2.1. Theoretical overview

Global governance reflects the need to establish authority across national borders to handle common goods or transnational problems. Due to the nature of this relationship, the first step is always communication between nation-states that agree on such common goods or transnational problems (Zürn, Reference Zürn2018b). This agreement is reliant on the establishment of normative principles, which includes consensus on the common good, available authorities that are accountable at the nation-state level, and a belief that international or global authority is plausible (Jang et al., Reference Jang, McSparren and Rashchupkina2016; Zürn, Reference Zürn2018a). Theoretical issues in global governance revolve around authority, legitimacy, and conflict (Weiss, Reference Weiss2000; Zürn, Reference Zürn2018b). Authority relies on institutions for enforcement and legitimacy of these actions; international bodies generally do not have directly elected representatives, which threatens the legitimacy of any enforcement action undertaken. In addition, authority is not strict within a global framework. Due to issues of legitimacy, it is best viewed as being fluid. Fluidity refers to the interplay between state and non-state actors and the nature of cooperative agreements. However, fluid authority is not a common framework for national governance and so it leads to conflict (Krisch, Reference Krisch2017). Conflict naturally arises between actors that make unilateral decisions in their own context and then must compromise on the international stage. Global governance is not restricted to representatives of nation-states either. Non-state actors, such as corporations and agencies directly involved with a common good, can be included within these frameworks. For example, credit rating agencies are a core actor in terms of financial governance and regulation (Jang et al., Reference Jang, McSparren and Rashchupkina2016; Wang, Reference Wang2017; Zürn, Reference Zürn2018b). While non-state actors can provide expertise and solutions beyond the capacity of individual states, this further raises issues of legitimacy, especially in terms of co-option by special interests. This is one of the enduring challenges of self-regulation by industry.

While common problems in global governance involve conflict, coordination, and cooperation, power structures and inequities in power can ultimately be destructive to international bodies or global agreements. The early days of global governance saw international bodies consisting of mostly Western powers. As emerging powers, such as Brazil, Russia, India, and China, entered the space, areas and avenues for conflict increased without any mechanism for increased cooperation (Barnett and Duvall, Reference Barnett and Duvall2004; Jang et al., Reference Jang, McSparren and Rashchupkina2016; Stephen, Reference Stephen2017). As these emerging powers enter international agreements, segmentation and fragmentation occur. The introduction of new actors may create instability in the global order, but this can also be an opportunity to innovate and determine new norms (Jang et al., Reference Jang, McSparren and Rashchupkina2016; Wang, Reference Wang2017). Finally, ineffective incorporation of emerging actors creates power imbalances and ultimately abuse by more powerful states. Mechanisms for correcting these power distortions and determining mutually acceptable norms are necessary for successful global governance.

Attempts to address the multiple complex issues that arise in global governance have led to several frameworks being developed. To the extent that this paper aims to provide a brief review of frameworks in global governance. A “framework,” for our purposes, takes a set of variables and their presumable relationships together in a conceptual way. Then, this conceptual framework can be further specified toward a “theory” (Ostrom, Reference Ostrom2007; Sabatier and Weible, Reference Sabatier and Weible2007). A theory provides more dense and coherent relationships among variables; yet, the relationships themselves are still susceptible to values of variables, which are yet fully specified. Then, a “model” is much narrower in scope and more precise in its assumptions. In particular, “the framework can provide anything from a modest set of variables to something as extensive as a paradigm” (Sabatier and Weible, Reference Sabatier and Weible2007), and this can be inevitable, realistically required, and crucial in dealing with, especially, challenging complex issues. Hence, we can first aim to better understand existing frameworks and develop them further by examining current cases for the progress and challenges they illustrate in global data governance. This brief overview can be a significant step moving forward to develop further specified theories and models facing the phenomena.

2.2. Frameworks in global governance

Global governance theory utilizes frameworks that leverage indistinct institutional hierarchies and normative principles to the advantage of the task at hand, whether that be sustainable development, regulating gene editing, or cyberwarfare. This paper will focus on three frameworks that offer potential in terms of global data governance. The frameworks are (a) governance through goals, (b) governance from the ground up, and (c) governance by fragmentation.

