1 Introduction

To keep abreast of global geopolitical competitors, especially the United States and China, since 2014, the European Union has launched a digital strategy, whose pillars are the centrality of citizens alongside the balancing of economic growth, social inclusion, digital sovereignty, and environmental sustainability (von der Leyen 2020). This article aims to explore if/how the EU is concretely pursuing such a multi-facetted citizen-centric approach. To do so, we conduct a critical review of latest policy-orienting documents and pieces of legislation published by the EU as part of its digital strategy. Following up on Grant and Booth (2009), a critical review is regarded as a method that delivers “analysis and conceptual innovation” for future informed research and practice. Hence, the present critical review does not aim to be exhaustive in scope, but rather identifies (discursive) patterns which then establish, de facto, the way to follow when it comes to governing the digital transformation within the EU. In this we align to van Lente’s (2000) idea that “technological futures are forceful”, meaning that discourses about technological innovation contribute to prescribe how new technologies shall be developed, implemented, and used, thus having (dis)enabling effects on the kinds of governance enacted.

Recent documents (European Commission 2020b; 2021; 2022a; c; d) have laid the ground for the establishment of an EU digital single market (DSM), as the arena where the digital strategy will play out. Yet, how to properly design such arena, making sure that it strikes a balance among all its pillars, is still an open issue. What is envisioned especially in latest EU’s documents is a data federation, as a tech-based infrastructure and business model, in which to be pivotal are private actors, the creation of economic value, and the defense of individuals’ rights. From such standpoint, societal and collective-level pillars of a citizen-centric digital transformation—such as social inclusion, digital sovereignty, and environmental sustainability—might not get sufficient attention and be sidelined.

From here, we investigate how to make the EU’s digital strategy truly citizen-centric, i.e., balancing individual and collective dimensions of digital transformation, as well as economic and societal values. Our rationale, in this respect, is conceptual in nature, meaning that we seek to “link work across disciplines, provide multi-level insights, and broaden the scope of our thinking” (Gilson and Goldber 2015). Notably, we advance the need to integrate the DSM, and its underpinning model, with a commons-inspired governance. The commons represents a regime for managing resources—in this case data and data tech infrastructures—which is able to strike a balance between economic and social values, individual and collective dimensions, as well as top-down and bottom-up stances (Zygmuntowski et al. 2021; Calzati 2022). Hence, while the federated model can constitute the tech-legal-economic backbone of the emerging DSM, a commoning of data does represent a robust complement to enact a citizen-centric EU’s digital strategy.

The article is organized as follows: Sect. 2 outlines the EU’s citizen-centric vision on digital transformation; Sect. 3 retraces the roots of such vision, highlighting major limits; Sect. 4 unpacks the governance model the EU is actually pursuing to tackle digital transformation and how this conflicts with its declared citizen-centric vision; Sect. 5 discusses how the EU’s model might be adjusted by looking at literature on the commons; Sect. 6 designs a convergence between the EU’s model and data commoning; Sect. 7 indicates further research ahead.

2 The EU’s governance of digital transformation

Since 2014, the EU has taken steps to enact a citizen-centric vision on digital transformation, as part of a digital strategy that aims to keep the EU abreast of competitors (the US and China) while safeguarding fundamental rights and balancing economic competitiveness with social inclusiveness, digital sovereignty, and environmental sustainability (von der Leyen 2020). Among major regulations in this direction are the General Data Protection Regulation (European Parliament 2016), the Regulation on the Free Flow of Non-personal Data (European Parliament 2018), the Ethics Guidelines on Trustworthy AI (European Commission 2019a), and the Data Governance Act (European Commission 2020b).

