and could be facilitated via a trust or a data collaborative. Shared Streets is an example where data from local companies and governments is aggregated or anonymised before being made available on terms agreed by both parties.

Another example is the Los Angeles Mobility Data Specification (MDS) Provider API, which requires dockless scooter companies to send information about individual devices directly to the city. The MDS initially led to a number of companies pushing back, claiming that these requirements violated user privacy.⁴³ In response the Open Mobility Foundation – a type of commons aiming to foster greater collaboration and accountability between public and private actors – has been set up to govern how these rules are created. Together a consortium of actors decide upon a set of model policies, privacy and data security, procurement and technical guidelines that inform the development and implementation of MDS in cities. Any member (public or private sector) may contribute to projects or be appointed as a liaison to one of the foundation's committees or working groups. Discussions between members take place on an online discussion board. The organisation calls itself 'a new kind of public-private forum' to ensure that the MDS platform is created in a way that provides the highest benefit to the largest number of people across cities and sectors.⁴⁴

Identity verification and finance – two fields where blockchain innovation is starting to have an impact – are other areas where this category of commons can provide value. Here a wide range of actors come together to build a trusted network, where each member participates in the storage and maintenance of a decentralized database, with one-member-one-vote over key decisions. The Decentralised Identity Foundation, Sovrin Foundation, or even Libra (proposed Facebook-led currency), which bring actors together from across private, public and non-profit sectors, are just a few examples. These are likely to grow in value as decentralised identity or cryptocurrencies become more widely used around the world. Though it's not clear yet how robust these commons are, or whether they will genuinely be able to build trust among all the different stakeholders who rely on them.

3. Collective action data commons

The next set of data commons involve more personal contributions by volunteers, and generally involve less sensitive data. Examples might include citizen science communities like Public Lab or iNaturalist, where people collect and share data with one another (e.g. photos, observations or questions related to biodiversity) in order to solve challenges. The Louisville Data Commons gathers citizen sensed data like pollen counts or odours, via a 'SmellMyCity' app. It's managed by seven community volunteers and data is approved for credibility and anonymity before published under a Creative Commons license.⁴⁵

Activism is another valuable area where these types of commons are emerging. Examples like Ceasefire Iraq and Safecity, which anonymously map local witness accounts of human rights abuses and sexual violence respectively, show the value of these types of commons might have in the humanitarian sector.

4. Personal/private data commons

In these examples the barriers to entry have to remain low to ensure large-scale participation. The need to build and sustain large volumes of volunteers means that there needs to be clear rules around community governance, as well as proactive moderation of online behaviour.

A related challenge is ensuring these commons can be inclusive, and provide opportunities for a diverse range of people to participate in their governance. A good example is Decidim, the digital democracy platform used by the City of Barcelona. The platform itself hosts digital debates, local government consultations and online petitions, all of which generate information about people's political opinions and voting preferences. Yet the community also hosts participatory processes and debates on the orientation of the Decidim project and software, via a parallel platform called 'MetaDecidim'.

In a recent experiment as part of the DECODE project, a multi-stage deliberative process was used to draft a new policy for the City – a 'Data Commons Manifesto' – while also discussing how data should be managed on the Decidim platform (e.g. discussing the use of DECODE technology as a more robust, privacy-friendly and transparent identity verification and data management system). It then culminated in a final vote using the integrated DECODE-Decidim technology. The experiment involved a range of offline discussions, and the community published the results of all conversations for comment online, making it transparent and open for anybody to join.

A final category of commons are those made up of much more sensitive data. The rules and challenges in this category are similar to the previous category, yet the data are much higher value to the individual and rarely shared widely (e.g. data from wearables, location data, private messaging data or health care records.

These data commons require much more careful, tightly knit governance arrangements. These are often informal, localised and highly deliberative. They may also require specialized technology which can help minimise data leakage and give individuals more control of what they're sharing.

A good example of this is the DECODE Internet of Things pilot, in which Barcelona residents installed environmental sensors which record data such as noise levels, pollution, temperature and humidity from both outside and inside their homes (making the data highly sensitive). DECODE technology enabled local residents to share this encrypted data anonymously within their community. The pilot also ran sessions to train and support participants to help them setup and use the sensors to gather and analyse the data with others within their neighbourhood to influence city-level decisions. It tackled the technical challenges of collating and storing of stream of citizen-sensed data, while also enabling those citizens to control what information is shared, with whom, and under which conditions (we give a fuller account in the following chapter)

There's huge potential for data commons containing more personal data to scale and expand across communities, so data can be integrated and compared across cities or regions. Yet given the sensitivity of the data, the challenge lies in making the commons as responsive as possible to participants whose data is in the commons.

Brighthive are a data trust company showing how this might be achievable with labour market and jobs data. In one project, they are working with the State of Colorado connecting data from citizens from middle schoolers to adults, who input personal information about their educational qualifications and training. Data is then securely shared among agencies and organisations to provide insights into how the jobs market is changing across the state, while providing individuals with personalised job recommendations. The most important feature is ensuring that data flows and decisions about who has access to data are transparent and accountable to those who contribute data. Parents and other data contributors are included in the governance board process and are given an electronic vote over how decisions are made, which is enshrined in the trust's data sharing agreement. Brighthive is also working on parental and individual consent management mechanisms that are configurable, track the provenance of data through the system and allow individuals to opt-out if they wish to do so.⁴⁶

Combining different commons

It's important to acknowledge that the categories are not mutually exclusive and it's likely that there will be overlap between different types of commons. Many actors within the data commons previously described make decisions on behalf of individuals (e.g. academic institutions or government departments), yet successful commons also need to allow for a much wider group of people to participate in the governance if they want to. Where the data is highly sensitive, or likely to cause harm if mishandled or shared with untrustworthy actors, then this becomes all the more important.

Here an overlap between 'Academic and research data commons' and 'Personal/private data commons' will be very likely. Many research data commons could benefit from greater public engagement with those who the data refers to. Not only could this make the data resource richer (i.e. by inviting people to donate more granular data from personal devices or wearables), it will also build trust by making the commons more accountable and responsive to a wider group.

PatientsLikeMe and other citizen science projects are a good example of what the outcome of this could look like, which blends personal experiences on health forums with larger-scale biological data and universities/companies who conduct research (although the governance structure isn't organised as a commons). Midata.coop is another good example, organised as a co-op to ensure that members have a voice over how sensitive health data is accessed and shared externally.

Some of the most nascent but interesting data commons blend elements of 'Public-private' data commons' and 'Personal/private data commons'. Examples of this include city data commons dashboards that bring different datasets together and make it easy to blend data from different sources. This is what DECODE is trying to achieve with the Barcelona Now Dashboard, which brings together around 30 available public and commercial datasets (including data on housing, noise, tourism mobility and other open data), and gives people the opportunity to collect and map citizen-sensed data to compare and generate their own insights. The Barcelona pilots integrate with the Barcelona City Hall data architecture (the CityOS data lake, the open source IoT sensor network Sentilo, and the Barcelona open data portal) and benefits from the ethical digital standards set up by Barcelona CTO that include an ethical data management policy that mandates the use of 'privacy, ethics and security by design' and new data sovereignty procurement clauses.⁴⁷

Layers of governance

There are various options for governance of commons, which are typically presented along a spectrum of top-down to bottom-up approaches. In reality, many options will take the form of a hybrid. An example at the top-down end of the scale might be similar to how a public statistics body is run – as an arm of the state, but run by non-state professionals and in practice accountable to other researchers and experts. In the middle of the scale you might see a community group given a license to manage an urban park by the city authority owner, as long as they abide by certain use principles. At the other end of the scale, it is difficult to imagine a pure self-governance model in a city, as the infrastructure and technologies often include decisions made by those outside of the citizen group, and these models can end up unrepresentative of the population. However, the DECODE project pilots have demonstrated how bottom-up approaches supported by bold and innovative city governments' data policies and Ethical Digital Standards⁴⁸ can operate as an effective hybrid model.⁴⁹

Nesta's (forthcoming) Data Sharing Toolkit⁵⁰ suggests that the best-fit governance model will depend upon the answers to a set of questions around themes such as who has decision-making power, where accountability lies, and how risk is managed. An additional element of the power dynamic depends on who will choose the structure and who will run the data commons.

A crucial part of success for many of these commons will be in making the right assumptions about how much time people are willing to spend participating. In many cases it will be unreasonable to expect individuals to participate proactively, and at the very least a simple 'opt-out' could provide people with the opportunity to retract or withdraw their data from the commons if they no longer want to take part. It might also involve the creation of different 'layers' of governance, each of which overlap, but adopt different decision-making roles for different groups.

As the previous examples show, there are some commons that are best suited to creating higher-level rules over standards, APIs or data-sharing principles. These inevitably require highly technical knowledge and accountable policy decisions. In other cases, it's much more about making more moral or more strategic decisions about how data is collected, what it's used for and who has access. These will require much broader participation. In some instances, decision-making will need to be highly local, depending on the audiences involved or affected by the decision. In sum, there may be many different components within a data commons that need governance from technical infrastructure right down to the more moral, or everyday decisions about who should have access to the commons and why.

We envision a range of governance layers emerging, operating alongside or nested within one another. This might be through different groups, committees or boards that operate in parallel and make decisions relevant to different components of the system. This bears out Ostrom's emphasis on the importance of a range of supportive governance structures surrounding common property regimes, helping to build what Calleja-López called 'recursive' commons,⁵¹ where different types of institutions overlap and support one another, as DECODE examples show.⁵²

DECODE data commons

One of the most challenging areas to build successful data commons is 'Personal/private data commons' (section 4 in the previous chapter). It involves personal data that is highly sensitive, and where there is usually little precedent for sharing data across organisational boundaries. It's also where DECODE ideas and technologies have the highest potential to contribute.

In this section we provide an overview of the four DECODE pilots, each of which contributed to this conception through a series of experiments in two European cities. We split these into two broad themes which contribute to the question of how to build city data commons: digital identity and democratic governance. Under digital identity we describe two pilots in Amsterdam which set out to explore potential use cases for a different way of expressing identity that give people more control over the information they share. Under the theme of democratic governance, we provide an overview of two pilots in Barcelona, one of which tested DECODE technology as part of an open consultation process; and another which engaged a local community in a citizen sensing experiment. These two pilots were brought together through the BarcelonaNow platform, a tool that explore data and put it to the service of the community through an open source online dashboard that integrates into the wide city data infrastructure, taking advantage of the data sovereignty policies released by Barcelona CTO. From the experience of the pilots, we summarise with three practical use-cases which cities can use DECODE for, as a foundation upon which to encourage the creation of new city data commons and policies to take back data sovereignty for citizens.

Digital identity and data commons

A secure and reliable digital identity system needs to be at the heart of any data commons that involves sharing of personal data. A digital identity system provides authentication of actors within a network, and can help to build trust between diverse participants who need to know who they are interacting with. However most digital identity systems on the internet today are overly centralised (thus making them vulnerable to attack) and are controlled by governments or corporations who may use them for tracking or surveilling their users.

One of the biggest challenges for DECODE has been in providing a robust identity system that avoids centralisation, with something that builds trust and empowers users to take control over personal data. The technology with which DECODE has attempted to develop this system is called Attributed-Based Credentials (ABCs).

The aim of ABCs is to replace what we know as personal data within DECODE as a series of 'attributes', which are simple pieces of information which help to describe a person. For example, a participant may have the attribute that they are 'over 18' or 'a resident of the city of Barcelona'. Attributes can be authenticated by an issuing party (e.g. a city government) and then cryptographically bound into an 'credential'. Once these credentials have been issued they can be stored in a secure digital app on the user's phone, and then used without any intervention of that issuing party anymore (users only need to interact with the issuing party once).

Attributes or bundles of attributes can be used to express certain 'credentials', which are defined by different parties in the network as conditions for accessing a service. For example, an entitlement for giving young people free access to the digital collection of the local library may be that they possess a credential by the City Government that contains the attribute 'under 18'.

The upshot is that DECODE can enable internet services to offer a whole range of personalised applications while greatly minimising the amount of sensitive information that needs to be collected and sent across the internet (because only relevant attributes need to be shown, rather than e.g. a full identification document).

Attributes have other useful features. They can define a range of things, like the specific organisation a person sits within, their role, their location, their department, and more. When it comes to actually sharing data, we can create mechanisms that allow individual participants to declare and enforce agreements about how data is accessed using these attributes (Attribute-Based Encryption). For example, a user may be able to encrypt personal data and say that this information can only be unlocked by the people that possess the specific attributes that they choose: such as only by certain people or organisations ('only medical professionals'), or in specific locations ('only within my neighbourhood').⁵³

No single entity needs to control the network. ABCs within DECODE are built upon open standards. A wide range of credential issuers may participate within a network, from local governments to NGOs, community groups and companies. The key point is that users interact with credential issuers in a way which minimizes data leakage, and makes their activity untraceable across different domains.

By giving people secure means to share personal data on their terms, DECODE's aim has been to enable a new generation of peer-to-peer digital applications where people and communities are able to flexibly decide what aspects of their identity and revealed and what remains private. We describe how two of our pilots aimed to develop a proof of concept to test this idea with local partners in Amsterdam below.

Amsterdam Pilot 1: Anonymous Proof of ID

Overview

The aim of the Anonymous Proof of ID Pilot in Amsterdam was to provide a proof of concept for the use of an Attribute Based Credentials system, and test how people interact with the process of collecting and managing personal data as attributes in a personal digital app.

This pilot created a prototype in the form of a 'Passport Box', where citizens would be empowered to verify certain details about themselves, without having to give away more detail than was strictly necessary, but holding the same level of trust in the verification of the data.

Citizens were asked to place their passport in the box. This checked the data on the RFID-chip against that on the municipal census data, and enabled them to download the verified information to their phone using a mobile app by scanning a QR code. They were then able to use an app to generate credentials based on their passport data, which they can use as needed to verify that they are over 18. Additionally, the app provided gender and name credentials.⁵⁴

Activities

The various technical pieces of the prototype were developed: the physical passport box with QR code display and RFID-chip reader,⁵⁵ the link to the municipal datastore to verify the information and confirm validation of the attribute, the app including 'Zenroom'⁵⁶ encryption and ability to store Attribute Based Credentials and produce credentials for use as required by the user.

