A Guide to First Nations Data Sovereignty (ID-SOV)

About these resources:

This guide features information developed by Terri Janke and Company for the Victorian Aboriginal Controlled Community Health Organisation (VACCHO), Infoxchange client, presentation to the Data Catalyst Network in June 2024, plus resources from Maiam nayri Wingara, the Australian Indigenous Data Sovereignty Collective and the international definition of rights to self-determination as described in the United Nations Declaration on the Rights on Indigenous Peoples (UNDRIP). More on Terri Janke in the references below.

Terri Janke and Company has provided consent for Infoxchange to adapt and reproduce the Indigenous Data Sovereignty (ID-SOV) slides presented by VACCHO for the purpose of providing information to organisations and individuals on the Data Resource Hub. 

PLEASE NOTE: This information is for personal use of Data Catalyst Network subscribers only and must not be copied, published, shared, adapted, altered or used in any other way without the express written consent of Copyright © Terri Janke and Company, 2024. All rights reserved. 

Infoxchange uses “First Nations” when referring to the non-homogenous countries and community groups of Aboriginal and Torres Strait Islander peoples throughout this article. We acknowledge that our offices operate on the stolen land of the Wurundjeri, Kaurna and Turrbal peoples, the traditional custodians of the land, waters and knowledge for this place where we gather to collaborate and strengthen communities. We pay our respects to Sky Country and Country, First Nations Elders, past, present and future, and acknowledge the ongoing colonisation and trauma impacting them to this day.

What is First Nations Data?

First Nations data refers to all information, in any format or medium, that is about or may affect First Nations peoples both individually and collectively (First Nations Information Governance Centre, 2016). When working with data that pertains to First Nations communities, First Nations, or Indigenous Data Sovereignty (ID-SOV) rights must be respected to ensure First Nations Peoples own, control and govern their data including maintaining control over aspects of research and information management incorporating their data, and extending to the control of resources and review processes.

Many existing processes have harshly homogenised data not reflective of unique community groups. Recognising and respecting ID-SOV principles ensures that First Nations peoples can govern what data is collected about them or their culture, for what purpose, where it is stored and used for service delivery, and design contextual-specific indicators needed for rebuilding communities and strengthening First Nations peoples’ collective wellbeing.

It is important for individuals and organisations working with First Nations people and their data to evaluate foundational principles for collecting, accessing, handling and using data and developing projects and consider whether existing held data meets the requirements of ID-SOV in practice.

What data should be governed by First Nations peoples?

First Nations data refers to all information and knowledge, in any format or medium that is about or may affect First Nations peoples both individually and collectively (First Nations Information Governance Center, 2016).

This may include data on:

• Personal information

• Housing

• Employment

• Education

• Finances and Tax

• Health care and Wellbeing

• Practices

• Environment

• Land history

• Geological information

• Titles

• Water information

• Social data

• Use of services

• Indigenous Cultural and Intellectual Property (ICIP) including:

• Traditional cultural data

• Oral literature

• Ancestral knowledge

• Cultural information

• Community stories

The excerpt below is from Terri Janke and Company’s ID-SOV presentation that was prepared for the Victorian Aboriginal Community Controlled Health Organisation (VACCHO). It is important for NFPs who engage with First Nations data to become familiar with the requirements for identifying data, obtaining free, prior and informed consent, collecting, storing, using and interpreting First Nations data, and making such data available to First Nations people.

What to consider when collecting First Nations Data (ID-SOV)

ID-SOV principles require that First Nations peoples exercise control over the creation, collection, development and analysis of data. Activities involving the First Nations data should be relevant and empower self-determination (including First Nations leadership and co-design) and effective governance by First Nations people.

Organisations and individuals should:

• Determine data collection priorities:

  • Why is data being collected?

  • How does the activity benefit First Nations people/fill a gap?

  • How will data be used? By whom?

  • Is there Indigenous leadership and co-design?

  • Is there clear understanding and agreed purpose with participants?

• Consent:

  • Has there been appropriate consultation with First Nations people?

  • Has Free, Prior and Informed Consent for collection and use of data been obtained?

  • Is there a proper written record of consent and any limitations on use? 

  • Is there compliance with Privacy Laws?

• Collection protocols (Indigenous Data Governance):

  • Are there any cultural protocols or restrictions on the collection of data?

  • How is this recorded and kept?

  • Where will data be stored?

  • Who can access data?

  • Has sensitive information (cultural, legal or personal), been identified and properly labelled?

  • Can data be removed/deleted upon request?

(Managing First Nations Data in Practice, prepared by Terri Janke and Company for VACCHO, Slide 5, June 2024.)

How should data be stored and accessed?