Governance through goals is presented as a novel approach that was used by the United Nations in developing and implementing their Sustainable Development Goals. The framework differs from traditional global governance approaches by its detachment from the international legal system, its flexibility in terms of adaptation to local needs, and general “weak” power structures (Biermann et al., Reference Biermann, Kanie and Kim2017). The goal-making process aimed to be inclusive of the needs of each nation to better ensure compliance since these goals are non-binding (Murphy and Yates, Reference Murphy and Yates2009; Biermann et al., Reference Biermann, Kanie and Kim2017). The success of such an arrangement relies on compliance and formalizing of these goals by each member state, but the flexibility provided increases the probability of integration of global goals into a national context. The ability to adapt to local needs and be flexible in terms of enforcement mechanisms may ultimately lead to slow progress, but it also achieves buy-in from a larger number of members (Thakur and Van Langenhove, Reference Thakur and Van Langenhove2006). A “governance through goals” approach relies heavily on non-state actors, such as research communities, to determine measurements for progress and whether progress is in fact being made (Biermann et al., Reference Biermann, Kanie and Kim2017). Ultimately, the success of governance through goals relies on inclusivity in process and compliance by individual nation-states.

Governance from the ground up focuses on the needs and strategies of local actors and communities and generates an adaptable global governance framework based on those local needs. A bottom-up approach is common across multiple fields, including policy implementation, where the theoretical emphasis lies with target groups or local-level actors rather than actors at the national-level or policy designers (Hjern and Porter, Reference Hjern and Porter1981; Matland, Reference Matland1995; Koontz and Newig, Reference Koontz and Newig2014; Meter and Horn, Reference Meter and Horn2016). In terms of global governance, a bottom-up approach has been recommended in the case of gene-editing because local-level actors often have the requisite expertise and can provide a more diverse perspective. There is also the belief that local actors will be free of the conflicts of national policy that can hamper top-down efforts in collaborative decision-making (Kofler et al., Reference Kofler, Collins, Kuzma, Marris, Esvelt, Nelson, Newhouse, Rothschild, Vigliotti, Semenov, Jacobsen, Dahlman, Prince, Caccone, Brown and Schmitz2018). This type of approach does assume weak institutional arrangements since national-level frameworks are being avoided in favor of local knowledge and adaptability. The intent of this framework for global governance is to gain buy-in from the actors that will have to implement any policies or regulations decided upon, so the lack of enforcement mechanisms is viewed as less problematic.

Finally, governance by fragmentation acknowledges that governance and governing activities can begin from a patchwork of international institutions and regulations rather than a formalized order (Biermann et al., Reference Biermann, Pattberg, Van Asselt and Zelli2009). The fragmentation framework is based on the idea of global governance as an architecture, which refers to the overall system of public and private institutions, norms, regulations, decision-making apparatus, and organizations that are working on a particular global governance issue (Biermann et al., Reference Biermann, Pattberg, Van Asselt and Zelli2009). Fragmented global governance is not devoid of an architecture in which to govern, but instead, the focus has been less on institutions and centralized control and more on fluid and organically established norms formed not just by state and intergovernmental organizations, but by civil society and non-state actors. The strengths of fragmentation can be seen in the arenas of cyberweapons and cyberwarfare, where the environment is complex, involves many non-state actors with greater technical expertise, and enters into power politics and international relations (Stevens, Reference Stevens2017). One area of fragmentation is existing norms in certain nation-states and the desire in global governance to converge institutions and norms rather than reducing conflict between differing strategies. This can be viewed as a strength and an opportunity for innovative solutions in a space, such as data governance, where strategies currently exist but may not converge.

All these frameworks attempt to wrestle with the international context of weak institutions and weak enforcement mechanisms. This lack of institutional strength may limit the ability to establish norms as well as accountability structures. New global data governance frameworks should address this weakness by establishing norms of enforcement that are mutually agreeable across the globe. Existing regional, national, and inter-country agreements should be harnessed in developing such mechanisms.