As this development was underway, engagement with the public was undertaken to build the conversation around the data privacy issues at stake and to test out the prototype. The soft launch happened at the CTO office in Amsterdam, where local citizens and public administrations were able to learn how it could be used. The Passport Box was also tested live with attendees who had brought their passports at the 'State of the Internet' event at the OBA Theatre in Amsterdam.⁵⁷

Implications

Government agencies across the Netherlands use the DigilD national identity system, a centralised identity service which requires users to authenticate themselves with a username and password. Their national identifier is then transferred from a national citizen registry to a service provider. One local official in Nijmegen told us that for many local services – such as reporting a local issue on your street – this level of authentication is unnecessary, leading to needless exchange of sensitive personal information. In the case of ABCs, all that the council needs to be able to verify in this case is that the resident lives on that particular street or postcode.

Any subscription services run by the council or local companies to access a physical space, or a virtual space (e.g. libraries, gyms, community groups etc.), are based on identity systems that could benefit from this kind of system. What's more identity attributes are generally siloed across different organisations. Because the DECODE implementation of ABCs is open source and builds upon open standards, this could help to harmonise the approach to identity across local business and government (avoiding 'lock-in'), while giving service providers the flexibility to define their own credentials.

Although this pilot was only intended as a proof of concept, it showed the potential of Attribute Based Credentials to become a robust open standard for authorisation around personal data in a smart city context. Much of the continuing work from this pilot has involved engaging with local governments in Amsterdam and a number of others across the Netherlands, many of whom are now exploring use-cases. For instance, the Amsterdam municipality is pursuing the next steps in applications of ABCs,⁵⁸ including integration into the CityPass for (which supports people on the edge of poverty) and with the housing department for an Airbnb register. Awareness-raising from the Amsterdam pilots has additionally led to the creation of a digital identity team, as well as work with the national government of the Netherlands.

Amsterdam Pilot 2: An ethical, locally owned social network

Overview

The widespread use of social media has enabled new forms of communication, sharing, organising and community groups to develop. Much of this growth has been associated with people sharing personal data with these platforms. There are concerns over security breaches and the way in which the large amounts of accumulated personal data are owned, stored and used for the benefit of private companies. In light of this, questions are raised in terms of what alternatives could look like that address the concerns while maintaining the social benefits of such networks.

Gebied Online (GO), a community-owned, member-based cooperative platform, is one example of an online neighbourhood platform which has been developed with the aim of providing a space for communities to come together online with a different kind of model. It enables local people, groups, and organizations to see events in their neighbourhood, share news, borrow things, and meet people.⁵⁹ Individual social networks exist for set geographic communities across the city of Amsterdam, aiming to provide a safe and constructive space for community sharing, discussion and activity.

For this pilot, The DECODE team worked with GO technology to create a security-enhancing Attribute Based Credential (ABC) sign-in feature to test with one neighbourhood which uses the platform. In preparation for the integration of technology, educational workshops and events were held to raise awareness of the issues that the technology works to solve, as well as to gather ideas and feedback on how the tools might be used to build more trusted local social networks in which people have more control over the data they share.

Activities

The aim was to allow members of a neighbourhood network to share personal attributes with others in their community without sharing non-essential personal data. For example, a user could prove their place of residency based on census records without ever having to share their address with GebiedOnline. This function was created by embedding a more secure login system that asks participants to use a digital app where their personal information has been verified and turned into Attribute Based Credentials, which are stored on the user's device. With this, the user can then log in to GO by anonymously proving that they are who they say they are.

Implications

As a result of the pilot, GO are currently working to explore what the technology could look like in practice with future methods of identification e.g. peer-to-peer authentication where community members can verify that a new member lives in the neighbourhood (a credential could be issued if five local residents are able to confirm someone as a member of the neighbourhood, for instance).⁶⁰ This could form the basis for new types of online relationships where communities develop their own mechanisms of building trust, that don't rely on a central certifying authority. It may also be more secure, since fraud schemes often depend on creating a network of false identities in order to make them look like real actors.

One use-case which arose during a workshop centred around boosting social assistance for individuals in online peer-support communities. It could encourage different structures of support where individuals identify doctors, healthcare professionals or trusted care-givers within their local neighbourhood who could be asked for anonymous advice.⁶¹

Taking this further, the community workshops also explored future scenarios for ABCs in which people would be able to control the 'persona' that they want to present in different situations. ABCs let people selectively disclose attributes as and when they need to, without revealing their full identity. It means that we could imagine a more pseudonymous form of online identity management, where people present trusted but anonymous versions of themselves in different contexts (e.g. 'the neighbourhood you', the 'health system you' or the 'government you').⁶²

A key challenge for building data commons is in understanding the relationship between individual and collective ownership. As some have argued, people may actually be incentivised to withdraw personal data from data sharing arrangements for value for the public good if they are given the ability to do so, because the perceived risks of being identified are too high.⁶³ In the examples given, ABCs help us to imagine how greater level of anonymity could actually provide a more trusted and secure foundations upon which to share personal data, allowing people to keep much more control over what they reveal about themselves, deciding the terms upon which they reveal it and with whom.

Democratic data governance

The previous section showed how ABCs can provide a solid foundation for more trusted, online interactions and relationships. In this section, we show how these technologies could form the basis for new types of community governance over data. These questions were tested in two DECODE pilots in Barcelona, which aimed to pilot the use of ABCs in two practical use cases with local citizens.

A key research question which DECODE has tested is how people respond to being given more control over personal data. This is all the more challenging when dealing with new technology, which can be difficult to understand or overwhelming. While the Amsterdam pilots were more focused on proof of concepts for the technology, the aim of the Barcelona pilots was to work in partnership with the municipal Government and existing communities of citizens who were looking for digital platforms to help find solutions to their day-to-day problems (e.g. democracy, environment and health) to trial DECODE in specific use-cases, and to work closely with them in building capacity to use the technology. At the heart of these pilots was how we might develop new types of local data commons where people are empowered to collect and share data in response to local challenges. These pilots also show the potential to scale at city level, integrating with the city-wide data infrastructure managed by the municipal governments following novel policies and approaches based on data sovereignty and applying ethics, security and privacy by design in the management of city data infrastructures.

Barcelona Pilot 1: Digital Democracy and Data Commons (DDDC)

Overview

Private companies and public authorities hold huge amounts of personal information on individuals, with implications for privacy and security of people's digital identities. Additionally, people have concerns around how data given for one purpose could potentially be used in the future. An example of this is the concern that individuals may have when petition platforms require a person's full address to verify that they are eligible to sign. People may feel uncomfortable with the idea that their identity could be linked with a particular political cause.

The DDDC pilot aimed to test technology developed under the DECODE project and to create a space for discussions around the future of city data commons. The test case focused around the Decidim online platform, used by the Barcelona City Council to engage citizens in municipal discussions and decision-making.

Three DECODE-developed privacy-enhancing technologies were designed for incorporation into the Decidim digital participation platform ecosystem, to enhance privacy and user control over which data they share and for which purpose:

• The DECODE app, to allow anonymous authentication for petition signing using ABCs.
• The DECODE distributed ledger, to increase transparency and trust in the technology.
• The BarcelonaNow dashboard, to allow exploitation of participant data.
• A fourth element was a new module in the Decidim platform to make it interoperable with the DECODE system.

Alongside the practical test case, the pilot was to provide a participatory space for discussion of the politics and economics of data, and to collaboratively envisage what democratic city data commons could look like. In the case of Barcelona this large participatory process enriched the city open digitalisation strategy, leading to the decision by the Barcelona CTO to set up a new Municipal Data Office and appoint a new Chief Data Officer, as part of their Ethical Data Management Directive.⁶⁴ The new data governance strategy explicitly mentions the creation of data commons as key objective, putting citizens and their rights to data at the very centre, as stated in the municipal Data Directive:⁶⁵

"The current situation of municipal data has to be transformed in order to turn it into a public asset, or data commons, with defined governance and rules that are created from the perspective of data as a common asset. The public and private perception of data has to change from that of an asset that offers a competitive advantage to one of a social 'infrastructure' that must be public in order to ensure common well-being, and which is exchanged on a quid pro quo basis. The more data there is, the higher its quality, and the more confidence there is in the exchange and privacy rules for this common asset, the better all the stakeholders taking part will be able to perform."

Activities

There were six stages to the DDDC pilot, consisting of a mixture of face-to-face and linked online activities. The first stage looked at presentation and diagnosis – assessing the issues in the wider data economy context in relation to the pilot. In this stage the initial survey enabled the group to assess how diverse the likely participant group would be, and plan steps to increase inclusiveness going forward.

The second phase took the issues mapped in the first stage and worked with participants to gather proposals to address them within the DECODE pilot. The final stage for participants involved the collection of support for the proposals included in the manifesto for data commons, using the DECODE technology to sign in a secure and transparent manner on Decidim. The team then evaluated the pilot and launched a survey on participant experience.⁶⁶

The pilot achieved the integration of DECODE signing functionality into the Decidim platform, with 235 users.⁶⁷ The first version of the DECODE app was developed through a process of agile user experience,⁶⁸ and development started on the DECODE distributed ledger. Users were enrolled onto the pilot website where they could test the developed tools and have discussions.⁶⁹

These discussions and explorations worked towards the collective creation of the Data Commons Manifesto. Participants on the Decidim platform, as well as at the various DDDC workshops and spaces at events, were able to contribute ideas and sign the petition endorsing the final document. Many of the recommendations were also reflected in Barcelona City Council's new Ethical and Responsible Data Management Policy and in the Manifesto in favour of technological sovereignty and digital rights for cities.⁷⁰ This was achieved through good relations with the Barcelona City Council data office, which have gone beyond the pilot itself to thinking about what these technologies and structures could look like in the longer term.⁷¹ For example, one of the DECODE nodes (running on DECODE OS and Arduino boards) is currently hosted on the city council infrastructure and was installed in collaboration with city council officials.

Implications

The pilot's contribution comes in the form of testing out what a city-wide data commons system could look like – what's required in terms of different pieces of technology, governance structures and processes of bringing people together, learning, discussing and acting upon shared ideas. It demonstrated different elements of the data commons 'stack' for digital democracy applications; and it showed how they could be used to enable a fully participatory, privacy-preserving consultation process for the city of Barcelona.

The Barcelona Now dashboard, linking with other municipal data sets, was used to analyse socio-demographic data on participants, which was not previously possible due to the data minimization and privacy by design policy of Decidim. DECODE has provided the privacy-enhancing tools for people to donate this data on BarcelonaNow, enabling creation of a commons of useful data to study real-life issues that could potentially lead to the creation of public value. The proposals were then discussed in the third phase, and elaborated in the fourth, which resulted in a collaborative 'Data Commons Manifesto'. Discussions were centred around legal, governance, and economic aspects of building a city data commons. The Data Commons Manifesto was then presented and discussed publicly and proposed as an integration to the city ethical digital standards releases by the city of Barcelona as part of their citizen centric digitalization strategy.

Through the pilot there has also been testing of gathering demographic data in a distributed way, to avoid misuse. This was done through the use of credentials to take part in the DDDC processes on the Decidim platform, and to donate data which is then aggregated and sent to the platform admins, so that the information can be used without risk of de-anonymisation.

It also provided an opportunity to consult people of Barcelona on the issues that matter locally regarding digital rights and data policy. The proposals made during meetings and on the online platform included the need for publicly accessible workshops on data literacy, public engagement in research involving citizen data, and the need to explore and fund alternative commons-based business models. All of these were later published in the Data Commons Manifesto.

Regarding the pilot method itself, a key lesson was that people are better engaged through a mix of online and offline participation, through workshops, deliberations and interactive sessions. Initially images of a digital democracy focussed pilot might turn to online forums, digital tools and remote participation facilitated by an online platform. However, despite testing digital tools, the DDDC pilot achieved the vast majority of its participation at face-to-face workshops and events, rather than directly through the online space. However, it also created a limitation on the number of individuals who could be reached through the pilot.⁷² In sum, there's still a challenge in how to 'scale up' data commons processes in an accessible and inclusive way, while ensuring that enough people feel motivated to take part.

Finally, the pilot threw up new challenges regarding the legal implications of storing data on a distributed ledger. DECODE's ambition has been to experiment with a more decentralised approach to how data is collected and used. By using a distributed ledger (where each partner runs a node and data sharing is executed in a more decentralised way via smart contracts), DECODE aimed to remove any central authority from having ability to manipulate or manage credentials or data shared via the app. However the aim of decentralising power raised new implications regarding how partners should store or use data shared by participants or available on dashboards, especially in the absence of any central data controller.

DECODE's ultimate vision is for individual participants to grant or revoke access to data in a more dynamic and flexible manner, though the technology was not able to provide this in a granular way during the pilots. DECODE therefore provided something called the 'Data Commons Privacy Pledge' which was intended as a pledge by all the partners involved in the commons to strengthen and respect the powers of the data subjects as set up by the European General Data Protection Regulation (for instance, by strengthening right to deletion as well as a commitment that data is used for research for the common good).⁷³ The aim was not to provide a final document, but a draft for further discussion and to provide some precedent for new legal frameworks that can help support the development of data commons in the future.

In the coming months, there are plans to further integrate and increase the impact of the DDDC pilot building on these considerations, including further testing of the technology with the Decidim community as part of the work of the Laboratory of Innovation in Democracy.⁷⁴ The pilot also contributed to the constitution of a local, activist network on data ethics, the Barcelona Data Commons network,⁷⁵ which will also help to take these ideas forward.

Barcelona Pilot 2: Citizens' Internet of Things Data Governance

Overview

Building on an existing pilot in which a community struggling with noise pollution came together to gather data to take action in their local area, the pilot added tools to enable participants to use the sensors in a way which enhanced their privacy. This additionally enabled discussion and learning around data risks, and for the community to discuss and design data sharing policies together for the data they collected. Members of the community were provided with Smart Citizen Kits (a cheap, open hardware sensor) to enable them to gather data on noise and air pollution from inside and outside their homes, which would be encrypted and they could then choose to share with each other anonymously.⁷⁶ Participants were then walked through the process of discussing the findings, and discussed how going forward, together they might make the case to local government for measures to reduce levels of noise pollution in their area.

As well as the practical use for the community, the pilot enabled the DECODE team to investigate some of the wider context around people's willingness and ability to share personal data for public benefit.