Most recently, the Declaration on Digital Rights and Principles (DDRP) (European Commission 2022b) reasserts the pursuit of “a European way for the digital transition, putting people at the center and fostering innovative businesses.” Notably, the DDPR pins down six principles: (1) preserve people’s rights; (2) support solidarity and inclusion; (3) ensure freedom of choice; (4) foster democratic participation; (5) increase safety, security, and empowerment of individuals; (6) promote sustainability. Principle 1—“Preserve people’s rights”—relates to the Charter of Fundamental Rights (European Parliament 2012) which comprehensively details the human, political, social, and economic rights of European citizens, encapsulated in six chapters: “dignity”, “freedoms”, “equality”, “solidarity”, “citizens’ rights”, “justice”. While most of the 50 enlisted rights pertain to the single individual, including the right to maintain one’s own privacy, the “solidarity” chapter includes rights, such as “collective bargaining and action”, “social assistance”, and “environmental protection”, which manifest a collective-by-default outlook over what it means to be Europeans. The DDPR stretches farer than that, insofar as its six principles equally split between a half (1, 3, 5) focusing on the individual and the other half (2, 4, 6) pertaining to the society. This vision is reasserted in a recent document envisioning the design of a data space for smart communities (European Commission 2021) which shall “ensure inclusive citizen participation and be demand-led; both addressing cities’ and communities’ concrete needs as well as ensuring a citizen-oriented service design.” Such goal demands a synergy between top-down and bottom-up stances able to finetune technical affordances with real societal needs. For instance, in the Policy and Investment Recommendations for Trustworthy AI (European Commission 2019b), the EU: “encourage[s] Member States to increase digital literacy” and it reasserts how “important ethical questions should be approached with the help of a wide consultation of civil society.” Yet, the extent to which the EU’s digital strategy concretely manages to enact such propositions, by balancing individual and collective dimensions of digital transformation, as well as top-down and bottom-up stances, remains contentious.

To start exploring the facets of the issue at stake, it is worth referring to Draheim’s (2021) remark that “the data governance architecture links data assets (…) along two dimensions: the interoperability dimension and the provisioning dimension.” In the case of the EU, data as assets can be disentangled by referring to the open data directive (European Parliament 2003; 2013; 2019) as far as provision is concerned, while interoperability is addressed by the European Interoperability Framework (EIF) (European Commission 2017) and the proposed Europe Interoperable Act (IEA) (European Commission 2022e).

2.1 Open data

For almost 20 years now, the EU has identified the open access and (re)use of public sector information as key to boost transparency, fair competition, innovation, and data-driven economic value (European Commission 2020a). To be considered as open, data must be complete, accessible, machine processable, non-proprietary, permanent, license-free, and free of charge (Open Knowledge Foundation 2023).

First in 2003 and later, in an updated form, in 2013, the European Commission (2013) released a directive on the re-use of Public Sector Information (PSI). As its name suggests, the PSI directive targets public sector data to release them as open data, favoring their (re)use for both commercial and non-commercial purposes. Overall, the goal of the PSI directive was to strengthen the link between public and private sector and create economic value through the opening of public data. Subsequently, in 2019 the European Commission (2019a, b) proposed the Open Data directive, which enlarges the scope of the PSI directive to involve research data, data held by public undertakings (under certain rules) and identify priority sector data to be released as open data (e.g., geospatial, health, mobility).

Recently, the Data Governance Act (European Commission 2020b) and the proposed Data Act (European Commission 2022a) represent policy pillars to boost data sharing across different stakeholders. The Data Governance Act establishes (1) measures to facilitate the (re)use of sensitive public sector data; (2) mechanisms for citizens and businesses to make their data available; (3) cross-border and cross-sector data sharing. On the other hand, the Data Act specifies the actual rights on the (re)use of data generated by users, also identifying avenues for public sector bodies to access and use private sector data in exceptional circumstances (such as a public emergency). While these regulations signal an increasing drive towards the fostering of a data-inclusive ecosystem in terms of both actors involved and types of data pooled, limitations remain.

