6.4. Governance Building Blocks

Personal Data Intermediary #

· It allows them to manage consents and authorisations, be informed on the usage of their data, the value, and risks of sharing it.

· It can be integrated into the interfaces of the participants and individual end users can also access it through a central interface.

· It represents the individual in the data space and can have the authority, granted by the individual to exercise its rights on its data.

· It is composed itself of several building blocks to enable its functionalities such as: consent management, identity management.

PDI Consent Building block #

· People can manage their consent from the services concerned in the data exchange or from their Personal Data Intermediary where they can find and manage all their consents from a single place.

· The consent is generated from a data sharing agreement existing between the parties sharing the data; the consent triggers the real data exchange or access.

PDI Identity Building Block #

PDI Decentralised AI Training #

· The users give or revoke the right to mobilize their data, wherever it is stored, to train AI models.

· A decentralized federated learning protocol allows to train AI models without disclosing users’ contributions. Whereas today, the training of AI imposes the need to provide the data in clear to a central actor. Individuals no longer have to arbitrate between altruism and confidentiality. Since data is no longer shared, AI researchers can focus on their core business because they no longer have to spend time on compliance for data access.

· By mobilizing data at its source, decentralized learning increases the relevance of AIs by allowing them to train on more transversal, sensitive and up-to-date data, from multiple sources: data is no longer shared to benefit from the service.

· AI and/or language models for Personal Data intermediaries can be developed in many ways. There are many scientifically, legally and ethically valid methods to train AI / language models with personal data that can be used in Data Spaces context. Such AIs should follow PDI Trustworthy Algorithm guidelines as well as guidelines described for AI Building Blocks in the section 7.3.2

PDI Distributed Data Visualisation #

· The data model that is built/constructed/manipulated in the service layer (data storages, APIs, AIs, service providers, etc) and/or in the edge and finally passed to the UI/visualization component in client side.

· Visualization component that can be embedded into any application like Google Ad -plugin component can be embedded into any web page or app. This Google Ad -type of approach is meant to ensure the UI & visualization mechanism is embeddable to any part of the data space.

PDI Catalogue #

· Allowing people to easily navigate and find the apps, data users and data sources of their personal data space and be matched with the most relevant applications according to their needs and preferences.

· Allowing people to be informed on the risks and value of sharing their personal data with the data space participants.

PDI Trustworthy AI Assessment #

· Explainability: Provide transparency in the consequential decision-making process, explaining how the AI system arrived at a particular decision. This helps people understand why a particular decision was made and provides clarity and assurance in the decision-making process.

Rulebook and Rolebook #

· A Rulebook contains rules coming from: hard law, soft law, and the ecosystem internal decision-making.

· All bodies involved in the definition or application of rules, at all levels including outside the ecosystem, are part of the Rolebook.

· Rules within the Rulebook can refer to or apply to bodies and roles defined in the Rolebook.

· The Rolebook is an open, transparent, and dynamic registry of functions (roles) and decision-making entities (bodies) for data sharing.

· PDI, which are part of the Rolebook, allow individuals to participate in the governance of the different ecosystems handling their data sharing use cases.

Contractual Framework #

· Collect all core aspects of a use case implementation in written form, establish valid legal commitments for data sharing and promote standardized ways of operation.

· Bind the data consumer to data producer to a written agreement defining who can access what of how the data is to be used.

· Minimize transaction costs.

· Ensure fair, transparent, and compliant agreements in data spaces.

· Support interoperability.

· Dynamic links to the regulatory framework & regulatory changes to allow compliance with upcoming rules.

· Proposes a set of clauses for use case implementation with European wide applicability.

· General code of conduct to ensure the data space participants follow similar values and principles.

· Policy enforcement.

· Protect individual rights.

· Specify access rights.

· Specify usage patterns/outcomes.