The pilot team set up a series of workshops with the local community to find out what the problem was that they were trying to solve, and how the sensor kits could help them to do this. They spent time introducing participants to how to set up and use the technology and facilitated discussions around how the community might like to gather data and share it towards their desired impact, giving them control over what was shared.⁷⁷ Technology was developed, and specific architecture put in place (believed to be unique in the IoT context – including a web app⁷⁸ and other infrastructure⁷⁹), to allow the participants to choose what community they join and what data they share.

Activities

This pilot saw over 125 people attend six workshops and several meet-ups (average 30 participants between these), with over 1000 people impacted by the project.⁸⁰⁸¹ There were over 25 'community champions' who hosted sensors,⁸² and five users took part in a UX session.⁸³ Additionally, there were two presentations of the pilot in public events, reaching over 150 people.⁸⁴ Participation was initially encouraged through the neighbourhood community previously involved in the Making Sense project. After an open call, participants were selected to cover a spread over Barcelona, geographically, as well as a mix in terms of gender and age.

This pilot was designed under the principle of co-creation, combining practices from Participatory Action Research, User Centred Design and Participatory Design.⁸⁵ It meant that the participants collectively designed the process with the pilot team. This was to encourage engagement and ownership of the project, in a way which addressed the needs of the community itself.⁸⁶ In practice, much of this work was done through workshops and using methods such as designing user journeys and making iterative changes based on feedback gathered throughout.⁸⁷

These workshops were carefully designed to take users on a journey as a community using Smart Citizen Kits to measure things like noise and air pollution in their area, and collectively decide how they would share the data they gathered. Consideration was taken to help onboard people with the technology (through step by step guidance) and emphasise how it could be used as a tool. In between the community workshops, participants interacted with their sensor kits at home, gathering insights and reflections on using the tools to be shared in the following meetings. The city council participated in the coordination, as well as providing datasets which were opened to be able to be compared with actual sensor readings by users (e.g. sensor data publicly available on Barcelona City Council's 'Sentilo Open Platform'⁸⁸).

Implications

The DECODE technology being developed and beta tested included a DECODE web app, which walked people through the process of setting up their Smart Citizen Kits with Attribute Based Credentials; a web app which allowed people to join different online communities for sharing streams of encrypted data; the BarcelonaNow dashboard for visualisation of anonymised data, and comparing it with city data; and the Zenroom smart contract engine, which powered the entire technological stack being used.

The pilot demonstrated the ways in which communities, citizen sensing technology and data can work together to produce potentially policy-changing collective insights from data, whilst enhancing privacy through enabling individuals to have control over what they share and where it is used.

In terms of attitudes towards sharing data, there were the following learnings. Regarding changing habits, the ability to view live data from their house helped participants to make decisions. Having a sensor created conversations with housemates and friends, sparking discussions around privacy and the implications of data sharing (when data could tell if someone is at home, smoking, or having a party), improving collective awareness about privacy. An attitude of 'my data are not really mine, they belong to the public'⁸⁹ emerged as 'a shift from individual data ownership towards collective data ownership'⁹⁰ which raised questions about whether neighbour permission should be agreed.

Location of the sensor had an impact on participants' willingness to share the data generated, with locations outside home being more comfortable for sharing than sensors located inside. Additionally, participants felt that community should play a more central role for technical peer-to-peer support and data comparison.

"I would have liked to create more community around the sensor. To have a chat with users from all over the world, so that we could help each other or say 'I have been looking at this ...'. I think it is a very enriching part of the project that could be enhanced more."

Pilot participant

The pilot could be the starting point of collective environmental action, as participants felt that their data, when shared, could drive action and advocacy for change in the city, and would like to know how to take collective action with the data they collected.⁹¹

"It made me think of the implications it [data sharing] can have and that is already a big step. One of the reasons why I came to this workshop is to gain some insights [on projects about data ownership]. It changed my attitude and my awareness of data."

Pilot participant

Overall the pilot showed there's considerable potential to build capacity and involve people in collecting and sharing data at a community level. With privacy preserving and user-friendly technology and support, citizens can have an active role in monitoring, requesting and advocating for changes that affect their lives. The pilot demonstrated the potential to upscale similar sensor projects by using low cost sensors, with potential to deploy a mesh of citizen-sensors throughout the city that can contribute to a data commons with public and private data. This needs to be an inclusive and community-driven process, requiring onboarding with local residents, offline and online participation and consultation involving both citizens and policymakers alike.

Summary: Three 'ready-to-implement' use-cases for DECODE tools in cities

1. DECODE ABCs provide an open standard for more robust identity systems that give users control and minimize data leakage.

Zenroom and the DECODE ABCs are built on modular, open standards, meaning anyone can build applications on top of the system. It's also 'blockchain ready', which makes it possible to run as a decentralised network across multiple nodes (thus potentially building trust across different actors or sectors). This infrastructure could provide the foundation for a range of other local civic applications that want to provide more privacy-friendly identity management.

1. Identification of individuals with certain attributes in secure online community networks (e.g. doctors in GebiedOnline to support wellbeing in the community by being trusted local supporters).
2. To enable data minimisation through use of ABCs in a wider set of day-to-day interactions, while still allowing for eligibility to be ascertained e.g. buying certain goods (like alcohol), using municipal services (such as reporting repairs on your street).

2. The DECODE-Decidim tool provides a ready-to-use app for more privacy preserving digital democracy applications.

'Ready-to-use' implementations include signing petitions, online consultations, sharing specific data, concerns or feedback to the city council, or engaging in local dialogue via local community forums.

1. Signing petitions.
2. Online consultations.
3. Sharing concerns and feedback.
4. Local community forums.

3. Smart Citizen Kits, the DECODE onboarding site, and BarcelonaNow dashboard provide tools for community data commons for citizen science.

This brings together the work of DECODE and the Making Sense project's participatory sensing methodology for engaging local communities in citizen sensing,⁹² empowering people to gain new digital skills, collect data and make decisions on issues that matter to them.

1. Use of citizen science kits by a community to address a specific local issue such as noise or air pollution, gathering data with the intention of using it to evidence the need for a local policy change.
2. Creation of local data commons as a means of local communities feeling greater control of their data gathered in their area, and comparison between them (for decisions in their own lives) in a secure way.

See the DECODE tools page for a summary of the applications alongside links to further information, source code and software documentation.

Section 3

Four areas to support data commons approaches

This section identifies a number of key factors or components that should be central to a data commons approach in the future. Our aim here is not to provide systematic set of design principles from scratch, but rather to list some of the key characteristics which are both important and unique to a creating a commons-based approach for governing data. These blend reflections from the DECODE pilots, as well as insights from a workshop hosted at Nesta in early September 2019. They are intended to inform future research, as well as shape the policy recommendations in the final section.

Open, trustworthy digital infrastructure

A data commons needs to be built on top of open digital infrastructure. That means embedding transparency over how the technology works, and using shared and commonly used open standards. There are pragmatic reasons for this - allowing collaboration and easy integration of data rather than encouraging silos - but it's also about building trust with the people that use it. This means using technology that avoids black boxes or lengthy terms and conditions, and gives people control over data. Trust needs to lie at the heart of any data commons; it's necessary to build the positive feedback loops that encourage more data to be fed in, in turn making the commons more and more valuable to those that have access to it.⁹³

Another lesson from the DECODE project is the importance of technology being convenient and user-friendly. However open source technology is not always convenient or user-friendly for non-technical audiences (who may be indifferent to whether the technology is open source or not). Open source digital tools for building commons therefore need to put a big emphasis on user-centred design and on-boarding (i.e. simple technical explainers that make it easy to participate and understand the technology being used).

Sensitivity to power imbalances between beneficiaries, contributors, data subjects, and those participating in governance

A key part of the commons is ensuring that people can participate in decisions that affect the data commons. As one workshop participant put it:

“Going back to Ostrom – what a commons arrangement is trying to do is solve the problems with resources that can be described as commons. One way is to assign individual rights; a more commons approach is to assign rights in a way that builds consensus-based decision making.”

As discussed in section 1, however, a key challenge for the creation of successful data commons compared to traditional commons is judging where the boundaries lie. Sometimes the data subjects are the sole participants who contribute and benefit from their pooled data. Other times the contributors and the beneficiaries have no or tangential relation to the data subjects. One example of this might be Wikidata - a crowdsourced platform turning information on Wikimedia sites (like Wikipedia) into structured, searchable data. Here users have to be active contributors to gain administrative privileges, however this does not necessarily include those who benefit or are affected by the end product of the use of that data.⁹⁴

It can also be hard to know who the relevant stakeholders in a data commons are ahead of time (for instance if crowdsourced pollution maps may unexpectedly end up affecting house prices in a local area). This means that any commons needs to constantly reflect on the risks inherent in creating a data commons, who the relevant stakeholders are, where consent needs to be established and how to ensure the commons remains accessible and inclusive.⁹⁵

Barabara Prainsack recently made a similar argument in her article 'Logged Out: Ownership, exclusion and public value in the digital data and information commons.' She provides a guide helping practitioners through 'four type exclusion from digital commons'. These are: exclusion from including one's personal or other data in the commons; exclusion of people from using data and information held in the commons; exclusion from benefiting from the commons; and exclusion from participation in the governance of the commons. For each type of exclusion she suggests a series of questions to provide critical reflection on who may be excluded and how to mitigate any harmful consequences. In the most extreme case, she proposes legal mechanisms that would mandate inclusion of a person, their access to data or their ability to participate in governance of the data commons.⁹⁶ It's not fully clear what this would look like in practice. Some authors have proposed national bodies to provide a similar role and which people could turn to when they feel they are harmed or excluded by data use.⁹⁷ At any level, it is important for governments to consider how those who choose (for whatever reason) to opt out can still be represented fairly in the decisions made based on the data.

These ideas highlight a gap for policymakers to explore some of the legal issues, and highlight an interesting future avenue for research into building successful supporting infrastructure that allow data commons to emerge.

Governance needs to be open and actively work to upskill those members of the community who cannot participate

Even a cursory look at most types of digital commons on the Internet today show us that they are not diverse or even necessarily inclusive. They require technical skill, and often have heavy gender bias in terms of who the contributors are. The disproportionate number of men who contribute to Wikipedia is one example. Another example is Bitcoin or cryptocurrency communities, where discussions and governance are in theory open for anyone to join, yet the barrier to entry to participate in technical conversations or decisions is extremely high. These are not always about technical literacy, they could also be financial barriers, geographical barriers or other factors.

Commons-based approaches to data governance rely on inclusion of all those who have a stake in the communal resource. Given that these boundaries can be unpredictable and porous (see the previous point), data commons therefore have a duty to build awareness, encourage multiple opportunities for involvement, and actively upskill those who may wish to participate but currently cannot. They may also need compensate people to participate who would not otherwise find time, particularly under-represented groups. An interesting model to learn from is the City of Chicago's Civic User Testing Group (CUTGroup) which travels across different corners of the city and pays residents to test and provide feedback on the city's websites and apps. It shows the importance of being proactive about reaching out to communities who wouldn't usually be involved in technical conversations about civic technology.

Commons-based approaches need to align incentives to allow the commons to grow and be self-sustaining

Many data commons today are reliant on public grants, while others have emerged as a result of significant volunteer effort combined with a desire to do good. One of the key gaps in the current debate is about funding for commons, especially those that need to operate at scale. Ostrom's work identified a number of factors that make it more likely for common-pool resources to succeed, including the value of the resource to its users, its productivity, and the size of the system. This implies highly specific, or localised approaches, where it's very clear what the individual and communal benefit is going to be in developing a commons (e.g. in pooling health data to better understand the symptoms of an illness) are much more likely to succeed.

Yet if data commons are truly able to scale at the city level and above, then we'll need completely new approaches for ensuring their sustainability, including new business models. A range of new ideas for funding commons range are emerging in the field of token economics and mechanism design. Ocean Protocol, for instance, is a data commons platform which allows people to access data for free but pays users who provide data back to the commons in the form of tokens, which improve reputation and incentivise people to contribute more data.⁹⁸

Other approaches could focus on taxation. Governments are likely to play a decisive role in funding new data commons, perhaps through redirecting some of the flows of advertising revenue that go through to large aggregation or data brokerage platforms. Indeed this is the model used to finance some public service broadcasting in the UK. Other taxes in cities might include those on the use of Internet of Things sensors, or micro-taxes on uses of personal identity.⁹⁹

Section 4

Policy recommendations

This final section brings together insights from the previous analysis, and DECODE pilots, to make a series of practical recommendations for governments at multiple levels to experiment with, support and implement a commons-based approach for data governance. We categorise these according to the city, national and European levels.

Throughout these initiatives there would also be a role of acting as a link between different 'data owners' and the opportunities available for them to engage with, whether voluntarily or by regulation.

City level

Pilot data commons technologies in partnership with local communities linked to identified priority areas for citizens. Invest in local citizen sensing pilots or through engagement via local platforms (like GO). Start with real-world problems faced by people within the city, where sharing personal data could help address a local challenge (e.g. air pollution, health or safety and crime). Such pilots could start with less sensitive data and graduate to more sensitive data as best practice methods are refined.

For a robust policy and regulatory framework, set a clear Data Governance policy that mandates ethics, privacy and security by design. Consider encryption a right for citizens and invest in local trainings. Apply new 'data sovereignty' clauses in public procurement contracts in order to regain democratic control of data produced collectively, and make data available in open formats for citizens, companies, startups following specific access control rules.

Provide opportunities for citizens to boost their knowledge and skills around data commons technologies, and provide support for creation of community-level data commons. Provide training and resources to upskill the population, so that they are empowered and supported to start creating an ecosystem of grassroots data commons for public benefit across the city. Making sure that these tools are accessible will help reduce barriers to participation and increase diversity of those involved. Host meetings with affected communities and build capacity for using the tools. Invest in digital literacy, and explore accessible public spaces as sites for face-to-face conversations about the issues (e.g. public libraries and community spaces).

“Organise campaigns and courses about the values and impacts of data exploitation, data impact and protection.”

Data Commons Manifesto

Experiment with local use-cases for decentralized identity like ABCs that strengthen data protection and improve citizen control. As DECODE has shown, these can be the basis for a range of services that help to build trust and give people more control, from e-government services to local digital democracy applications and local social networks. Embedding these in well-used services will contribute towards a culture change and the expectation that citizens will have greater control over data, in turn influencing other sectors, and providing a viable alternative to certain uses of big tech for citizens. DECODE principles could eventually be built into the decision-making process of any new development to a service, or creation of a dataset.