Aware that data supply alone does not lead to more (re)use, nor to the creation of public value per se, Welle Donker and van Loenen (2017) stress the need to finetune data with actual needs and users, matching demand and supply of data. On this point, Lupi and colleagues (2020) further note the need for “appropriate data” rather than simply open data, insofar as we witness an enduring “under-exploitation of open data”. To this, it must be added that open data initiatives have so far chiefly focused on the national and supranational levels, while much data reside at local level (Verhulst et al. 2020). This is also why scholars have called to action to mobilize authorities at various levels for not only making data sets available, but also engaging citizens and foster stakeholder communities around open data (Mergel et al. 2018). Hence, an overfocus on data supply and the economic value-only of open data show its limit when digital transformation is put in context, demanding tech-legal mechanisms and sociotechnical practices to harness its full potential.

2.2 Towards interoperability

According to the European Interoperability Framework (European Commission 2017), “interoperability is the ability of organisations [public administration] to share information and knowledge, through the business processes they support, by means of the exchange of data between their ICT systems.” The document also acknowledges that “the lack of interoperability is a major obstacle to progress on the digital single market.” In such statements it is possible to retrieve why interoperability is important and how it should be designed.

Notably, the EIF details a set of recommendations to favor interoperability between public administrations (A2A), between public administrations and businesses (A2B), and between public administrations and citizens. The document identifies 12 fundamental principles to guide interoperability: while the majority are tech-legal requirements, organizational recommendations and societal outlooks are also taken into account (e.g., “user-centricity”, “inclusion and accessibility”, “multilingualism”). The EIF, however, is an advisory document that stops at the threshold of implementation. As the EU acknowledges, recent evaluations have exposed serious limitations of this entirely voluntary cooperation approach. In fact, the current state of the art across as well as within countries is that of “fragmented ICT islands” which prevents effective interoperability.Footnote 1

Most recently, building on the EIF the EU proposed the Interoperable Europe Act (European Commission 2022e) as a way to enforce cross-border interoperability and public administrations’ cooperation. The IEA envisions an EU-scale framework to promote the secure exchange of data based on shared digital solutions—such as open-source software—to support trusted data flows. Notably, the document expects to achieve this by “remov[ing] legal, organisational, semantic and technical obstacles” (European Commission 2022e). While the IEA is still at the level of proposition—thus leaving open the question on how and when it will be implemented—it is worth noting that (1) the trustworthiness of the framework is considered as a direct consequence of technically secured data flows, overlooking the fact that trust in technology is a complex sociocultural construct, as a robust body of literature acknowledges (Bodó 2021; Botsman 2017); (2) the thriving of the digital transformation is considered within reach by removing hurdles, sidelining the need to also foster capacity and skills in the public sector, as well as in citizens, overcome those limitations already encountered by open data initiatives.

Concerning the technical hurdle, in 2019 the GAIA-X (BMWi 2020) project was launched by a nonprofit foundation with the goal to “support the development of a digital ecosystem in Europe, which will generate innovation and new data-driven services and applications [enabling] interoperability and portability of infrastructure, data and services.” The vision behind GAIA-X aligns with that of the EU to promote digital sovereignty by building an infrastructural backbone that is expected, among other priorities, to “enable a sovereign decision on data-based business models” and to promote “common models and rules for data monetization”, as well as “cross-industry cooperation to create federal, interoperable services” (BMWi 2020). It is not hard to detect behind such a project a tech-economic rationale that risks, once again, to leave societal and collective dimensions unaddressed. Most importantly, it is at EU political level that GAIA-X shows concerns. As Draheim (2021) writes, behind GAIA-X is a consortium “founded by 22 companies from Germany and France under the aegis of the German Federal Ministry for Economic Affairs and Energy.” Although GAIA-X is officially a nonprofit foundation, its governance architecture advances a private-led model endowed with the task to design a standard infrastructure from which not only French and German companies, but European companies at large, as well as all European states and citizens should benefit. This raises concerns about the way in which sovereignty can be actually guaranteed as a collective principle, since it gets dislocated to private actors and placed in the hands of only two countries, without dutiful consultation and orchestration. It is hardly surprising that the project has encountered various hindrances soon after its inception. A report by Politico (2021) states that “more than a dozen industry and government officials said the project was struggling to get off the ground amid infighting between corporate members, disagreement over its overall aims and a bloated bureaucratic structure that is delaying decisions.” This attests to the unavoidable political and societal entrenchment of any project supposedly (only) technological in nature and economic in orientation. It remains to see if and how the EU is willing to acknowledge such entrenchment and act consequentially. It is safe to say, however, that since its inception the EU’s data governance architecture has been centered around the boosting of economic value and the preservation of individuals and their rights as consumers (Valli Buttow and Weerts 2022). In this context, citizenship has by and large been coopted as a glamouring rather than a pivotal concept.