Storage: Storage of Indigenous Data (ID) should prioritise data sovereignty, custodianship and Indigenous Data Governance (ID-GOV). This requires data to be stored in accordance with the individual or community’s preferences,  the implementation of robust security measures to protect ID from unauthorised access, breaches or misuse, application of ID-SOV principles and ID-GOV obligations, ensuring privacy policies are in place that protect the confidentiality of individual and community data, and the establishment of procedures for security, privacy and risk management, including the right to remove, veto and destroy data.

Access: Organisation policies and procedures and Data Agreements should incorporate best practice protocols for both collection and acquisition as well as access and use of ID in accordance with ID-SOV principles and ID-GOV obligations. They should also clearly identify owners of data, the decision-makers over data sets, the ongoing consent requirements, and restrictions on access and use of ID, sensitive and confidential information. Mechanisms should be implemented for access and use by individuals and community, digital data repatriation and ongoing community decision-making processes (Terri Janke and Company for VACCHO, Slide 7, June 2024).

How to develop agreements and contracts:

Agreements enable ID-SOV principles and best practice protocols to be embedded as legally binding obligations, and protect First Nations people’s rights, knowledge, and confidential and private information from disclosure and misuse, such as sacred, secret and private cultural knowledge or information. Indigenous Cultural and Intellectual Property (ICIP) clauses can also be added to identify First Nations people’s rights to their cultural knowledge and information, and ensure free, prior and informed consent for any use of the same.

Copyright clauses can be used to confirm the legal ownership of resources incorporating ID and cultural knowledge and information (ownership of which should be held by First Nations people in circumstances where they are sharing their knowledge), the terms of any licence for use from First Nations people, approval rights, commercialisation and publication obligations. (Terri Janke and Company for VACCHO, Slide 9, June 2024).

How to catalogue data:

Organisations, businesses and individuals should appropriately catalogue information around ICIP and ID records and materials. Cataloguing should include the person or group who provided the material, data or information, identifying who it belongs to, what consent has been received and the extent of that consent, who can use the data for what purpose, any relevant cultural protocols or restrictions that apply, and contact details for obtaining further consents, including Next of Kin information.

For example, Traditional Knowledge (TK) labels can be used to identify and record culturally significant or sensitive data, and the protocols or restrictions that apply on accessing and using the information. (Terri Janke and Company for VACCHO, Slide 10, June 2024).

How to use Indigenous data:

It is critical to ask who will be using the data, and for what purpose. Protocols and conditions must be applied for the original use and every new use of data by an organisation, any third parties, and re-interpretation or analysis of the data.

Important considerations for the use of ID include:

• Free, Prior and Informed Consent must be obtained for any collection, access or use.

• Self-determination must be promoted through Indigenous co-design, full participation and leadership in all aspects of the data collection, access and use.

• Agreements are in place that appropriately maintain the integrity of ownership of ID and attribute rights-holders. First Nations Peoples have the right to be acknowledged when ID is used, including their preferences to not be attributed.

• Meaningful benefits of collection and use of ID flow back to community and are in accordance with community wishes.

• Obligations are appropriately communicated and acknowledged. All third parties should sign binding agreements that detail their obligations regarding security, privacy and use of ID in line with IDSov principles. Individuals and organisations should regularly monitor and audit third-party compliance (Terri Janke and Company for VACCHO, Slide 11, June 2024).

(VACCHO’s Deadly Data® Lake data sharing process, Terri Janke and Company for VACCHO, Slide 15, June 2024).

Further information:

If you need any further information or assistance with the application and implementation of Indigenous Data Sovereignty principles and Indigenous Data Governance practices for your workplace, project or activity, advice can be sought from Terri Janke and Company:

Terri Janke and Company is an award-winning 100% Indigenous owned and run law firm led by Dr Terri Janke that empowers clients to achieve success in business and innovation.

Email: [email protected]

Website: www.terrijanke.com.au

References:

• Managing First Nations Data in Practice, Indigenous Data Sovereignty workshop and presentation slides prepared by Terri Janke and Company for VACCHO, June 2024.

• First Nations Information Governance Centre, 2016

• United Nations Declaration on the Rights on Indigenous Peoples (UNDRIP)

Additional Resources:

• Terri Janke and Company resources: https://www.terrijanke.com.au/idsov

• Miaim nayri Wingara ID-SOV Principles: https://www.maiamnayriwingara.org/mnw-principles

• Lowitja Discussion Paper (2024), Taking Control of Our Data: A Discussion Paper on Indigenous Data Governance for Aboriginal and Torres Strait Islander People and Communities‘: https://www.lowitja.org.au/wp-content/uploads/2024/01/Taking-Control-of-Our-Data-Discussion-Paper.pdf

• AIATSIS Discussion Panel (2019), Delivering Indigenous Data Sovereignty: https://aiatsis.gov.au/publication/116530

• Yoorrook Justice Commission Information Sheet (2022), Indigenous Data Sovereignty and Data Governance: https://yoorrookjusticecommission.org.au/wp-content/uploads/2022/04/041922_Yoorrook_DataSovereigntyGuidance.pdf