“Integrate citizen initiatives and citizen science projects for public policy making."

Data Commons Manifesto

Start small when piloting new technology tools. Cities should start small before rolling out anything new, especially in the development of new technologies which involve personal data. They should be transparent about the aims and objectives for local experiments and start an open conversation with relevant stakeholders across different sectors. This too could be facilitated by an open consultation or co-creation iterative process with citizens or community groups, similar to the method tried and tested in the DECODE DDDC pilot.¹⁰⁰

Act as a standards setter for open source technology innovation. In order to improve collaboration in the development of new innovations, cities should create digital strategies that build on open standards (e.g. procurement of open software IT and e-government platforms). In addition, cities should also require companies to use open APIs as a condition for operating in the city, as Barcelona has tried to show working with dockless bike operators and local telecoms companies.¹⁰¹ These data should then form the basis for new pilots that experiment with sharing data for communal benefit.

“Enlarge community datasets through public datasets.”

Data Commons Manifesto

National level

Embed education on benefits and risks of different approaches to data management and use into school curricula. Empower the next generation to understand and make choices on the way their collective data is used through making them aware of the social, political and economic implications of different models. Present alternative solutions such as the ideas tested in DECODE and similar projects.

To foster fair competition, interoperability and data portability are key at national level. Additionally, for a robust policy and regulatory framework, apply new 'data sovereignty' clauses in public procurement contracts in order to regain democratic control of data produced collectively, and introduce data sharing mandates of public interest data for digital platforms.

Invest in research and innovation in Privacy-Enhancing Technologies (PETs). National governments should support research and development for technologies like Attribute Based Credentials, but also other PETs (like homomorphic encryption or multi-party computation) that can help unlock more of the value in personal data without revealing raw sensitive information underneath. These technologies are embryonic but will play an important role in enabling new types of data commons to emerge in the future.

“Develop and promote technological, legal and practical tools that provide privacy, security, and ethics by design.”

Data Commons Manifesto

Build a national consortium of actors who can provide trusted credentials for new, decentralised identity applications. A critical mass of practical tools need to be available, as well as a substantial number of trusted actors involved with providing credentials in order for a viable ecosystem (that provides a coherent user experience across different actors) for ABCs to emerge. We have seen examples of this in countries such as the Netherlands, where trusted public bodies are working together to employ IRMA¹⁰² in a variety of contexts. National governments should play a role in helping facilitate these new partnerships, either through funding or by co-ordinating their own experiments.

“Promotion and adoption of open standards to foster interoperability and data portability and, furthermore, of data sovereignty, beginning with public procurement processes.”

Data Commons Manifesto

Ensure that a commons-approach is robustly tested embedded in national experiments in data governance. Many national governments are now funding research and experimentation into new institutional arrangements like trusts and collaboratives that involve sharing personal data. For example, the UK government announced it would explore data trusts to facilitate better collaboration between the public and private sectors, but included little reference to how these would encourage any kind of public involvement.¹⁰³ Principles of a commons-based approach should be at the heart of these experiments, considering how diverse groups of citizens can participate, either through more dynamic forms of consent, tested by projects like DECODE, public engagement, or via providing opportunities for people to participate in higher level governance if they wish to do so.

EU level

Commit to a programme of research and practical work to explore how regulation can help to support new data commons by working with innovators. Decentralized identity and commons-based technologies are likely to bring new challenges that current European regulation is not well adapted to respond to. For instance use of personal data stores, or the use of blockchains to eliminate intermediaries in the process of identity verification, raise new data protection challenges. Given the fast-changing nature of the field, the Commission should adopt an anticipatory approach to new regulation in this area. This might include the use of sandboxes; experimental testbeds; interaction between regulators and innovators; and active engagement of the public. A similar approach has been referred to elsewhere as 'polycentric co-regulation' - in essence a commons-based approach to supporting the development of new digital commons.¹⁰⁴

For a robust policy and regulatory framework, mandate 'data sovereignty' clauses in public procurement contracts, so that data used in public services belongs to citizens. In addition, strengthen R&I investments to develop privacy-enhancing and decentralised technology for data governance. Work to link data, privacy and competition to revitalise antitrust and competition laws for digital platforms.

Fund experiments which support new markets or mechanism design that could help enable commons to grow connected to real world issues. Most data commons today are reliant on public grants. One of the key gaps is about funding for commons, especially those that need to operate at scale. Ideas for funding commons range from new taxes (perhaps city-based or sector based) to enable support for more emerging fields like token economics and mechanism design. The European Commission should fund research and practical experiments to explore which options are most feasible, and to test theoretical ideas out in practice and at different levels from the city to the international level.

“Take advantage of taxation ([e]specially to big digital corporations) to promote commons business models."

Data Commons Manifesto

Fund projects that build cross-sector, international partnerships for new commons, working with other major international players such as the UN, IADB or World Bank. New decentralised identity networks that provide foundation for new data commons will only be successful if they are able to build international, cross-sector collaborations across the continent and beyond. The European Commission should prioritise funding for the development of new decentralised technologies that have created cross-sector partnerships with the objective of building open, auditable and trustworthy digital infrastructure for identity verification, finance and other applications. Consideration should be given to what effective engagement with the private sector could look like, with the aim of expanding the use of DECODE principles to sectors where significant personal data is collected and used.

Fund competitions to encourage innovation in commons-based business models, as well as providing sustained funding. The EU has committed to using challenge prizes as a means of driving innovation within Horizon Europe. These challenges should be used to build a more active network of innovators in the field of decentralized and self-sovereign identity, and commons-based applications for data governance. The LEDGER Project, part of the European Commission's Next Generation Internet initiative, is a good example which will build upon technology developed during DECODE. Funding needs to be available to support ecosystems over longer periods of time, as well as building in interoperability of outputs, to make sure that the work of short term projects is not lost before it has the chance to scale.

Appendix 1

This appendix sets out a more detailed evaluation of each of the pilot projects, starting with key facts (location, partners and collaborators), followed by what took place, who was involved and the impact they had in relation to the pilot goals (intended impact, participants, activities, actual impact and contributions, social impact, technology impact and political implications) as well as exploitation and lessons. We have structured this appendix into the four main pilot projects, incorporating the BarcelonaNow platform as a feature embedded in both of the Barcelona pilots, bringing them together.

This evaluation is based upon a review of previous DECODE reports and other deliverables, the Pilot Evaluation Survey (jointly run with D2.6 report researchers, including self-evaluation by pilot teams), the DECODE IoT Pilot Impact Assessment report (mixed method approach for impact assessment, carried out by Ideas for Change, including interviews, feedback sessions in workshops, heuristic evaluation and surveys) and a series of interviews (with pilot teams by Nesta, by Ideas for Change and D2.6 report researchers).

Digital identity and data commons

Amsterdam Pilot 1: Anonymous Proof of ID

Pilot partner(s): City of Amsterdam, Dyne, WAAG

Purpose

Citizens often find themselves having to provide more personal data than is strictly necessary, in situations where they need to prove one or two credentials. For example, when buying a bottle of wine, an individual may be asked for proof of age. The standard process for this is to show the shop or bar employee your passport or driving license, so that they can check your date of birth to see whether you are over 18. However, instead of just knowing that you are over 18, they can see your actual date of birth, and a range of other details such as your full name and address.

This pilot aimed to create a system where citizens would be empowered to share certain details about themselves, without having to give away more detail than was strictly necessary, but holding the same level of trust in the verification of the data.

The proposed solution used Attribute Based Credentials (ABCs). These take the form of anonymised credentials given to an individual upon verification of a piece of information. For example, ABCs can take the form of gender, age of 18+ or resident of Amsterdam. There are a variety of possible sharing opportunities for ABCs, including e.g. proving that you are over a certain age for online purchases, without having to upload full identity documents.¹⁰⁵

A prototype Passport Box was built, which citizens place their passport in. This checks the data on the RFID-chip against that on the municipal census data, and enables them to download the verified information to their phone using a mobile app by scanning a QR code. The set up can generate credentials to verify that they are over 18, their gender and name attributes.¹⁰⁶

Intended impact

The aims of the Age Verification pilot were:¹⁰⁷

1. To develop something of use to the citizens of Amsterdam.
2. To give citizens access to their personal data as stored in the municipal database, and allow them to share these data in a different context.
3. To approach the pilot iteratively, so that initial steps can have a clear impact but also leave room for further development and applications.

The idea was to create a prototype with which the technology could be tested, and potential uses of the credentials could be explored, informing future developments of the technology and its uses. Within this, the pilot team aimed to provide a clear user experience, to demonstrate that these aims are possible, and to inspire further trust and belief in this approach towards citizen identity.¹⁰⁸

Self-assessment by pilot team of the extent to which goals were achieved

Participants

Participation in the sessions trying out the passport box was open to local citizens, developers and public administrations,¹⁰⁹ as well as 'State of the Internet' conference attendees, where it was possible for people to try out the passport box.

As this development was underway, engagement with the public was undertaken to build the conversation around the data privacy issues at stake and to test out the prototype.¹¹³ The soft launch happened at the CTO office in Amsterdam, where local citizens and public administrations were able to learn how it could be used. At the 'State of the Internet' event, the Passport Box was tested live with attendees who had brought their passports.¹¹⁴ This was followed by internal usability tests.¹¹⁵

Activities

The various technical pieces of the prototype were developed: the physical passport box with QR code display and RFID-chip reader,¹¹⁰ the link to the municipal datastore to verify the information and confirm validation of the attribute, the app including 'Zenroom'¹¹¹ encryption and its ability to store Attribute Based Credentials and produce credentials for use as required by the user. These features were developed by Dyne with a focus on privacy and added benefits for users.¹¹²

Actual impact and contributions

This prototype of the Passport Box enabled the development and testing of the technologies to test out Attribute Based Credentials in a real-life case study, meaning that ABCs are being better understood by members of the administration and the technology has been applied in a proof of concept.¹¹⁶

On a small scale, the pilot tested the process of giving citizens Attribute Based Credentials from their identity documents, and empowering them to use these in everyday situations requiring validification of one or more aspects of their identity, without revealing more than is necessary.

In addition, the team held consultations with public administrations of different levels and invited them to educational and awareness-raising workshops with citizens and tech professionals, to increase political support for the use of privacy-enhancing technologies in local government. For the city, it has shown proof of concept and the use of ABCs, and the Amsterdam municipality is pursuing the next steps in applications of ABC and DECODE principles to issues in the city.¹¹⁷ These include integration into the CityPass (which supports people on the edge of poverty), GebiedOnline and could additionally look at credentials for undocumented citizens.^{118 119}

The reach of the pilot has gone beyond the box and Amsterdam - having seen the idea in practice, now other cities are starting to pilot or implement open source Attribute Based Credentials in Haarlem, Leiden and Almere.¹²⁰

Technology contributions

This pilot has created a prototype of the physical passport box that can scan a passport's RFID-chip and create a QR code, the app (available at https://DECODE.amsterdam) for the individual to then access and store their credentials from their passport and the supporting technology to enable the parts to interact with each other, which uses Zenroom DECODE technology for encryption.¹²¹ This has enabled individuals using the set up to share individual verified attributes without sharing more information than is necessary for the particular interaction.¹²²

By including Zenroom testing within the process, the following were able to be implemented:¹²³

• Zencode natural language interpreter for smart contracts and data manipulation.
• More robust ECP2 based cryptography.
• 'Coconut' credential-based authentication, based on the work of A. Sonnino et al. at UCL.¹²⁴

Two distinct stages were delivered in this pilot: onboarding and attribute based disclosure,¹²⁵ though the Passport Box could be further developed to verify other attributes, and/or be applied to different contexts.

Lessons and policy implications

Government agencies across the Netherlands use the DigiID national identity system, a centralised identity service which requires users to authenticate themselves with a username and password. Their national identifier is then transferred from a national citizen registry to a service provider. One local official in Nijmegen told us that for many local services such as reporting a local issue on your street - this level of authentication is unnecessary, leading to needless exchange of sensitive personal information. In the case of ABCs, all that the council needs to be able to verify in this case is that the resident lives on that particular street or postcode.

There are a range of subscription services run by the council or local companies to access a physical space, or a virtual space (e.g. libraries, gyms, community groups etc.), that could benefit from this kind of technology. Because the DECODE implementation of ABCs is open source and builds upon open standards, this could help to harmonise the approach to identity across local business and government (avoiding 'lock-in'), while giving service providers the flexibility to define their own credentials.

The box was specifically chosen to be a physical illustration of what digital identity might mean. People may engage and understand more easily when faced with a physical object and process. However, there has to be a wider ecosystem in which the ABCs can be used usefully in everyday life. For example, with the municipality or enough shops (for e.g. buying alcohol) that makes it worth download the app and getting ABCs from your passport. This points to the need for different levels of government to continue implementing pilots of this technology at the local and national level.

Amsterdam Pilot 2: An ethical, locally owned social network

Pilot partner(s): WAAG, GebiedOnline (GebiedOnline won a WAAG challenge to be a partner in this pilot)

Purpose

The widespread use of social media has enabled new forms of communication, sharing, organising and community groups to develop. However, much of this growth can be attributed to the willingness of people to share personal data, and there are concerns over security breaches and the way in which the large amounts of accumulated personal data are owned, stored and used for the benefit of private companies. In light of this, questions are raised in terms of what alternatives could look like, that address the concerns while maintaining the social benefits of such networks.

The DECODE team worked with one example of an alternative model. GebeidOnline (GO), a community-owned, member-based cooperative platform, which enables local people, groups, and organizations to see events in their neighborhood, share news, borrow things, and meet people.¹²⁶ However, online community spaces such as neighbourhood platforms often rely on email/password or external platforms for log in, which creates unwanted dependencies and potential security issues. Current alternatives can be costly and more complex for users.¹²⁷

This pilot proposes new technological applications which be implemented by communities to enhance the security of their online platform, with a manageable and affordable set-up. Using this application, DECODE adapted and developed technology to create a security-enhancing Attribute Based Credential (ABC) sign-in feature to test with one neighbourhood which uses the platform.

In preparation for the integration of the technology, educational workshops and events were held to raise awareness of the issues that the technology works to solve, and to gather ideas and feedback on how the tools might be used to build more trusted local social networks in which people have more control over the data they share.