3 Unpacking the EU’s vision: the way ahead

To explore the extent to which the EU’s digital strategy can deliver a citizen-centric digital transformation, it is worth looking at most recent EU-published documents, focusing on three main axes: (1) values; (2) actors; (3) processes. While these three aspects are deeply intertwined, they will be addressed in their own respect for analytical purposes. Previous research has thoroughly investigated governance through, by, or with data (Latzer and Just 2020; Vydra and Klievink 2019; van der Voort et al. 2019), showing the interplay among different stakeholders and suggesting how to strike a balance for such interplay. Prior studies have also suggested that values ascribed to data-driven technologies are framed institutionally and normatively (Guenduez et al. 2020; Thornham and Gómez Cruz 2016): this means that the understanding of what data-driven technologies can do and how is collectively shared (Jasanoff and Kim 2015) and becomes “enforcing” when it comes to the development, implementation, and use of these technologies (van Lente 2000). In a way, then, how digital transformation as a process is governed depends (also) on how it is discursively framed and envisioned. This is why it is worth critically reviewing policy documents and pieces of legislations informing the EU’s digital strategy, as compasses that not only dictate but prescribe the shape of the emerging European governance of digital transformation.

3.1 Values

The 2021 Digital Europe Programme (European Commission 2021) is an open call by the European Commission looking for funding projects that will build up the preliminary conditions and enablers of the emerging DSM. Notably, the objective is “to deploy and operate an EU online marketplace for cloud and edge services.” To speak of “market” underpins since the outset the idea of data—the building blocks of digital services—as a commodity, which is a very contentious idea to begin with for at least two reasons. On the one hand, it considers by default data as something to be seized, owned, and exchanged under an economic and proprietary rationale. This vision, however, does not do justice to the unique nature of data as a hybrid—technical and informational—resource which comes into being under precise sociotechnical conditions. In this regard, it would be fairer to consider and tackle the managing of data as entangled processes. On the other hand, the idea of market smoothly turns subjects—either physical or legal—into consumers. This means that, since the outset, the rules meant to enable and/or constrain actions in the DSM regard subjects as economic players, marginalizing those civic and collective dimensions which can hardly be covered from an economic standpoint. This is also evident where the document calls for a robust governance to guarantee “supervision of transparency and fair rules of operation” framed in terms of “long-term (economic, i.e., revenue-driven) sustainability by a broad range of relevant stakeholders (cloud service providers, cloud users, regulators, the public sector and civil society)” (European Commission 2021). While the document does mention the importance to involve all relevant stakeholders—including civil society—the economic rationale represents the sole benchmark against which to assess the success of the DSM.