2.3. Data governance

With the rapid development of technology, data governance becomes one of the most salient issues for good governance. Data governance emphasizes assigning authorities and building stewards to control and regulate data-related activities, such as data collection, processing, protection, and uses (Janssen et al., Reference Janssen, Brous, Estevez, Barbosa and Janowski2020). There are many potential actors in data governance, including governments, markets, and civil society. These participants have various interests and preferences to construct different data cultures and infrastructures (Meijer, Reference Meijer2018). Regulations, cultures, policies, principles, and procedures mutually interact with social contexts, expectations, and norms to present diversified natures of data governance in different communities (Meijer, Reference Meijer2018; Janssen et al., Reference Janssen, Brous, Estevez, Barbosa and Janowski2020). Moreover, public values, such as transparency, accountability, and fairness, are often inherent goals for decision-making in the field of data governance (Chen, Reference Chen2017). To pursue these goals, data governance mechanisms need to include potential actors, data processes, and public values in the consideration.

Clarifying the dimensions of data governance, Khatri and Brown point out five key data decision domains, such as data principles, data quality, metadata, data access, and data life cycle, which are useful references for global data governance. We highlight two domains on which global data governance should focus. These are data principles that determine how data can be used, reused, shared, and transferred, and data life cycle which refers to data inventory, retention, and retirement (Khatri and Brown, Reference Khatri and Brown2010).

First, data principles require governments to establish a concise and effective mechanism to regulate data use, sharing, and exchange (Khatri and Brown, Reference Khatri and Brown2010). The rules shape actors’ behaviors and further construct the interaction among participants in data governance. Specifically, data principles motivate actors to have various considerations in controlling and planning, risk assessing, data auditing, and monitoring (Janssen et al., Reference Janssen, Brous, Estevez, Barbosa and Janowski2020).

Second, the data life cycle provides another approach to analyze data governance. One of the issues in data governance is how organizations, including governments, private companies, and third parties, collect personal data. In recent years, as artificial intelligence (AI) and other advanced technologies have become more widely adopted, it is easy to collect personal data but becomes harder to protect the information compared to traditional approaches (Hansen and Porter, Reference Hansen and Porter2017).

Furthermore, one of the goals of data governance is to build a trustworthy mechanism to use and protect personal data (Khatri and Brown, Reference Khatri and Brown2010; Janssen et al., Reference Janssen, Brous, Estevez, Barbosa and Janowski2020; Verhulst, Reference Verhulst2021). As citizens and customers understand the purposes of data use, the mechanism of data processing, and the life cycle of their personal information, they can have higher levels of trust in sharing data with governments or private entities (Stalla-Bourdillon et al., Reference Stalla-Bourdillon, Thuermer, Walker, Carmichael and Simperl2020; Reference Stalla-Bourdillon, Carmichael and Wintour2021). In other words, transparency in data use and processing is pivotal to enhancing trust in data sharing. Furthermore, accountability and responsibility are two essential components of trustworthy data protection regulations (Khatri and Brown, Reference Khatri and Brown2010; Verhulst, Reference Verhulst2021).

Although the existing body of knowledge provides data principles, data life cycle, and trustworthy mechanisms within domestic data governance, the larger world lacks the authority to build data principles and regulate data life cycle in fact. Countries have their individual data protection regulations, and thus different general data principles are developed. In other words, data regulation and protection depend on the legal regime within individual countries rather than across them.

3.1. The European approach

The GDPR addresses the issue of data privacy for the online activity of EU citizens. It was developed and implemented on April 14, 2016, after decades of discourse on improving existing standards (mainly the “95 Directive”) and practices for protecting the personal data of Europeans. Lawmakers incorporated strict enforcement mechanisms to incentivize compliance. The GDPR mandates that entities processing data must comply with seven principles: (a) lawfulness, fairness, and transparency; (b) purpose limitation; (c) data minimization; (d) accuracy; (e) storage limitation; (f) integrity and confidentiality; and (g) accountability (European Parliament and Council of European Union, 2016). Each of these principles provides guidance as to the scope, scale, and type of data that can be processed in certain instances. These requirements also place standards on data processors detailing the level of security that must come with harvesting data. The GDPR requires “appropriate technical and organizational measures” to ensure that data are secure, and that can range from the implementation of dual-factor authentication to end-to-end data encryption techniques (European Parliament and Council of European Union, 2016). The primary objective of this legislation is to govern the ways in which personal data are collected, managed, and erased (European Parliament and Council of European Union, 2016). The EU sought to achieve this goal by developing the GDPR in a way that harmonizes data protection laws across European nations, regulates the transfer of Europeans’ personal data outside of Europe, and ultimately gives Europeans greater authority over how their personal data are managed (Houser and Voss, Reference Houser and Voss2018). The GDPR is more powerful than its predecessor (95 Directive) because of its stronger enforcement mechanisms (Houser and Voss, Reference Houser and Voss2018).