Intended impact

The three main goals of the pilot were:¹²⁸

1. To enable GebiedOnline users to have granular control over the data they share on the platform.
2. To integrate the IRMA API into existing GebiedOnline neighbourhood/network.
3. To allow users to login to GebiedOnline with IRMA (which provides a more secure login than is currently available on the site).

The desired impacts of the pilot fell into three categories. In terms of social impact, the aim was to raise awareness within communities about the issues that the technology aims to help solve e.g. data security and privacy control.

Technically, the pilot's impact would be integration of IRMA (privacy-enhancing technology, using Attribute Based Credentials) into the GO platform, which would provide this privacy-enhancing function to all existing members of the network.

Self-assessment by pilot team of the extent to which goals were achieved

Participants

The pilot engaged with the general citizen population as well as policymakers in terms of awareness raising and education around the issues. For testing the attribute-based login technology, a particular neighbourhood in Amsterdam which uses the GebeidOnline platform was selected.

The users can be broken down into the following categories:¹²⁹

1. The GebiedOnline community - their needs for greater control of data and ease of use drove the technical development choices for the GO pilot.
2. Public officials and administrators in the Netherlands became an interested audience to learn more about the lessons and potential future applications of ABC based on the GO case study.
3. The general public (in the Netherlands) were engaged in workshops, in public spaces, and online through educational materials (articles, videos, activities) to explore the subject of digital identity.

Activities

For the technical side, the DECODE team looked to combine and build upon technologies that would enable their users to have granular control over the data they share.¹³⁰ The GebiedOnline platform was chosen by WAAG to trial the technology. While GebiedOnline already fits a lot of DECODE values (giving people ownership of their personal data, decentralized IoT access, data shared for the public good),¹³¹ it is still "missing features on security and is not sufficiently privacy aware."¹³² So, the pilot focus was on building in security and verification, by building and piloting a set of features in a multi-step approach to use and access the platform using Attribute Based Credentials.¹³³

The first step was to build technical solutions to the issues, by integrating the IRMA API into an existing GO neighborhood platform. The aim was to allow members of a neighborhood network to share personal attributes with others in their community without sharing non-essential personal data. This function was created by embedding the IRMA login system, which provides a more secure login than is currently available on the site.¹³⁴ This works by the user having an IRMA account where their personal information has been verified and turned into Attribute Based Credentials, which are stored on the user's device. With this, the user can then log in to GO by proving that IRMA has already verified that they are who they say they are.

Co-design of the project would have required a high level of technical knowledge, however community feedback was incorporated throughout, and there was a programme of educational outreach, delivered through the Digital Identity Lab. This informed people about ethical and technical issues and risks regarding attributes, identification data ownership and management, as well as opportunities to address these issues through the uptake of technology.¹³⁵

"The workshop was part of an educational program – a set of four – where we discussed with local people/ residents, professionals and so on, talking about what would be possible in developing an e-community."

Anja Boersma, workshop lead

Examples of the resources created and used in this part of the pilot include a video series interviewing local people about their thoughts and concerns around digital identities (Digital Identity Video Series¹³⁶), an interactive online space, 'You, Online',¹³⁷ which takes participants on a journey exploring data collection, privacy and ethics, and a game which citizens were invited to try out to find out just how much information they share online.

Actual impact and contributions

The technology is in the early days of being tested by a GebiedOnline community, therefore it's not yet possible to point to final impacts. However, the pilot has so far demonstrated the benefit of having a social infrastructure in place first (i.e. working with, and addressing a problem, being faced by an existing community), rather than a tech-first approach.

The pilot aims to tackle three relevant social issues: 'user control' and being able to share data granularly; digital identity, how this is formed, and what an individual's rights and/or abilities are to shape this process; and protection of individual privacy at an institutional (governmental) level.

The technology required to enable the more secure sign in has been developed, and the latest activity consists of integration and testing in a neighbourhood. This includes introducing local residents to the IRMA login in the context of the education around privacy online, data sharing and sovereignty, and testing how it works. Initially this is to help existing users with a different way of signing in. This acts as the first stage of a future peer-to-peer validation system. There is the expectation that around 50 users will test the sign in system in the early stage of the pilots, though if successful the features can be rolled out to the wider GO community of over 6,000 users.¹³⁸

Technology contributions

As a result of this application of the technology, IRMA has developed and added new features such as including photo as an attribute, enabling transfer of credentials from a passport/id-card/driving license into IRMA attributes, and the potential use of peer-to-peer verification in Coconut protocol research.¹³⁹

For individuals, the technology provides better control of their personal data, which could be expanded to other types of data in future.¹⁴⁰ For the municipality, it provides a shared standard for privacy preserving identity authentication, and improves GDPR compliance. Though the full roll-out of the pilot is still not yet finished, the improvements to the GebiedOnline platform's login system could easily be taken up by multiple other neighbourhoods or other local e-government services.¹⁴¹

Lessons and policy implications

As a result of the pilot GO are currently working to explore what the technology could look like in practice with future methods of identification e.g. peer-to-peer where community members can verify that a new member lives in the neighbourhood.¹⁴² In future there will be the possibility of issuing their own credentials on the GO platform.

"What we want to do, because we know our neighbours, is that if my neighbour adds their zip code in GO, and I am their neighbour, I can prove that they are really who they say they are, including those who are not documented, so unable to be verified by a central authority. We will add the same function for working addresses."

Michel Vogler, Founder and CTO of GebiedOnline

There is potential for this technology to strengthen trust in communities - the verification technology enables people to know that they are sharing a space with legitimate neighbours. This could have benefits for wellbeing for individuals and the community as a whole, reducing isolation and potentially encouraging different structures of support where individuals do not want to share their identity. For example, ABCs could identify doctors in the local neighbourhood who individuals could ask for anonymous advice.¹⁴³

Due to technical capacity, there was not an opportunity to develop further uses of the ABCs, but this can be developed going forward. Alongside this is a need for adaptation and development of the smart rules surrounding attributes, multiple values for the same attribute and their storage (if they are stored on your device, losing it presents an issue).

A couple of other issues were raised in the development and testing of the technology: how can we make the interface as easy as possible for people to set up and use, and what happens if several providers of ABCs all start offering different services, who should people trust and will there be competition around possible uses? These raise important issues around who controls and manages new decentralised identity systems.

"[There are] some issues to tackle, such as the end date of an attribute, how long will it be valid [or] multiple values for the same attribute."

Michel Vogler, Founder and CTO of GebiedOnline

While the educational resources are now available and can be maintained online, additional technical implementation will require further funding.¹⁴⁴

Democratic data governance

Barcelona Pilot 1: Digital Democracy and Data Commons (DDDC)

Pilot partner(s): Led and coordinated by Dribia, with support from Institut Municipal d'Informatica de Barcelona (IMI). The Internet Interdisciplinary Institute of the Open University of Catalonia (UOC) research groups - Technopolitica and Dimmons - led coordination of the non-technical, social side of the pilot.

In collaboration with: Eurecat (leading on BarcelonaNow platform); Dyne; Thoughtworks; Barcelona City Council, Nexa Center for Internet & Society; DECIDIM; CNRS; aLabs; & Jamgo.¹⁴⁵

Purpose

Private companies and authorities hold huge amounts of personal information on individuals, with implications for privacy and security of people's digital identities. Additionally, people have concerns around how data given for one purpose could potentially be used in the future, e.g. people signing a petition may feel uncomfortable with the idea that their identity could be linked with a particular political cause.

The DDDC pilot had two core purposes: to use the Barcelona context to test technology developed under the DECODE project and to create a space for discussions around the future of city data commons. The test case focused around the Decidim online platform, used by the Barcelona City Council to engage citizens in municipal discussions and decision-making.

Three DECODE-developed privacy-enhancing technologies were incorporated into the Decidim digital participation platform, to enhance privacy and user control over which data they share and for which purpose:

• The DECODE app, to enhance privacy.
• The BarcelonaNow dashboard, to allow data exploitation.
• The DECODE distributed ledger, to increase transparency.

Alongside the practical test case, the pilot was to provide a participatory space for discussion of the politics and economics of data, and to collaboratively envisage what a democratic city data commons could look like.

Intended impact

The three main aims of the DDDC pilot were:¹⁴⁶

1. To develop and test improvements of the digital democracy platform Decidim and its integration with the DECODE system.
2. To co-create alternative narratives and imaginaries on data and the digital society.
3. To raise awareness and mobilise civil society around data-related problems and possibilities.

The pilot was designed to enable the application of DECODE-developed technologies to a real life context through the Decidim platform, as well as providing a space for discussions envisioning what citizen control over data and data commons could look like, and experimenting by constructing a city data commons.¹⁴⁷

In terms of impact, the technical part of the pilot had a focus on developing DECODE technology functionality and integration into Decidim, so that the tools would create a more privacy-enhancing and anonymous petitions functionality for the digital democracy platform. Additionally, it focused on the usability of DECODE's app, aiming to give people more control and empowerment in sharing their personal data.

---

Footnotes

The pilot also aimed to engage with city democratic data processes, by exhibiting a participatory approach to data governance, leading to practical and tangible recommendations for the City Government to adopt.

The additional desired impact was in terms of community building and awareness raising of DECODE issues, looking to have a social impact by empowering people with new knowledge about how to protect personal data online.

Self-assessment by pilot team of the extent to which goals were achieved

Participants

The DDDC pilot reached over 200 participants who were invited to take part on three grounds:

1. To contribute to the development and testing of legal, technological and socioeconomic tools aimed at creating fairer data policies.
2. To learn, share and discuss ideas around the new digital economy.
3. To create and experiment with digital data commons.¹⁴⁸

Participation took place in person and digitally, in the form of an ongoing agile development process,¹⁴⁹ consisting of 227 participants, 97 proposals, 118 votes, 86 comments, eight meetings and two petitions, as of October 2019.¹⁵⁰

Offline, the pilot has engaged participants in three workshops (76 participants), four meet-ups (111 participants) and one seminar (11 participants). There was no set criteria for participants, but there was an assumption that early adopters would be the core group. The pilot included a range of actors from civil society, public and private sectors.¹⁵¹ They additionally did five presentations of the project in public events.¹⁵²

In the first phase survey, the pilot team investigated the diversity of participants, and found (within those 33 participants): a balance in terms of gender, 73 per cent under 44, 60 per cent living in Barcelona, with the vast majority working. Additionally, only 6 per cent had an education level below university level and 60 per cent belong to an organisation or group. In terms of their interest in the project, there were high levels of concern around management of personal data (vast majority 4 or 5 on scale of 0-5), and the main worry was privacy, followed by data exploitation, mass persuasion and data monopolies. There was less concern about security and surveillance.¹⁵³

Following this analysis of the initial participants, actions were taken to reach a wider diversity of participants, by locating workshops in areas with different demographics to the majority of participants in the survey.

Activities

There were six stages to the DDDC pilot, consisting of a mixture of face-to-face and linked online activities. The first stage looked at presentation and diagnosis – assessing the issues in the wider data economy context in relation to the pilot. In this stage the initial survey enabled the group to assess how diverse the likely participant group would be, and plan steps to increase inclusiveness going forward.

The second phase took the issues mapped in the first stage and worked with participants to gather proposals to address them within the DECODE pilot.

The BarcelonaNow dashboard was used to examine socio demographic data on participants. The proposals were then discussed in the third phase, and elaborated in the fourth. Discussions were centred around legal, governance, and economic aspects.

The final stage for participants was the collection of support for the proposals, including a collaborative manifesto for data commons, using the DECODE technology to sign in a secure and transparent manner on Decidim. The team then evaluated the pilot and launched a survey on participant experience.¹⁵⁴

Actual impact and contributions

The DDDC pilot has been about relationships: relationships between different technologies, relationships between users and technologies, and relationships between citizens and city authorities. The pilot’s contribution comes in the form of testing out what a city-wide data commons system could look like – what’s required in terms of different pieces of technology, governance structures and processes of bringing people together, learning, discussing and acting upon shared ideas.

"[It] goes beyond the corporate data paradigm, as well as beyond open data and the publicly-controlled state data paradigm." Antonio Calleja López, DECODE Researcher

The DDDC pilot has brought citizens, authorities and technologies together in a new way, and in doing so has explored the interdependencies within and between systems, the necessity of the offline to support the online, and the importance of values and vision in building structures that people can get behind.

"One of most successful elements, was mobilisation of different organisations into the Barcelona data commons network." Antonio Calleja López, DECODE Researcher

From a social perspective, the pilot reached 200 people across the city, enabling both digital and in-person participation, raising awareness of data commons and the related technical, legal and policy tools to develop the space, and encouraging and providing space for engagement in the debate around such issues. This resulted in the creation of the Barcelona Data Commons network, consisting of a range of organisations working locally in the field of data.

In particular, the pilot aimed to raise awareness and contribute towards addressing the following social issues: social surveillance, data monopolies and data-based mass persuasion.¹⁵⁶ The exploration of these topics in a variety of ways – from discussions to the Data Control Wars¹⁵⁷ role play helped engage participants with the topic on a different level to wholly discussion-based projects.

These discussions and explorations worked towards a tangible impact: the collective creation of the Data Commons Manifesto.¹⁵⁸ Participants on the Decidim platform, as well as at the various DDDC workshops and spaces at events, were able to contribute ideas and sign the petition.

The goals and actions developed reflect the interconnectedness of the data commons idea with other societal issues, and the need to reflect these in all aspects of data commons design, going beyond simply considering data control, to:

1. Rights and society. Constructing a well-regulated and fair digital society, where people "equitably control, share and benefit from data."
2. Democracy: Building a more participatory democracy, "where collective intelligence, deliberation and action are boosted."
3. Economy. Moving towards a commons-based digital economy, where people have "easy ways to build commons with their digital lives, and to use them for improving them."¹⁵⁹

The idea is that the manifesto can form the basis of the underlying principles for city municipalities looking to develop city data commons.

“A fairer data economy implies to advance towards a strong model of data commons, one that goes beyond open data by attending not only to the potential of open access to data but also to the conditions of its production, to the power over and the protection from it, to its governance as well as to the social responsibility for its impacts.” Data Commons Manifesto

Technology contributions

Technically, the pilot achieved the integration of DECODE signing functionality into the Decidim platform, with 219 users.¹⁶⁰ Additionally, the first, and second (revamped) version of the DECODE app was introduced through a process of agile user experience,¹⁶¹ and development started on the DECODE distributed ledger. Users were enrolled onto the pilot website where they could test the developed tools and have discussions.¹⁶² In parallel, the BarcelonaNow platform was developed for sharing and visualisation of data.