Beyond that, the same document defines in a footnote “data ecosystem”—another phrasing for DSM—as “a platform that combines data from numerous providers and builds value through the usage of processed data.” The equation of ecosystem with platform is also telling. Indeed, discussions on “platformization” (Cristofari and Helmond 2023) have widely unveiled the commodification of services and actors that such concept and vision put forth. In fact, as Cristofari and Helmond (2023) notes, while “the EU not only takes platformization as an inevitable phenomenon, but it allows it to thrive”, platformization re-enacts in the digital realm forms of private monopoly and abuse of market power. Not surprisingly, the 2021 Digital Europe Programme (European Commission 2021) further specifies that the “EU online marketplace will provide a brokerage for the transaction and delivery of cloud infrastructures and services offered to entities from the public sector. Over time, it should become a critical resource for supplying cloud-to-edge services to the public sector, services of general interest and, where applicable, the private sector.” Here it emerges more neatly the extent to which the enactment of an EU digital marketplace departs from a civic collective dimension to foreground an economic-driven and individual-centered approach which aligns more closely with the US corporate-driven vision. The DSM is de facto understood as a set of necessary-sufficient infrastructures in the form of a “vendor-neutral technical architecture and reference framework” with the goal to promote an “agile and future-proof revenue model to cement long-term commercial viability, while ensuring unbiased competition.” Although being regulated, the chiefly economic rationale at the basis of such architecture and framework might face similar societal limitations as the US approach, sidelining those collective-level principles that cannot be boiled down to individual rights or economic value. The digital transformation is a systemic condition that can no longer be reduced to cost and benefit transactions, which “inherently privilege individual values, needs, or requirements (…) ignoring many social norms and expectations” (Sanfilippo and Frischmann 2023). Overall, at stake is the need to design an arena that moves away from prioritizing certain values over others—oftentimes economic competitiveness over social inclusiveness or environmental sustainability—to rather pursue a systemically balanced ecosystem across all stakeholders. This leads to discuss the second point, notably the actors in play in the DSM.

3.2 Actors

To understand the emergent DSM as “a critical resource for supplying cloud-to-edge services to the public sector” (European Commission 2021) positions by default the public sector as a client of data and tech solutions developed and owned by third parties. The public sector is public, because it is bound to transparency as per its functioning and it is subjected to mechanisms of external accountability and audibility to guarantee that it operates in the general interest. To conceive of the public sector as a client within the DSM means to subordinate its role to third parties, notably companies. The Digital Europe Programme (European Commission 2021) speaks of “the importance of building a thriving ecosystem of private actors to generate economic and societal value from data, while preserving high privacy, security, safety and ethical standards.” This statement is significant for different reasons. First of all, it clearly places private actors at the centre of the market, endowed with the task of creating economic and societal value. On this point, Taylor (2021) warns against the notorious difficulty of “establishing meaningful accountability for the private sector” which hinders an effective public scrutiny of how tech companies operate, for which purposes, and with which results. The risk is to see the conflation between public value created by the public sector and public value created by businesses “despite the profit interests involved and the different regulatory architectures occupied by firms and government” (Taylor 2021). While it might occur that private companies do deliver public value, this can hardly occur on a systemic basis, that is, one that keeps into account collective-level tradeoffs beyond cost–benefit logic notoriously oblivious of interdependencies and externalities.

Second, the passage above entrenches economic and societal values with principles, such as privacy, security and safety that maintain an individual outlook. While, as seen, the Charter of Fundamental Rights constitutes the polar star of the EU when it comes to govern digital transformation, recent studies have shown that a human right-based only approach cannot be exhaustive (Taylor et al. 2017; Smuha 2021; Viljoen 2021). For instance, Taylor and colleagues (2017) discuss the idea of “group privacy” and the need to redesign current legal frameworks, starting from the acknowledgement that data-driven technologies address and impinge on groups-as-collectives to be tokenised besides and beyond individuals. Going further, Viljoen (2021) notes that the individualistic vision behind the current EU approach does not account for the relational nature of data and the consequent trade-off effects that data re-use involving two subjects might have on unaware third parties. On this wave, Smuha (2021) suggests taking inspiration from environmental law for tackling potential collective-level effects caused by digital transformation, such as the erosion of the legitimacy and functioning of the rule of law, which can be neither accounted for nor mitigated by current individualistic approaches to digital transformation. Hence, while a human right-based approach to digital transformation is necessary to protect the individual’s autonomy, it might be insufficient to protect Europeans as a whole. This requires designing sociotechnical mechanisms that aim to represent and strike a balance between all stakeholders and their potentially competing interests.

3.3 Processes

While the 2021 Europe Digital Programme remained vague in characterizing the governance of the emerging DSM, a more robust characterization can be found in the 2022 document (European Commission 2022d). Here, the European Commission speaks of “the deployment of (…) common data spaces, based on federated cloud-to-edge infrastructure and services that are accessible to businesses and the public sector across the EU. The objective is the creation of data infrastructure with tailored governance mechanisms that will enable secure and cross-border access to key data sets in the targeted thematic areas.” This passage highlights key features of the DSM.