There are several new protections in the GDPR that were absent from the 95 Directive. One of the most famous protections in the GDPR is the “right to be forgotten.” The right to be forgotten or the “right of erasure” allows Internet users to request entities that have collected their data, to delete their data. This issue of whether or not personal data should be harvested by companies gained salience after a 2014 European Court of Justice ruling from a lawsuit between the Internet conglomerate, Google, and the nation of Spain in which the court declared that “European citizens have a right to request that commercial search firms, such as Google, that gather personal information for profit should remove links to private information when asked, provided the information is no longer relevant” (Ilešič, Reference Ilešič2014). Another critical protection added to the GDPR is that data processors are legally liable for managing user personal data, while the 95 Directive only held controllers liable. This means if someone were to request their personal data be removed by a controller, then the controller would have to ensure any possible third-party data processors must erase the user’s data as well. Other protections include the ability to transfer data between controllers at no cost to the user, the best practice of European companies appointing a Data Protection Officer to manage client data, and the right of users to inquire about how their data are being utilized by data controllers and processors when an “automated decision” is made regarding their data (Houser and Voss, Reference Houser and Voss2018).

One notable departure from the 95 Directive to the GDPR was an increase in the strength of enforcement mechanisms attached to the regulation. The enforcement of the GDPR still relies on individual member states, through their Data Protection Authority (DPA), to coordinate with the European Commission, the newly established European Data Protection Board (EDPB), and other member states. However, now DPAs have much broader powers to investigate and levy heavier fines against companies found to be in violation of the GDPR. DPAs monitor the ability of citizens to exercise their rights under the regulation and evaluate whether the control and processing of personal data by companies are in compliance with the regulation (Tolsma, Reference Tolsma2020). Using guidance from the EDPB, DPAs handle cases of suspected violations, assess these claims, and ultimately determine the appropriate penalty. Despite additional guidance being provided, the administering of fines is still largely fragmented by country and each DPA’s approach to determining the severity of the violation. Member state laws also play a role in the fragmentation of fines as each country has the ability to set stricter rules than the GDPR (European Commission, 2020).

Although the GDPR intended to increase the strength of enforcement and drive changes in the practices and procedures related to the use of EU citizen data, the lessons learned since 2018 highlight continuing challenges with regulation and compliance, in particular, the GDPR’s consistency mechanism, which requires that the supervisory authority in the Member State that a company has indicated as its main establishment must take the lead. Major companies, such as Facebook, Twitter, Apple, and Google, have stated their main establishment to be in Ireland, which has created a significant backlog of cases for Ireland’s Data Protection Commission. Other DPAs have complained about this backlog as well as the consistency mechanism, claiming it leads to delays and communication breakdowns (Heine, Reference Heine2021). Outside of issues with utilizing the enforcement procedures under the GDPR, research has shown that when fines are levied, they tend to be often small, many within the thresholds of laws set prior to the GDPR (Wolff and Atallah, Reference Wolff and Atallah2021). In addition, only half of the articles that allow for penalties under the GDPR have been utilized with the majority of these relating to privacy protections (Wolff and Atallah, Reference Wolff and Atallah2021; Ruohonen and Hjerppe, Reference Ruohonen and Hjerppe2022). While privacy protections have led to the greatest number of fines, the largest fines have been levied against security violations (Wolff and Atallah, Reference Wolff and Atallah2021). Evidence from the first few years of GDPR enforcement shows signs of gradual improvements in terms of company security practices as well as protecting privacy for individuals (Heine, Reference Heine2021). However, any global framework should take into account the problems of regional consistency and the need for resources to effectively regulate such a law.

