Seven proposals for the Model Law on Health Data Governance

By guest contributors Meg Davis, Sharifah Sekalala, Franco Serra, Belinda Rawson, Molly Pugh-Jones, and Leo Anthony Celi

This week, Transform Health Coalition will launch a draft Model Law on Health Data Governance in a side event for the World Health Assembly. As scholars and practitioners working in digital health governance, we suggest seven areas where the draft model law could be strengthened, and call for more debate.

In proposing the law, THC calls for consensus around the essential elements of national legislation to address health data governance. But speeding to consensus risks masking deeper structural problems. The unequal treatment effect of digital health tools largely hinges on unequal historical power inequalities both within and among countries. Any model law that does not acknowledge these historical power disparities risks being window washing. While a model law can offer government officials a framework to begin internal discussions, it also risks a homogenising effect, troubling in the context of the global movement to decolonise global health governance and address data extractivism.

Given issues with public trust in health systems in the wake of the Covid-19 pandemic, especially the failure of much-touted digital solutions such as digital contact tracing, human rights safeguards and meaningful public consultations that lead to real change have become essential. In interrogating the draft model law, we aim to move the conversation forwards in the spirit of constructive debate.

In this spirit, we offer seven provocations to our colleagues from the Transform Health Coalition:

1. Allow meaningful input and wide participation in developing a model law. THC convened an online consultation 7 to 30 April and invited multilingual feedback in English, French, Spanish, Portuguese and Arabic: very welcome linguistic diversity (though omitting Chinese, also an official UN language, was a missed opportunity, given important data governance debates underway in China and Taiwan).

What constitutes meaningful consultation on a draft global governance norm? This question begs discussion. The brief three-week online consultation left little opportunity for low- and middle-income (LMIC) governments and experts to input into a complex proposal with far-reaching human rights implications. In the wake of the Covid-19 pandemic, and in the context of the decolonisation agenda, global projects for digital health governance such as this one ought to set a new standard for public participation, ensuring greater transparency and democracy than in the past. A meaningful process should involve multiple feedback rounds, with clear communication as to how feedback was analysed and incorporated, how input has shaped revisions, and any opportunities to discuss and resolve queries. 

2. Embed civil society and community participation at all levels: Furthermore, the text of the draft law does not address the need for civil society and public consultation at national and community levels, which is especially important for women and groups that have historically felt the brunt of both algorithmic discrimination and digital harms. The Lancet and Financial Times Commission on governing health futures 2030: Growing up in a digital world, the first review of global digital health governance, called for young adults be consulted in development of digital health strategies and policies, but this is not addressed in the model law. This risks creating digital governance tools that once again fail to address the needs of young people, who have experienced the fast-tracking of the digital transformation, but are rarely consulted.

3. Build in accountability for data colonialism: The draft model law provides little accountability for multinational corporations. Data is increasingly extracted from low- and middle-income countries for profit in high-income countries. While the US and other high-income countries are finally taking steps to sanction sale of sensitive health data to third parties, this regulation so far only applies to actions within those countries, and does not address the same behavior overseas.

We call for more attention to the need to protect data subjects from collection, processing and use of transnational flows of health data without their consent. If the model law does not restrain multinational corporations from having free reign of the market, it will not do much to rebuild public trust. The rationale for THC’s creation of a new concept of “health data generators” with proprietary rights and interests could be better explained.

4. Avoid homogenizing diverse local contexts. The draft law makes assumptions about diverse national contexts, including the pre-existence of a robust and fully-implemented national data protection law. In practice, existing regulation varies, as does implementation and public awareness of legal rights.

The draft model law also proposed an independent tribunal to handle breaches. This proposal was challenged in consultation calls we participated in, given that countries have diverse administrative and civil court regimes that may already be addressing these matters. A separate health data tribunal risks creating confusion at national levels. The reference to the pandemic accord in the draft model law also raised questions, given that the current draft fails to protect human rights or address data protection.

We hope to see this feedback taken on board in the final published version of the law.

5. Address risks to those most likely to experience harms: We were concerned not to see language on rights of those most affected by privacy breaches, such as women and groups that have experience historical discrimination (such as LGBTQ+ people, people living with HIV, sex workers, people on the move, persons with disabilities, minoritised groups, linguistic minorities, indigenous people, and others). A robust health data governance law must recognise and address diverse needs.

6. Call for investment in digital literacy: While the importance of addressing data literacy is mentioned, it is not addressed with specific provisions. Participatory action research in Ghana, Kenya and Vietnam has found a need for more investment in digital and data literacy training, including awareness for the public of their rights and how to protect themselves from harms. Strengthening the digital knowledge, skills and competencies of diverse publics will contribute to more robust and effective rights-based digital governance.

7. Add an accountability plan – To hold us all accountable, THC should lead in developing an evaluation framework to monitor the effectiveness of each of the items we list above. How can we assess whether we have sufficiently engaged those who are most likely to be harmed by innovations that will arise from the use of health data? How do we measure civil society and community participation at each level? How do we quantify the return on digital literacy investment? We propose that these questions should be addressed by the same people we would like to engage, using a participatory approach. 

We agree there is a need for more concrete work to address weak digital and data governance for health, and welcome Transform Health Coalition’s leadership. To promote rights-based digital health governance, we call for broader debate and consultation, and a shared plan to engage national governments and civil society openly on what regulation of the digital transformation will truly work for all.

About the authors:

Molly Pugh-Jones (she/her) is Advocacy Manager at STOPAIDS. She has over six years of experience in youth and community organising, and currently supports coordination of global advocacy for the Digital Health and Rights Project. She completed her MSc in Global Health and Development at University College London.

Disclaimer: Views expressed by contributors are solely those of individual contributors, and not necessarily those of PLOS.