First, the emerging ecosystem is substantiated as a technical cloud-to-edge infrastructure whose objective is to federate data across involved actors to facilitate cross-border interoperability. Cloud computing is a tech solution typically good for accumulating and storing huge amounts of data, although their processability may imply some latency. Edge computing configures a “lighter” form of data accumulation and one that is faster to process, because data do not go back and forth between the remote data centre and the used devices, but are kept in loco, or better, at the edge of the network. Ideally, this also means a safer processability of the data, because they are less dispersed and remain anchored to the context of use. Beyond that, however, the reference to principles other than security and data protection, remains unsystematized in the EU document.

Second, the focus is chiefly on businesses and the public sector, with civic society—mentioned in the 2021 document—pushed out of the picture. From this perspective, the effective deployment of the infrastructure coincides with the objective to make the model economically sustainable, dismissing societal concerns, as well as the importance to maintain a multi-stakeholder equilibrium.

Third, the infrastructure is regarded as fundamental to build common data spaces, which is a regulatory concept first introduced in A European Strategy for Data (European Commission 2020a). Here, it is stated that “common European Data Spaces will ensure that more data becomes available in the economy and society while keeping companies and individuals who generate the data in control.” While the document references economy and society as two macro—yet distinct—dimensions benefitting from the establishment of common data spaces, these latter are articulated in terms of businesses and individuals, reasserting an economic-driven and individual-based rationale, with no mention to other (non)institutional actors. In a more recent working document (European Commission 2022c), it is specified that common data spaces will guarantee:

  • A secure and privacy-preserving infrastructure to pool, access, share, process and use data.

  • A clear and practical structure for access to and use of data in a fair, transparent, proportionate and/non-discriminatory manner and clear and trustworthy data governance mechanisms.

  • European rules and values, in particular personal data protection, consumer protection legislation and competition law, are fully respected.

  • Data holders will have the possibility, in the data space, to grant access to or to share certain personal or non-personal data under their control.

  • Data that is made available can be reused against compensation, including remuneration, or for free.

  • Participation of an open number of organisations/individuals.

Here the bundling between technology, (proprietary) law, and economic value is vivid. Disregarding societal, ecosystemic, and collective dimensions of digital transformation, the EU pursues a federation of data, in terms both of infrastructure and business model. Through its common data spaces, this vision is one that, technologically speaking, revolves around interoperability and secured sharing of data, with transparency and trust achieved automatically as soon as the infrastructure is interoperable and safe; economically speaking is concerned with prioritizing businesses and individuals as consumers; legally speaking is concerned with privacy compliance and competition law.

From a literature perspective, this is no novelty, after all. Federated data systems originally relate to the idea, in vogue since the 1970s, of federated databases, as a way for integrating data from multiple, independent databases into a single one. It is only in the mid-2000s, with the booming of the digital revolution and the creation of increasing amounts of data, that the idea has been applied to data management and governance, coming to define a model for maximizing secure interoperability (Fioretto and Hentenryck 2019) and economic value through data sharing (Zhang and Zhang 2012).

Beyond technical and economic advantages, Govarts and colleagues (2022) point to the potential increase in data quality and (re)use that a federated system can achieve, for instance “facilitate[ing] the FAIRification of data [findable, accessible, interoperable, reusable].” At the same time, however, the authors note that to release the full potential of federated models it is necessary to tackle enduring barriers that “are not primarily technical in nature but rather concern legal, ethical and political barriers, as well as lack of resources and good incentives for data custodians to embark on sharing their data.” This points to the fact that while federating data might represent a strategic infrastructural choice to abide to secure data sharing and privacy concerns, such choice brings with itself the need to build sociotechnical and legal expertise and skills (World Economic Forum 2019). In other words, federated data, as a tech infrastructure and business model, is not enough to guarantee the enactment of those societal and collective-level principles that the digital strategy claim as pillars. Table 1 shows the discrepancy between how the EU frames its digital strategy and how it is eventually enacted, in terms of values, actors, and processes.