3.2. The U.S. approach

The current data privacy protections in the United States are based on a patchwork of laws and regulations across multiple levels of government. Federal law offers protection for certain data and protected classes, and then states often have their own data protection and/or privacy legislation. For example, the Health Insurance Portability and Accountability Act provides protection for medical information, and the Children’s Online Privacy Protection Act protects the data of those under the age of 13 (FTC, 2013; Houser and Voss, Reference Houser and Voss2018; O’Connor, Reference O’Connor2018; OCR, 2020). In addition, the Family Educational Rights and Privacy Act protects certain student records. Ultimately, the Federal Trade Commission (FTC) is responsible for the enforcement of laws and regulations regarding data privacy and security. The FTC has the power to prohibit “unfair and deceptive trade practices” under Section 5 of the FTC Act (O’Connor, Reference O’Connor2018). Attempts have been made in recent years to address the expansion of the digital world and provide consumers with more information about the data being collected as well as protections for their privacy. At the federal level, these efforts have largely involved research through commissions and studies. However, the White House did develop the Consumer Privacy Bill of Rights in 2010 that would have expanded the FTC and state attorney general’s authority as well as consumer rights. Initial state efforts started with data breach notification laws and have recently expanded, following the introduction of the GDPR, to address the multitude of concerns related to data collection and control (NCSL, 2020).

3.3. The California Consumer Privacy Act and other state efforts

While the U.S. Congress has yet to pass legislation concerning data privacy and protection, California became the first state to adopt a law comparable to the GDPR in 2018. The CCPA provides several protections for the personal information of Californians. The CCPA affords Californians the right to know if their personal information is being collected as well as the right to access that personal data (California Office of the Attorney General, 2020). It also grants Californians the right to delete data collected from their activity and the ability to opt out of the sale of their data (Camhi and Lyon, Reference Camhi and Lyon2018; California Office of the Attorney General, 2020). The CCPA is comparable to the GDPR as it exerts its authority on businesses and data processors based, and operating, outside of California. This has serious implications for companies operating around the United States because while California is only one of 50 states, its population of 45 million people accounts for a significant portion of the overall U.S. population, and it has the fifth largest economy on earth (Federal Reserve Bank of St. Louis, n.d.). California’s position in the global economy means companies and nations far beyond the state’s political borders will face pressure to comply with CCPA regulations.

Several other U.S. states have taken efforts to address data privacy since California passed the CCPA in 2018. Maine and Nevada each enacted data privacy bills into law. The privacy law passed in Maine allows consumers to restrict the types of information companies can collect from their online activity, allows consumers to opt out of their personal information being sold to third parties without their consent, requires companies to explain certain data handling practices to consumers, and prohibits discrimination against consumers that exercise their rights (Rippy, Reference Rippy2020). Nevada’s data privacy bill is similar to Maine’s in that it provides consumers the right to opt out of their data being sold without their consent, and it requires companies to be transparent about data handling policies (Rippy, Reference Rippy2020). As of this writing, California is the only state in the United States that has adopted a “right to be forgotten” policy like that of the EU’s GDPR. Other states have introduced bills that have been rejected or are currently going through the legislative process. Some of these proposed pieces of legislation are similar to the laws passed in Maine and Nevada, with many adopting different policies and protections that include limiting the ability of companies to collect consumer data beyond particular instances, rights for consumers to request outdated or incorrect data be deleted or rectified, and much more (Rippy, Reference Rippy2020).

3.4. Additional approaches across the globe

In 2019, India introduced the Personal Data Protection Bill (PDPB) to address consumer data protection issues. This came after the Supreme Court of India ruled in 2017 that India’s constitution gave its citizens the right to privacy, leading Indian policymakers to address issues of data protection. The PDPB would give consumers the right to opt out of their data being sold and analyzed by third parties without their consent. The bill also mandates that personal and critical data must be stored within India. Firms must also create platforms that allow consumers to access and erase their data (Burman and Rai, Reference Burman and Rai2020). PDPB enforcement mechanisms are weaker than the GDPR, as fines for the infringement of data protection are limited to roughly US$2.1 million versus the potential billions of dollars in fines the GDPR allows. A unique characteristic of PDPB is that government entities in India are exempt (Burman and Rai, Reference Burman and Rai2020). As of this writing, India’s PDPB has been tabled from further movement in the legislature until it has been studied further by a national commission.

