Overview
In the age of digital transformation, data is one of the most valuable assets in healthcare, education, technology, and development. However, as data becomes more integral to Neftaly’s operations and innovations, questions around data ownership—who controls, accesses, and benefits from data—have become increasingly critical.
Neftaly is committed to managing data ownership issues with transparency, integrity, and respect for individual rights, community interests, and regulatory requirements.
What Is Data Ownership?
Data ownership refers to the legal and ethical rights and responsibilities associated with data—including its creation, control, access, use, sharing, and deletion.
Key stakeholders in data ownership include:
- Individuals (e.g. patients, learners, clients) who generate or are the subject of the data
- Organizations (like Neftaly) that collect, manage, or analyze the data
- Third-party partners or vendors who may process or store the data
Understanding and clearly defining ownership is essential for ensuring privacy, compliance, accountability, and trust.
Neftaly’s Guiding Principles on Data Ownership
1. Individual-Centered Ownership
- Individuals retain primary rights over their personal data.
- Neftaly considers individuals as data stewards, not just subjects.
- Consent, transparency, and control are foundational to all data interactions.
2. Purpose-Driven Data Use
- Data is used only for the purpose for which it was collected, unless further consent is obtained.
- All secondary use of data (e.g. for research, development, or innovation) requires clear governance and ethical review.
3. Shared Value, Shared Responsibility
- When data is co-produced—such as through partnerships, collaborative platforms, or digital services—Neftaly ensures shared ownership models are in place.
- We recognize the rights of communities, institutions, and partners in jointly generated data.
4. Legal Compliance and Risk Management
- Neftaly complies with national and international data protection laws (e.g., POPIA, GDPR, HIPAA, Kenya Data Protection Act).
- We proactively address jurisdictional differences in data ownership, especially in cross-border contexts.
- Legal agreements clarify data control, access rights, intellectual property, and dispute resolution.
Operationalizing Data Ownership at Neftaly
1. Data Governance Policies
- Maintain up-to-date internal policies on data ownership, access, sharing, and lifecycle management.
- Define clear roles and responsibilities across departments (e.g. Data Owners, Data Stewards, IT, Compliance).
2. Informed Consent and User Agreements
- Obtain clear and informed consent for data collection and use.
- Provide easy-to-read user agreements that explain ownership, rights, and limitations.
- Allow users to request access to, correction of, or deletion of their data where applicable.
3. Transparent Data Sharing Practices
- Use Data Sharing Agreements (DSAs) and Memoranda of Understanding (MOUs) when sharing data with third parties.
- Include terms related to ownership, licensing, liability, and breach response.
4. Ethical Use of Data
- Apply ethical review for projects involving personal or sensitive data.
- Ensure community consultation and benefit sharing in data-intensive projects (e.g. public health, community surveys).
- Avoid extractive practices that use data without fair return or impact on the source communities.
5. Security and Access Control
- Use role-based access to ensure only authorized users can view or modify data.
- Implement strong encryption, audit trails, and data retention policies to protect ownership rights.
Special Considerations
1. Artificial Intelligence and Machine Learning
- Ensure training data used in AI systems is ethically sourced and ownership is acknowledged.
- Address issues of derived data and ownership of algorithmic outputs.
2. Public vs. Private Data
- Clearly differentiate between public domain, open data, and proprietary or confidential data.
- Implement licensing or attribution where appropriate.
3. Employee and Contractor Data
- Clearly communicate data ownership terms in employment and vendor agreements.
- Respect privacy and IP rights while ensuring Neftaly’s legitimate business interests.
Case Example: Community Health Data Platform
Neftaly implemented a digital health platform in partnership with local clinics and communities. Key ownership practices included:
- Joint governance board with local stakeholders
- Community ownership of anonymized health insights
- Shared licensing of platform-generated data for research and service planning
- Transparent opt-in consent from all users
This approach built trust, enhanced data quality, and enabled long-term sustainability of the initiative.
Conclusion
Managing data ownership is about more than legal control—it’s about ethics, equity, and empowerment. Neftaly is committed to handling data in ways that honor the rights of individuals and communities, promote responsible innovation, and comply with all applicable laws.
By establishing clear data ownership practices, we strengthen trust, reduce risk, and create shared value from the data we steward.