"There are four key elements in the DDDC infrastructure: the DECODE app, a module in Decidim that is interoperable with the app, plus a distributed ledger, that connects both the Decidim module and BarcelonaNow (a dashboard for data visualization) to the DECODE app." Antonio Calleja López, DECODE Researcher

The various parts of the pilot technology contribute in the following ways:¹⁶³

• DECODE app: improving data control and sovereignty.
• Blockchain: increases transparency and democratic processes.
• BarcelonaNow dashboard: contributes to collective intelligence in technology, helps enable easier use of data and to plug into democratic processes.

Each of the technologies developed for the DDDC pilot could be used in a variety of other contexts: the app for verifying personal information for government applications; the BarcelonaNow dashboard recreated for other cities and expanded in terms of what it shows in Barcelona; and the DECODE ledger could be useful for other methods of transparently noting transactions without any personal data being included 'in the open'. However, it is the combination of these various elements together that provides a unique insight into what a multilayer infrastructure for digital democracy can look like.¹⁶⁴

"[We aimed] to articulate the relevance of building a multilayered infrastructure for digital democracy that takes into account the democratic management of data, of technologies (the infrastructures of democracy), as well as of politics itself.” Antonio Calleja López, DECODE Researcher

In the next months, there are plans to further integrate and increase the impact of the DDDC pilot. These include further testing of the technology with the Decidim community and the Barcelona Data Commons Network, as part of the work of the Laboratory of Innovation in Democracy;¹⁶⁵ public launch of the Barcelona Data Commons Network and work expanding on the Data Control Wars toolkit; and continuing to explore possibilities for city data policy with the Barcelona CTO and Data Office.¹⁶⁶

Lessons and policy implications

DDDC explores the necessity of building a multilayer infrastructure for digital democracy. Practicalities such as adaptability of technologies to context need to be supported by a wider structure that carefully considers management of data, infrastructure of democracy and management of politics itself, to provide a strong basis for the development of the city data commons.

While the pilot has led the way in showing what's possible in terms of integration of privacy-enhancing technologies into digital democracy tools, and using that context to open up spaces of discussion and visioning of possible city data commons futures, the pilot is open about challenges that they have faced along the way. In the context of digital democracy, representativeness of participants is of particular value. While the team changed their workshop locations as a result of an initial participant group skewed to those who were well-educated and younger, rather than older or migrants, for example, to try to find a more representative sample, it was challenging to reach those who are often least connected to this type of activity. This is a reminder of the need to be active in our pursuit of reaching those least represented, to enable a meaningful study of the impact of tools on the widest range of potential users.

"More diversity and more people would have been good." Antonio Calleja López, DECODE Researcher

Initially images of a digital democracy focussed pilot might turn to online forums, digital tools and remote participation facilitated through an online platform. However, despite testing digital tools, the DDDC pilot achieved the vast majority of its participation at face-to-face workshops and events, rather than directly through the online space. This created a limitation on the number of individuals who could be reached through the pilot – reaching over 200.¹⁶⁷

"Online space has not been a space of discussion, but a space to register what was going on. Most happened offline.” Antonio Calleja López, DECODE Researcher

One of the bigger challenges faced by the DDDC pilot was the unforeseen delay to the development of the blockchain technology. This meant that there were slight delays to the on- and offline activities while a temporary replacement was found for use in the pilot to support the functioning of the DDDC stack, but the custom DECODE blockchain technology is yet to be tested.

The biggest impacts of the DDDC pilot may be felt long after the end of the DECODE project, as the pilot has galvanised the creation of a network of organisations who are planning conversations around how to work with the city authorities to develop the city commons together, providing an example for other cities to follow.

In terms of policy, the pilot collectively developed the Data Commons Manifesto, and many of the recommendations were reflected in Barcelona City Council's Ethical and Responsible Data Management Policy.

This was achieved through the strong participation of the Barcelona Chief technology and Digital Innovation Office and the Barcelona City Council Data Office led by DECODE coordinator Francesca Bria, which have gone beyond the pilot itself to thinking about what these technologies and structures could look like in the longer term. For example, the novel approach adopted by the Barcelona City Council around data sovereignty and data commons has influenced the city of Amsterdam's new responsible data governance and has inspired the creation of the Cities Coalition for Digital Rights, a global alliance backed by UN-Habitat that aims to scale these policies globally. This shows the power of an enabling political context to provide direction, vision and concrete policies that enable trying new things out. There was a challenge around how the blockchain would provide transparency and auditability of the results without compromising participants' privacy. No personal data was stored on the blockchain itself, only anonymity aggregate data.¹⁶⁸

Barcelona Pilot 2: Citizens' Internet of Things Data Governance

Pilot partner(s):

Coordinated and led by Dribia with support from Institut Municipal d'Informatica de Barcelona (IMI).

Supported by external partners:

Ideas 4 Change and FabLab.

In collaboration with:

Barcelona Digital City (Barcelona City Council), Nexa Center for Internet & Society; Eurecat (leading on BarcelonaNow platform); CNRS; Dribia; aLabs; Thoughtworks; Dyne & Jamgo.¹⁶⁹

Purpose

DECODE builds on the Making Sense project, where a Barcelona community was struggling with noise pollution in their local area. They only knew from their own experience and anecdotal evidence, though, which was difficult to use as evidence to ask for a change.

People have lost control over their personal data online and we still do not have a good understanding of people's willingness to share data for public benefit. Partly this could be due to the difficulty of understanding personal data and its current uses, and there being few precedents for creating tools such as "data licenses' to enable sharing of personal data on specific terms set by the user.¹⁷⁰

The pilot provided the community with citizen sensor kits to enable them to gather data on noise and air pollution (amongst others) which would be encrypted and they could then choose to share with each other anonymously.¹⁷¹ At the heart of the pilot was an exploration of people's willingness and ability to share personal data for public benefit.

The pilot team set up a series of workshops with the local community to find out what the problem was that they were trying to solve, and how the sensor kits could help them to do this. They spent time introducing participants to how to set up and use the technology and facilitated discussions around how the community might like to gather data and share it towards their desired impact, giving them control over what was shared, under which conditions.¹⁷²

Intended impact

The desired impacts from the pilot sat across the social and technical fields, in terms of finding out more about people's attitudes and willingness to share data for public benefit (including the types of trade-offs people might be willing to make), testing the DECODE technology out and raising awareness of the issues and alternatives to current systems.

The overall objective of the pilot was to test DECODE technology to enable community sharing of data for social good, using data with potential consequences of sharing, such as noise and ambient sensors.¹⁷³

The three main aims of the pilot were:¹⁷⁴

1. To run a social test on reception, usability and understanding of the system for privacy preserving data gathering among groups of individuals who decide the level of anonymity of the data they share.
2. To undertake a Technological test of state of the art cryptographic technology for data gathering among different individuals, including the entire architectural flow.
3. To raise awareness on the dangers of IoT contextual data and co-create data sharing policies to test granularity of data sharing permission rights for IoT.

The pilot lead also emphasised the wish to engage a community of citizens and co-design the DECODE technologies, including dynamic attribution rights; to perform a collaborative citizen science campaign aimed to collect, analyse, govern and share data that can help to understand aspects of the environmental pollution in different areas of Barcelona.

Self-assessment by pilot team of the extent to which goals were achieved

Participants

This pilot saw over 125 people attending six workshops and several meet ups (average 30 participants between these),¹⁷⁵ with over 1,000 people impacted by the project.¹⁷⁶ There were over 25 'community champions' who hosted sensors,¹⁷⁷ and five users took part in a UX session.¹⁷⁸ Additionally, there were two presentations of the pilot in public events, reaching over 150 people.¹⁷⁹

Participation was initially encouraged through the neighbourhood community previously involved in the Making Sense project. After an open call, participants were selected to cover a spread over Barcelona, geographically, as well as a mix in terms of gender and age.¹⁸⁰

Activities

This pilot was designed under the principle of co-creation, combining practices from Participatory Action Research, User Centred Design and Participatory Design.¹⁸¹ This meant that the participants collectively designed the process with the pilot team. This was to encourage engagement and ownership of the project, in a way which addressed the needs of the community itself. In practice, much of this work was done through workshops and using methods such as designing user journeys and making iterative changes based on feedback gathered throughout.

The following overarching activities were advertised as part of the engagement strategy:

The main pilot activities were structured around a series of six workshops with members of the community:

• Pilot kick off.
• Barcelona Citizen Science Data Governance pilot launch.
• Personal data awareness and entitlements - objectives were clearly scoped, defined, designed and implemented.¹⁸²
• Technology onboarding - deployment of 25 open hardware sensors testing the technology, gathering up to 3.25M data (data events counts in the encrypted datastore).¹⁸³
• Data awareness.
• Final action and wrap up.

These workshops were carefully designed to take users on a journey as a community using citizen science kits to measure things like noise and air pollution in their area, and collectively decide how they would share the data they collected. Consideration was taken to help onboard people with the technology (through step by step guidance) and emphasise how it could be used as a tool.

"We had to go the extra mile to create that extra guide to facilitate the process. This will possibly change the results we are expecting in terms of impact. We expect tech to be informed by experience.” Mara Balestrini, Community engagement leader

Alongside the workshops, the DECODE technology was being developed and beta tested¹⁸⁴ to enable data sharing by the pilot community from the Smart Citizen kits to the BarcelonaNow dashboard, for visualisation across the city. The technology used in this pilot consisted of the following (all software open source):

• Zenroom: the smart contract language powering DECODE, based on Attribute Based Credential implementation called Coconut.
• Data store, Data policy, Stream encoder: A novel architecture for privacy preserving IoT gathering, where user retains control of the data at all times.
• DECODE smart citizen app: Smartphone app for iPhone and Android to ease set up of the smart citizen kit using DECODE.¹⁸⁵ Alongside this the DECODE web app allows set up of the entire stream of encryption of the sensors.
• BarcelonaNow: A website hosting an open source dashboard that exposes public data and allows easy visualization and combination with public and private data sources. BarcelonaNow is DECODE tech compatible, and allows for exploration of datasets at different levels of granularity.
• Data policies cookbook: Policies resulting from common agreement of community regarding data sharing practices in IoT.¹⁸⁶

In between the community workshops, participants interacted with their sensor kits at home, as they collected data, and were able to visualise it on the BarcelonaNow and Citizen Science platforms.

Actual impact and contributions

The pilot demonstrated the ways in which communities, citizen sensing technology and data can work together to produce potentially policy-changing collective data, whilst enhancing privacy through enabling individuals to have control over what they share and where it is used.

The pilot collected data on participants' perceptions and experiences of participating in the DECODE pilot, using the DECODE and Smart Citizen technologies, and changes to their level of awareness around data governance through taking part in data sharing activities.¹⁸⁷ It also explored the conditions under which participants would be willing to share certain types of data.¹⁸⁸ The pilot considered how we can ask people to participate by donating data, if they do not control its use. An example could be for scientific purposes around health or climate challenges, in a way which does not compromise their own private lives.

It showed a method of onboarding technology that takes into account the need to make it easy, and in line with a community aim, even for those with a low level of technology and data interaction and knowledge.¹⁸⁹ The pilot sought to explore how we can convince people that data IoT technology sensors deployed around a city, especially in houses, can be dangerous for privacy. The pilot was able to provide participants with actual examples and visualisations, leading to small group discussions around e.g. how placing noise sensors indoors could have implications in terms of neighbours' perceptions of their private activities, or the potential impact on property prices due to sensor placement in environmentally adverse areas.¹⁹⁰

Additionally, it explored how we can transform people from customers into actors of technologies, even if they are not technically savvy. This was done through explaining the technology and the ways in which users can choose to activate and deactivate the way in which the data is shared and visualised. However, there is still work to be done to make the technicalities less overwhelming for some participants.¹⁹¹

"There is so much to be won from designing the tech with the people.” Mara Balestrini, Community engagement leader

Many participants joined because of interest and existing knowledge, some because of wanting to monitor environmental variables in their area.¹⁹² They showed interest in continuing proactive engagement with future activities in the data sovereignty and environmental sensing area,¹⁹³ potentially using this as a tool for advocating for change in their area.

The pilot recorded specific findings on attitudes towards sharing data and community features of the project, with the following coming from the pilot Impact Assessment.¹⁹⁴ Regarding changing habits, the ability to view live data from their house helped participants to make decisions. Having a sensor created conversations with housemates and friends, sparking discussions around privacy and the implications of data sharing (when data could tell if someone is at home, smoking, or having a party), improving collective awareness about privacy. An attitude of 'my data are not really mine, they belong to the public' emerged as 'a shift from individual data ownership towards collective data ownership', which raised questions about whether neighbour permission should be agreed. From the impact survey, the following change was evidenced:

• Are the data you create yours? 75 per cent yes before pilot, 90 per cent yes after pilot.
• Do you think that the data you create can show who you are? 75 per cent yes before pilot, 70 per cent yes after pilot.

"It made me think of the implications it [data sharing] can have and that is already a big step. One of the reasons why I came to this workshop is to gain some insights [on projects about data ownership]. It changed my attitude and my awareness of data." Pilot participant

Interestingly, this showed a greater feeling of ownership over data – which can be taken either as having more control over the sharing and use of data, or actually as a feeling of individual rather than community ownership, due to greater awareness of risks.

"This data is mine only up to a certain extent because I am gathering it, but it actually belongs to everyone because I am not creating it, I am not responsible for the noise. By not creating this data all the time, I think I feel more of an obligation to return it to the common good." Pilot participant

Location of the sensor had an impact on participants' willingness to share the data generated, with locations outside home being more comfortable for sharing than sensors located inside. Additionally, participants felt that community should play a more central role for technical peer-to-peer support and data comparison.