Japan’s Act on Protection of Personal Information (APPI) legally protects the personal information of citizens, and this has recently expanded to better protect data privacy online. This expansion was partially to comply with the EU and enable data transfer between the Union and Japan. In 2017, Japan’s reformed privacy law came into force; the update applied the law to both foreign and domestic countries that processed the data of Japanese citizens (Simmons, Reference Simmons2019). The update aligned the law with the GDPR and led to the establishment of a cooperative agreement between the EU and Japan in terms of data transfer as well as establishing each entity as having adequate levels of personal data protection. The APPI applies specifically to businesses that collect personal information and requires that they specify the purpose of obtaining such information, prevent the unauthorized loss, disclosure, or destruction of personal data, as well as limit the transfer of data to third parties unless the subject consents (Umeda, Reference Umeda2012). Governmental organizations do not have to comply with the law, in a similar manner to India, but other laws regulate governmental use of personal data (Cooman, Reference Cooman2019). Japan also has previously established rights to privacy through legal decisions, and these overlap with the APPI to provide broader rights to privacy that are not limited to the digital world (Umeda, Reference Umeda2017).

The Taiwanese government enacted the Personal Data Protection Act (PDPA) to enhance privacy and individual information security. The government requires the public sector, private companies, and nonprofit organizations to collect and process data following the regulations of the PDPA. Compared to the GDPR, most data protection principles are like the European approach. However, the government has a decentralized management system to monitor all activities related to data protection. Unlike the GDPR, the central government authority and local governments can protect personal data and fine violators. Furthermore, the government allows entities to transfer data to other countries (Ministry of Justice, 2020). In addition, to enforce Transitional Justice, the government can disclose certain personal information without the limitation of the PDPA. Transitional justice refers to the period from 1945 to 1989, when the Taiwanese people lived under a dictatorship. To explore historical truth and recover victims’ rights related to these injustices, the current government can collect, transfer, utilize, research, and publish information on these events, including names and individual behaviors. It is the most notable difference in data protection law compared with other democratic countries.

In China, the government has a number of laws and rules related to personal data protection (Feng, Reference Feng2019). In 2013, the Ministry of Industry and Information Technology announced Regulations for the Protection of Personal Information of Telecommunications and Internet Users and required all companies to follow this rule. This regulation ensured that personal data could not be used without the consent of the user or for uses beyond the scope of the original agreement. In 2016, the National People’s Congress Standing Committee, the highest legislative institute in China, enacted the Cybersecurity Law (CSL) to increase the protection level of personal data and strengthen the central government’s power to monitor the Internet. This included a provision similar to the right to be forgotten as it allows an individual to request their data to be deleted if the collector of said data violated the law or the established agreement (Creemers et al., Reference Creemers, Triolo and Webster2018). In addition, the CSL emphasizes transparency of data collection and processing by companies and provides individual rights to correct their data as well as the right to object to processing. The Information Security Technology—Personal Information Security Specification updated by the Standardization Administration of China in March 2020 provides further clarification for business operators in terms of the CSL. While not a law or regulation like the CSL, the security specifications provide guidance for businesses and a standard for the government to assess companies against (Seamons, Reference Seamons2020).

On November 1, 2021, the Personal Information Protection Law went into effect. This establishes the ability to collect data without consent in national emergencies, such as public health crises, so long as other laws permit such collection. The draft also provides web users with the ability to withdraw their information from the collectors. The government can warn and fine violators up to roughly US$7.6 million or 5% of annual revenue (Creemers et al., Reference Creemers, Shi, Dudley and Webster2020). Many elements are still to be defined (Cooley, 2021). It should be noted that both the Data Privacy Law and the Personal Information Protection refer to businesses and individuals operating within China, not the Chinese government. Data privacy laws and protections that apply to companies and not government raise greater concerns for citizens. The smart city project in China that has largely been promoted by the national, centralized government collects a vast array of data on a daily basis (Yang and Xu, Reference Yang and Xu2018). In addition to the fact, new data privacy protections do not prohibit government access to those data. The potential surveillance implications of such a model cannot be ignored. The current status of data privacy and personal information protection laws versus the centralized control over data by the government in China raises further challenges to developing a global data protection framework (Wu et al., Reference Wu, Lau, Atkin and Lin2011).

The diversity in legislation from different nations aimed at addressing data governance issues suggests that there are many ways of tackling this issue. Nations do not have the same privacy laws, values, or standards, and some of these differences pose challenges to the development of a global data governance agreement.