Table 1 Gap between envisioned and realized values, actors and processes through the EU's digital strategy
Full size table

To tackle this situation, it is necessary to rethink democratic participation through and about digital transformation. As Cardullo and Kitchin (2019) note, we need to redesign participation towards “more extensive public consultation, collaboration and co-production” which are rooted in “a set of civil, social, political, symbolic and digital rights and entitlements”, rather than in market individualistic logics. To move towards a comprehensive approach, it is crucial first to truly consider the data landscape as an ecosystem (van Loenen et al. 2021) that, by definition, is irreducible to any of its actors or values for its sustainable working; and second to design “collectual” strategies (Calzati 2022) to keep the whole ecosystem in balance by redressing possible power asymmetries arising among actors or values.

4 Data ecosystems and data commons

4.1 Data ecosystems

Far from being equitable to a platform, an ecosystem is characterized by interacting elements within a given environment, so that the behavior of the ecosystem cannot be studied by isolating either elements or interactions; rather, it must be studied in its entirety. Similarly, a data ecosystem is a concept framing the sociotechnical elements, actors and procedures contributing, all together, to create and manage data-based initiatives (Jarke et al. 2019). To govern a data ecosystem then, requires balancing out the data interests of all the actors in play, based on shared values and in view of socioeconomic sustainability of the whole (van Loenen et al. 2021). It is hardly possible, then, to take economic and social values apart, as well as to consider the ecosystem as a tech-sole network of nodes; it is a sociotechnical ensemble to emerge. To achieve a governing of data ecosystems that is truly compliant with the EU’s fundamental rights and digital principles, it is worth looking at the literature on the commons as a regime to inform the current EU’s governance of digital transformation which moves beyond the individual and economic value only. At stake is the reconsideration of data governance from an actor-network approach (cf. Latour 2004) to a systemic–procedural one, which considers stakeholders, processes, and values as co-dependent aspects of a whole entangled dimension.Footnote 2

Concerning actors, the commons can be said to enact an ecosystemic approach negotiating between individual and collective stances to the extent to which to prioritize one or the other would imply the collapse of the self-regulating system. This concretely means that the quadruple helix—public sector, private sector, academia, and citizens—which is often regarded has the standard approach to have thriving data initiatives, from a commons perspective is rather regarded as the baseline instead of the optimum. A whole galaxy of (non)institutional actors enters the scene and informing commons initiatives: as Hummels and colleagues (2021) note: “in the end, mitigation mechanisms are necessary for both those who incur damages due to their inclusion, and those who incur damages from being excluded.” At stake is not a singling out of certain actors, but the identification of strategies to keep the ecosystem in balance. This also applies to data ecosystem, where NGOs, no-profit organizations, data intermediaries, data stewards, including free riders, inform the life of data initiatives. This entails exploring governance mechanisms of in/exclusion which can guarantee the diversity of actors involved, while maintaining a collective outlook and minimizing negative effects on the individual.

Concerning this latest point, in terms of processes an ecosystem that remains in equilibrium requires to first acknowledge and then enable the synergy between (non)institutional actors, hosting both normative and grassroot stances. Indeed, research (Cazacu et al. 2020) shows that the consolidation and institutionalization of new ideas and initiatives occur at best when top-down and bottom-up stances enter in dialogue at various scales, allowing to decrease power distances and guarantee more agency to all actors in play, and foster mutual synergies.

Concerning values, the commons defines a self-organizational way to manage resources which is non-appropriative by default (knowledge, assets, and outputs are not owned, in the commercial sense of the term, but summoned up and recirculated); collaborative by design (it considers all actors and links within the ecosystem as integral and necessary to the system’s flourishing), and collectively sustainable in its goals (indeed, common goods for the community) (Calzati 2022). This means that the creation of social value as a collective-level value—in either tangible or intangible forms, including the minimalization of negative externalities—is regarded as desirable on an equal footage with economic (individual-level) value, which is then recirculated within the system.