"I would have liked to create more community around the sensor. To have a chat with users from all over the world, so that we could help each other or say 'I have been looking at this ...'. I think it is a very enriching part of the project that could be enhanced more." Pilot participant

The pilot could be the starting point of collective environmental action, as participants felt that their data, when shared, could drive action and advocacy for change in the city, and would like to know how to take collective action with the data they collected.¹⁹⁵

"I believe that not everyone is aware of the issues around data governance, because they really do not know that they have the capacity and possibility to access their data. These types of pilots allow people to be aware of that. And above all, being part of such an initiative helps you tell others that this can be done, and to those who are interested, tell them that they can join. I believe that we are starting at a place where owning our data is the beginning of a major change." Pilot participant

Technology contributions

24 participants used the Smart Citizen kits with the web-app and BarcelonaNow platform.¹⁹⁶ Several UX sessions were run to test the technologies out, gaining feedback which influenced their ongoing development.¹⁹⁷ A lot of attention was paid to developing the usability of the technologies based on this feedback, which contributed to the successful implementation of this novel architecture.¹⁹⁸

Additionally, this process gathered useful comments on potential further uses of the technology as well as notions of perceptions of privacy and data sovereignty in interactions with electronic devices.¹⁹⁹

There was, however, a slight delay on the delivery of the technology, which had a negative impact on participant engagement.²⁰⁰ The make up of the group changed through the pilot – those who stayed tended to be more tech savvy and with a particular interest in the field.²⁰¹

Heuristic evaluation (a 'usability engineering method for finding usability problems when testing new technology')²⁰² of the technology was carried out, asking users about different aspects of the sensor kit's interface and usability. The highest scoring aspects were 'Aesthetic and Minimalist Design' (average 8.05/10) and 'Visibility of System Status' (average 7.95/10), with 'Error Prevention' (average 6.35/10) and 'Flexibility and Efficiency of Use' (average 6.42/10) scoring lowest.²⁰³

"[Heuristic evaluation] could be one of the biggest contributions. How you design so that people make sensors work, not 1000 different steps and get lost." Mara Balestrini, Community engagement leader

In terms of feedback on the technology itself through the pilot, key issues were raised around sensory setup and data visualisation. Regarding sensory setup, overall there was little to no difficulty in onboarding and installation of sensors.²⁰⁴ Two issues were repeatedly mentioned: the difficulty of finding a space for sensor where it could be permanently charging (as otherwise it could run out of battery and did not notify the user), and understanding what the different light signals meant.²⁰⁵

For data visualisation, while all participants expressed interest in viewing their data on both the BarcelonaNow and Smart Citizen platforms, most found it difficult to visualise their own data on BarcelonaNow, and tended to prefer using the Smart Citizen platform, despite this not being restricted or mediated by DECODE credentials, meaning that their perception of privacy in the pilot may have been influenced by this.²⁰⁶ Additionally, they would like more granular control over which data is shared where and over when it is sharing or not, as well as average reference point for ease of data comparison.²⁰⁷

As the pilot has provided proof of concept, the tools and technologies are now ready to be adopted by others.²⁰⁸ For NGOs, they enable people to donate private data in an aggregate and privacy-respecting manner, which could be used for community advocacy and activism to address local issues. For individuals, the pilot raises awareness of the potential dangers of IoT devices in homes, with DECODE providing the potential to enable direct monitoring of their immediate environment. For the municipality, these tools can help bring together private and public data for better decision making, and could pave the way to distributed sensing networks powered by citizen participation across the city.²⁰⁹

For local committees, the pilot empowers people to gain evidence on the issue of local noise and air pollution, which could be scaled up to gather other types of data. From the private sector perspective, it provides proof of concept of a process for delivering aggregated results within GDPR compliance, and could lead to implementation of solutions that are privacy-aware, with user control over data, which still benefit companies. For the academic sector, the pilot shows a way in which people can donate environmental data, which can benefit studies of related topics. For the project implementation partners, the pilot delivers proof of concept and paves the way to larger-scale experiments of this kind, leading to wider use across society.²¹⁰

The BarcelonaNow platform can continue to be used in Barcelona and in other cities, and the DECODE system could continue to be used as a back-end for smart-citizen projects. The pilot is a unique implementation of data protection for IoT devices, and as such could be exploited in this context, or adapted for health (for example, projects like salus. coop, by Ideas 4 Change pilot partner) or other data contexts.²¹¹

Participants from the pilot have also been participating in two other citizen science projects: CitieSHealth, which collects environmental data to tackle health concerns in five European cities, and Salus Coop in which citizens are supported to share clinical data safely for health research. Building upon the DECODE pilots, the technology could then be applied to more sensitive data uses.²¹²

Lessons and policy implications

It takes a lot of time to get people thinking about the issues, understanding the technology and being comfortable using it. When people are unfamiliar with technologies, this may affect how well they engage with them.²¹³ This space is already dominated by the big tech companies, which has created a certain set of usability expectations of users, without a full understanding of the data 'payment' behind their use of the service.²¹⁴

This pilot worked well because it was positioned as a means to an end – the community could see how this helped them to address the bigger issue in their local area.

There is a lack of clear understanding of data privacy concepts, and the lines between the benefits and downsides of choosing to share data are not clear cut, and this pilot helped understand where some of the tensions lie.²¹⁵

The project could benefit from further ongoing work around the user experience of the technological stack as a whole.²¹⁶

For this pilot, enabling factors were found to be: social awareness/need, pervasive impact of IoT technologies and the potential harm they could cause, and well-functioning technology. Inhibiting factors were: requirement of high levels of technological knowledge in distributed settings and cross-domain fields, little incentive for private companies (if not forced by regulation) as systems are costly compared to traditional systems.²¹⁷

The Barcelona City Council participated in the pilot, providing support, access to city infrastructures and materials.²¹⁸ Additionally, the City Council boosted the possible uses of the BarcelonaNow platform by sharing datasets which enabled the participants to compare the data generated with that held by the Council.²¹⁹

"Something that also seemed a bit surprising to me is that when I compared the data from my sensor to data provided by the city council, they did not match at all." Pilot participant

In future this could be expanded – by investing in and linking further citizen science networks generating data with municipal datasets, contributing a city data commons of public and private data. This would enable a wider range of actors to explore and use data to tackle city-wide issues.²²⁰

"A takeaway from this project is feeling that citizens can have an active leading role by monitoring, requesting, advocating in an activist way for certain changes that affect their lives but that they haven't monitored or advocated for." Pilot participant

Appendix 2

Data Commons Manifesto

Data Commons Manifesto

This Data Commons Manifesto was created by dozens of people collaboratively using DECODE technology on the Decidim platform, as an activity and outcome of the DDDC pilot. It was promoted by Tecnopolitica.net and Dimmons.net, research groups at the Internet Interdisciplinary Institute of the Open University of Catalonia and shared at events in Barcelona between 2018 and 2019, and is still open for contributions and signing at the time of writing.²²¹

Summary

This manifesto projects a vision of the digital society, today and tomorrow. A vision embodied in the technologies, narratives, legal tools, activist networks, and emerging institutions we live in and, live for, in the context of Barcelona. A vision that connects with others elsewhere. The main goal of this manifesto is to project such vision, and to call others to join us in this desire to build a new digital world in the shell of the old. The document is divided into three parts, a diagnosis of the threats and possibilities latent in digital societies today, a statement of the convictions, principles and values underlying the Digital Democracy and Data Commons pilot, and a preliminary list of of goals and actions to achieve them.

This manifesto, has been promoted by Tecnopolitica.net and Dimmons.net, research groups at the Internet Interdisciplinary Institute of the Open University of Catalonia, in the context of the DECODE project. It reflects the discussions and proposals of dozens of people and collectives involved in the Digital Democracy and Data Commons participatory process, in the co-creation workshops 'Distributed architectures for data sovereignty: DDDC pilot kick off', 'Sharing Cities Summit', 'Data Control Wars', 'Conversation: data commons and breaches in surveillance capitalism' and 'DDDC Sprint: DDDC Manifesto co-writing meeting', which took place in Barcelona between late 2018 and early 2019.

Description

Diagnosis

Today, everything can be turned into data.

Digital technology is deeply changing the world and the way we work, learn, move, share, decide; even the way we love.

Although we produce data we do not control it. Data controls us. More precisely: who controls data and technologies, controls us.

Data has value, but it is extracted and exploited without our awareness, and concentrated in a few hands. The most valued companies base their business model on it, and the trend is pervading the rest. States rebuild themselves around data, as well. The quest for profit and power fuels today the datafication of the world.

As a result, our individual and collective rights, and the very shape of our lives, are threatened and redefined in new forms of surveillance, exploitation, manipulation, or discrimination. New (or old) inequalities, subjugations, dysfunctions and divisions emerge.

Democracy is endangered too. Data is used to influence the political decisions of millions. Economically, it feeds monopolistic platforms that erode people's rights, impact the environment, and give lease life to an unjust and unsustainable economic system.

Capitalism is pushing socio-technical progress down narrow paths, where the possibilities of people, data and digital technologies are not realised. However, there are alternatives. Against the quest for profit and power, they outline a quest for wealth and potentialities for the many rather than for the few.

Free software, hardware, knowledge, and culture point towards a digital society without artificial scarcity, grounded on a logic of fairness and cooperation rather than exploitation and competition. Innovations in digital democracy as well as in the solidarity and cooperative digital economy multiply, and could help to address local and global challenges. Activism for data awareness, empowerment, justice or commons is mounting. Increasingly digitally educated and skilled citizenries are there to be mobilized. Some public institutions react, and new regulations such as GDPR, even if insufficient, can be useful in the struggle.

Against corporate data and extractivism, open data and personal data control initiatives are a step in the right direction. However, we must go further. A fairer data economy implies to advance towards a strong model of data commons, one that goes beyond open data by attending not only to the potential of open access to data but also to the conditions of its production, to the power over and the protection from it, to its governance as well as to the social responsibility for its impacts. It implies to avoid data-centric visions by looking not only to data but also to the technological, legal, economical, social and other structures that define it. Strong data commons go also beyond regulations and initiatives centered on individual control over personal data by pointing towards the centrality of the collective dimension.

Resuming: there is a need to advance from open data to data commons, from 'my data' to 'our data'. Data commons means data of, by and for the people.

Beliefs, principles and values

In the face of this, we declare that:

1We still believe in freedom, equality, and fraternity, and the need to strive for a just society. A socio-technical contract on data in the digital era will be necessary to advance towards it.

• We believe in data sovereignty/autonomy, data justice and data commons: people should be able to equitably control, share and benefit from data. If the market has symbolized freedom and the State formal equality, we believe commons points towards fraternity and sorority, and should be the base of a better digital society.
• Data collection and use must be consensual, fair and transparent (Good Data Principle #11).
• Data is not neutral or unbiased, so it must bear a critical, political and ethical analysis.
• Privacy and data protection are key: furthermore, people have the right to be free from all forms of unlawful or unfair interference in their digital life.
• Data is usually relational, so we must think beyond the individual, towards collective rights.

2We believe in democracy. Data and digital infrastructures should be used to nurture a radical and augmented democracy, a society where everyone is allowed, able and willing to rule, and where collective intelligence, deliberation and action are boosted.

• Data should primarily nurture emancipatory social transformation instead of unjust perpetuation, blind disruption or mere innovation.

3We believe in an economy that respects and nurtures the living, from nature to our own lives. Today, data and digital infrastructures are a basic building block for this.

• Corporations should respect people's digital life and rights worldwide, the State should work for this, and people ascertain it.
• Sharing and collaboration are fundamental for equal and fair digital societies. People should have easy ways to build commons with their digital lives, and to use them for improving them.
• Data should not only respect human rights and the natural world but to help them to flourish (beyond Good Data Principle #14).

4We also believe data is only a small piece in such endeavors. People and life are their centers.

Goals and actions

These beliefs, principles, and values inspire us to define a set of broad goals. These goals demand action (from civil society, the public sector, and academia, especially, but from the private sector). Below, we list some preliminary proposals for action gathered in open meetings during the DDDC process:

1Rights and society. Constructing a well-regulated and fair digital society.

• Co-construction of a model of data commons, by an initial community comprising any organizations (be it civic, public or private) citizenry, including a contract of technological and social protocols able to reconcile all parties' interests in a trustworthy, privacy-protecting and mutually value-producing way.
• The public sector must regulate, monitor and audit data as well as data-powered (i.e. algorithmic) procedures in order to ensure citizens' rights and well-being.
• Promotion and adoption of open standards to foster interoperability and data portability and, furthermore, of data sovereignty, beginning with public procurement processes.
• Develop and promote technological, legal and practical tools that provide privacy, security, and ethics by design.
• Promotion of quality data ecosystems, including indicators of data science for the common good.
• Development and promotion of more understandable (user friendly) privacy agreements, terms of use and other legal tools.

2Democracy. Building an augmented democracy.

• Fund experiments for developing more democratic data governance models.
• Stir citizen participation in the definition of research using public data.
• Awareness. Moving towards a data-aware society, with a holistic and critical vision of data.
• Raise campaigns to promote terms and conditions and privacy policies that enable digital commons.
• Organize campaigns and courses about the values & impacts of data exploitation, data impact and protection, etc.
• Develop educational plans on critical data management and science.

3Empowerment. Advance towards a digital society where people are able to control, share and exploit data.

• Enlarge community datasets through public datasets.
• Promote the use of free and creative common licenses that also ensure personal and community rights.
• Promote grassroots data analysis and visualization programs.
• Develop a data commons design toolkit.
• Generate spaces where citizen can participate in data-based research agendas, specially, based on public data.
• Promote the release of open resources to facilitate public and community data exploitation (notebooks).
• Integrate citizen initiatives and citizen science projects for public policy-making.

4Economy. Moving towards a commons-based digital economy.

• Incentivize the development and scope of digital platforms that do not base their sustainability in user's data exploitation, but in a commons oriented sustainability model, where users, funders and community take a step forward taking the lead of this sustainability.
• Take advantage of taxation (specially to big digital corporations) to promote commons business models.
• Make for-profit users of open data pay for it proportionally to their intensity of use.
• Research different platform models in order to characterize them and develop data commons economic viability models.
• Organize trainings about data commons exploitation and foster commons-oriented businesses.
• Support data sovereignty and commons communities and ecosystems, with local impact.

---

Footnotes

Endnotes

1https://www.nesta.org.uk/blog/new-ecosystem-trust

2https://theodi.org/article/odi-survey-reveals-british-consumer-attitudes-to-sharing-personal-data; https://www.dataiq.co.uk/articles/attitudes-data-sharing-vary-across-europen-says-survey

3Bria, F. 2018, Our Data is valuable. Here's how we can take that value back, The Guardian: https://www.theguardian.com/commentisfree/2018/apr/05/data-valuable-citizens-silicon-valley-barcelona

4Including from a workshop, hosted at Nesta in London in September 2019, where we brought together a range of experts in data governance to explore the concept of data commons greater detail.

5https://sifted.eu/articles/barcelonas-robin-hood-of-data-francesca-bria

6https://decodeproject.eu/publications/city-os-connection

7https://decodeproject.eu/publications/barcelona-open-data-sentilo-and-iris-api-available

8https://decodeproject.eu/publications/deployments-pilots-barcelona

9https://ajuntament.barcelona.cat/digital/en/blog/publication-of-the-balance-for-the-barcelona-digital-city-plan-2015-2019

10https://www.barcelona.cat/digitalstandards/en/data-management

11https://www.barcelona.cat/digitalstandards/en

12https://citiesfordigitalrights.org

13https://www.aiforhumanity.fr/pdfs/MissionVillani_Report_ENG-VF.pdf

14https://apps.apple.com/es/app/decode-app/id1451694589

15https://datacollaboratives.org

16https://datacollaboratives.org/explorer.html

17https://onetransport.io

18https://cphsolutionslab.dk/en/news/city-data-exchange

19https://amsterdamsmartcity.com/projects/amsterdam-data-exchange-amdex

20https://gdc.cancer.gov

21https://dataverse.org

22I.e. with collective decision making about governance and access regulated via individual licenses.

23https://theodi.org/article/odi-data-trusts-report

24https://theodi.org/article/odi-data-trusts-report

25Sylvie Delacroix, Neil D Lawrence, Bottom-up data Trusts: disturbing the 'one size fits all' approach to data governance, International Data Privacy Law, ipz014, https://doi.org/10.1093/idpl/ipz014

26https://www.saluscoop.org/, https://www.thegooddata.org

27Hardin, G. (1968), 'The Tragedy of the Commons', Science, Vol. 162, Issue 3859, pp. 1243-1248, https://science.sciencemag.org/content/162/3859/1243

28Of course the management of commons does imply some level of exclusion, however it is an exclusion not based on prices but on deliberative rules decided by the participants. See for instance: Vercellone C., Brancaccio F., Giuliani A., Vattimo P. (2017), Il Comune come modo di produzione. Per una critica dell'economia politica dei beni comuni, Ombre Corte, Verona' (p. 51).

29Hess, C and Ostrom, H. eds. (2007) Understanding Knowledge as a Commons: from theory to practice. The MIT Press.

30https://www.fern.org/fileadmin/uploads/fern/Documents/fern_community_forestry_nepal.pdf, p.11.

31Mulgan, G. (2018) Big Mind. Princeton University Press.

32Fuster Morell, M. (2010, p. 5). Dissertation: Governance of online creation communities: Provision of infrastructure for the building of digital commons.

33https://journals.sagepub.com/doi/abs/10.1177/0098858817700245?journalCode=jlma, p.661.

34Mahmoud, S. (2019) Sharing and Caring: Understanding different models for building a Digital Commonwealth. IPPR Progressive Review. Vol.28(1).

35Beckwith https://link.springer.com/content/pdf/10.1007%2F978-981-13-2694-3_11.pdf

36Beckwith https://link.springer.com/content/pdf/10.1007%2F978-981-13-2694-3_11.pdf

37From lot Impact Assessment.

38Contextual integrity (Nissbaum) citation.

39https://www.nesta.org.uk/blog/new-ecosystem-trust

40Ostrom, E. (1990) Governing the Commons. Cambridge: Cambridge University Press.

41https://medium.com/@rgrossman1/some-proposed-principles-for-interoperating-data-commons-3668c6cf48df

42https://dataverse.org

43Interview with Danny Brooke, August 2019.

44https://slides.com/mercecrosas/dataversecommunity2017#/25

45https://www.wired.com/story/why-uber-fighting-cities-data-about-scooters

46https://www.openmobilityfoundation.org/faq

47https://louisvilledatacommons.org

48This builds on technical work conducted by the T3 Innovation Network. https://www.uschamberfoundation.org/t3-innovation/background-reports

49https://www.barcelona.cat/digitalstandards/en

50https://www.barcelona.cat/digitalstandards

51https://www.wired.co.uk/article/barcelona-decidim-ada-colau-francesca-bria-decode

52Nesta and Smart Dubai - Data Sharing Toolkit: Approaches, guidance & resources to unlock the value of data (forthcoming - expected January 2020).

53Calleja-López, A. (2018). Technopolitical democratization and data commoning: the case of the Digital Democracy and Data Commons (DDDC) pilot. Working Paper. DECODEproject.eu. Retrieved from https://tecnopolitica.net/sites/default/files/D2.5 Technopolitical%20Democratization%20and%20Digital%20Commoning_V1.0.pdf

54Mahmoud, S. (2019) Sharing and Caring: Understanding different models for building a Digital Commonwealth. IPPR Progressive Review. Vol.28(1).

55This feature is more experimental and still only a research topic within DECODE.

56https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

57https://www.DECODEproject.eu/blog/claim-verification-18-summary-DECODE-pilot-amsterdam

58https://zenroom.dyne.org

59https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

60https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

61https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

62From 'Deployments of pilots in Amsterdam'.

63Based on discussion with WAAG.

64https://www.nist.gov/sites/default/files/documents/2016/09/16/mit_rfi_response.pdf

65http://jolt.law.harvard.edu/articles/pdf/v25/25HarvJLTech1.pdf

66https://www.barcelona.cat/digitalstandards/en/data-management

67https://www.barcelona.cat/digitalstandards/en/data-management/0.1/objectives

68https://dddc.DECODEproject.eu/processes/main

69From public data available at dddc.DECODEproject.eu

70From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

71From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

72https://www.barcelona.cat/digitalstandards/manifesto/0.2

73Antonio Calleja López, DECODE Researcher.

74From Pilot Evaluation Survey (jointly run with D2.6 report researchers) and public data at dddc.DECODEproject.eu

75For more on this work, and to read the Data Commons Privacy Pledge in full, see 'D1.9 Licensing of digital commons including personal data', https://www.DECODEproject.eu/publications/licensing-digital-commons-including-personal-data-update

76From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

77https://datacommons.barcelona/es

78https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

79See DECODE report D5.6 'Deployments of pilots in Barcelona' https://DECODEproject.eu/publications/deployments-pilots-barcelona

80iot.DECODEproject.eu

81https://DECODEproject.eu/publications/iot-privacy-enhancing-data-sharing-integration-pilot-infrastructures

82From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

83https://docs.google.com/document/d/IYOI-IEFs9jFUxgt2lzJw2OWGVVZi_aw_XDfr5a9yG50/edit#

84https://docs.google.com/document/d/IYOI-IEFs9jFUxgt2lzJw2OWGVVZi_aw_XDfr5a9yG50/edit#

85From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

86From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

87https://docs.google.com/document/d/IYOI-IEFs9jFUxgt2lzJw2OWGVVZi_aw_XDfr5a9yG50/edit#

88https://docs.google.com/document/d/IYOI-IEFs9jFUxgt2lzJw2OWGVVZi_aw_XDfr5a9yG50/edit#heading=h.llgcjm4qftg

89https://docs.google.com/document/d/IYOI-IEFs9jFUxgt2lzJw2OWGVVZi_aw_XDfr5a9yG50/edit#

90http://connecta.bcn.cat/connecta-catalog-web

91DECODE IoT pilot Impact Assessment.

92DECODE IoT pilot Impact Assessment.

93DECODE IoT pilot Impact Assessment.

94http://making-sense.eu/wp-content/uploads/2018/01/Citizen-Sensing-A-Toolkit.pdf

95https://datacommons.org.nz

96Mahmoud, S. (2019) Sharing and Caring: Understanding different models for building a Digital Commonwealth. IPPR Progressive Review. Vol.28(1).

97One workshop participant mentioned the use of stakeholder maps and systems maps as a useful tool which help draw out different people involved and understand the power relationships between them.

98https://journals.sagepub.com/doi/full/10.1177/2053951719829773

99https://www.academia.edu/40012096/Big_Data_Governance_Needs_More_Collective_Responsibility_The_Role_of_Harm_Mitigation_in_the_Governance_of_Data_Use_in_Medicine_and_Beyond

100https://oceanprotocol.com

101Mulgan, G. (2018) Big Mind. Princeton University Press.

102https://www.nesta.org.uk/feature/innovation-methods/anticipatory-regulation

103https://www.wired.co.uk/article/barcelona-decidim-ada-colau-francesca-bria-DECODE

104https://privacybydesign.foundation/irma

105https://www.gov.uk/government/publications/artificial-intelligence-sector-deal/ai-sector-deal

106See: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2990043

107https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

108https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

109From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

110https://www.DECODEproject.eu/blog/claim-verification-18-summary-DECODE-pilot-amsterdam

111From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

112https://www.DECODEproject.eu/blog/claim-verification-18-summary-DECODE-pilot-amsterdam

113https://zenroom.dyne.org

114DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eupublications/deployment-pilots-amsterdam

115https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

116https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

117From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

118From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

119From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

120From Roadmap: Digital Identity and Services 2019-2020, originally by City of Amsterdam, from D5.5.

121https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

122From 'Deployments of pilots in Amsterdam'.

123DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

124DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

125DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

126https://arxiv.org/pdf/1802.07344.pd

127https://www.DECODEproject.eu/blog/claim-verification-18-summary-DECODE-pilot-amsterdam

128https://www.DECODEproject.eu/blog/DECODE-pilots-amsterdam-experiment-attribute-based-credentials

129https://DECODEproject.eu/pilots

130From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

131From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

132DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

133DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

134DECODE report D1.1, Scenarios and Requirements Definition Report p. 61 https://DECODEproject.eu/publications/pilot-scenarios-and-requirements

135DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

136DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

137DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

138(Dutch https://digitaleidentiteit.waag.org/artikel/video-serie; English subtitles https://policylab.waag.org/article/video-series/) interviews with local citizens

139(Dutch https://digitaleidentiteit.waag.org/jij-online/ and English https://policylab.waag.org/you-online/) interactive article which reader inputs into.

140From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

141DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

142From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

143From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

144DECODE report D5.5, 'Deployment of pilots in Amsterdam', https://www.DECODEproject.eu/publications/deployment-pilots-amsterdam

145Based on discussion with WAAG.

146From Pilot Evaluation Survey (jointly run with D2.6 report researchers) and DECODE deliverable D5.9 'Final report on the Barcelona Pilots, evaluations of BarcelonaNow and sustainability plans'.

147https://dddc.DECODEproject.eu/processes/main

148From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

149Summarised from https://dddc.DECODEproject.eu/processes/main

150From https://dddc.DECODEproject.eu/processes/main

151From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

152From https://dddc.DECODEproject.eu

153From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

154From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

155Survey of first phase participants.

156https://dddc.DECODEproject.eu/processes/main

157https://dddc.DECODEproject.eu/processes/main Note: Minor style changes made by Nesta.

158From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

159Mostly developed by a partner Becoming, on technopolitics, with other partners.

160Full text of the Data Commons Manifesto is in Appendix 2.

161From Data Commons Manifesto https://dddc.DECODEproject.eu/processes/main/f/6/petitions/1

162From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

163The first version of the app was developed by ThoughtWorks and Dribia, and the second by Dribia. See DECODE deliverables D4.10, 'UX/UI for DECODE app development integrated to BCNNow', https://DECODEproject.eu/publications/uxui-DECODE-app-development-integrated-bcnnow and D4.14, 'Final DECODE app release' https://DECODEproject.eu/publications/final-DECODE-app-release

164From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

165Antonio Calleja López, DECODE Researcher.

166Antonio Calleja López, DECODE Researcher.

167From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

168From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

169From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

170https://www.DECODEproject.eu/blog/data-entitlements-licences-and-privacy-design-DECODE-first-design-case-study

171https://dddc.DECODEproject.eu/processes/main

172https://docs.google.com/document/d/lmXyvc53lNrJbiDTr6-gu28v7rlf8tT45ymTztQ3jFyY/edit

173See DECODE deliverable D5.6, 'Deployments of pilots in Barcelona' https://DECODEproject.eu/publications/deployments-pilots-barcelona

174See DECODE deliverable D5.6, 'Deployments of pilots in Barcelona' https://DECODEproject.eu/publications/deployments-pilots-barcelona

175From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

176From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

177From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

178Ideas for Change, Barcelona Citizen Science Data Governance Pilot (2019, forthcoming on the DECODE website).

179Ideas for Change, Barcelona Citizen Science Data Governance Pilot (2019, forthcoming on the DECODE website).

180From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

181From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

182From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

183Ideas for Change, Barcelona Citizen Science Data Governance Pilot (2019, forthcoming on the DECODE website).

184From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

185From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

186From https://docs.google.com/document/d/lxnsOhylufCR_-0892kjMYRebyYpTCZHIdfwRG-Zo274/edit

187See http://start.DECODE.smartcitizen.me

188Wording from response to Pilot Evaluation Survey (jointly run with D2.6 report researchers).

189From IoT Impact Assessment.

190Ideas for Change, Barcelona Citizen Science Data Governance Pilot (2019, forthcoming on the DECODE website).

191Based on Pilot Evaluation Survey (jointly run with D2.6 report researchers).

192From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

193From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

194From IoT Impact Assessment.

195From IoT Impact Assessment.

196From IoT Impact Assessment.

197From IoT Impact Assessment.

198From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

199From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

200From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

201From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

202From IoT Impact Assessment.

203From IoT Impact Assessment.

204From IoT Impact Assessment.

205From IoT Impact Assessment.

206From IoT Impact Assessment.

207From IoT Impact Assessment.

208From IoT Impact Assessment.

209From IoT Impact Assessment.

210From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

211From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

212From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

213From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

214From DECODE report D2.6 'Impact and economic sustainability of DECODE Ecosystem and future developments'.

215Ideas for Change, Barcelona Citizen Science Data Governance Pilot (2019, forthcoming on the DECODE website).

216From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

217Ideas for Change, Barcelona Citizen Science Data Governance Pilot (2019, forthcoming on the DECODE website).

218From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

219From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

220From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

221From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

222From Pilot Evaluation Survey (jointly run with D2.6 report researchers).

223https://dddc.DECODEproject.eu/processes/main/f/13

58 Victoria Embankment London EC4Y ODS

Email: [email protected] Twitter: @decodeproject Website: www.decodeproject.eu

Nesta is a registered charity in England and Wales with company number 7706036 and charity number 1144091. Registered as a charity in Scotland number SCO42833. Registered office: 58 Victoria Embankment, London, EC4Y ODS.

Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License