4.2 Data commons

Originally, the commons referred to natural resources characterized by non-excludability (i.e., difficulty or impossibility of forbidding access and use of CPRs to any potential beneficiary) and rivalry (i.e., the use of CPRs depletes them and reduces further use by others). Ostrom showed that the self-management of CPRs by communities can be more effective than market-driven or state-led approaches, provided that principles and roles are designed and abided to.

Moving towards what has been labelled as its “second wave” (Hess 2008), by now the commons has been applied to non-natural resources, such as data (Dulong de Rosnay and Stalder 2020) and cities (Iaione 2016). When it comes to data, the spillover has been favored by the consolidation of the Internet—an open infrastructure—which supplied the basis for the proliferation of new forms of co-innovation, via freely accessible knowledge, design, and software. Today, Data Commons (DC) characterizes a regime in which actors join forces in the collection, pooling, and use of data (and digital infrastructures) subservient to the delivery of services for the whole community. DC initiatives (de Lange and de Waal 2019; Morozov and Bria 2018) aim to counteract and/or repurpose the centralized ownership and use of data—either by tech companies or states—by giving these back to citizens, with the goal to foster sustainable collective data practices—in fact a sovereign approach meaning by this the ability of the community to self-determine the purposes of the collection, use, and sharing of data.

The most robust example of DC in the EU currently comes from the city of Barcelona (Ajuntament de Barcelona 2016). In 2016 the Catalan municipality launched a “new social pact on data”: various initiatives informed the new digital agenda, among which platforms based on data commons regimes, allowing citizens regain control over their data. In the words of Morozov and Bria (2018), the goal is to make good and fair use of the power of data through “an ethical and responsible innovation strategy, preserving citizens’ fundamental rights and information self-determination. This will help ensure that public resources and assets are publicly owned and managed for the collective good.” However, Barcelona’s case still presents barriers as some of its proponents have witnessed (Monge et al. 2022), especially in terms of limited funding, swinging political support, tech-legal capacity, and trust from institutional actors. In this respect, this case teaches that the commons can be applied to data and digital infrastructures only to the extent to which this regime is inscribed into a broader picture informing the blossoming of the ecosystem.

5 Federated data and data commoning: a convergence

Based on these premises, here it is contended that, while a federated data can work as an institutionalized tech-legal backbone—especially useful to overcome data commons’ enduring barriers—a commons approach can help enact a societal and collective outlook truly compliant with a citizen-centric approach to digital transformation (Table 2).

Table 2 How federated data and data commoning values, actors, and processes complement each other
Full size table

Scholars (Zygmuntowski, et al. 2021) have hinted at the promise of designing an EU comprehensive commons-based data governance. Already Hess and Ostrom noted the pivotal role of technology in creating and seizing a resource as a commons: “[t]his ability [of technology] to capture the previously uncapturable creates a fundamental change in the nature of the resource, with the resource being converted from a nonrivalrous, nonexclusive public good into a common-pool resource that needs to be managed, monitored, and protected, to ensure sustainability and preservation.” This means that as soon as a (new) technology creates a resource, this can effectively be managed as a commons. Bloom and colleagues (2021) went further suggesting how Ostrom’s design principles might be transposed in the context of data initiatives. In so doing, these authors outline guidelines concerning the governance that such commons-based data initiatives might take. However, their standpoint remains anchored to a normative understanding of data as a resource, preventing an effective tackling of data through the lens of the commons. As Sanfilippo and Frischmann (2023) note, departing from Ostrom’s principles is necessary as these do not fully map over data-driven technologies.

To overcome this hurdle, it is necessary to accommodate the idea of data “commoning” (de Angelis 2017) as a sociotechnical process. As de Angelis (2017) notes “commons are not just resources held in common, or commonwealth, but social systems [of] ongoing interactions, phases of decision making and communal labor process.” In this sense, the commons comes to identify, more broadly, a practice consisting of a resource, its users, institutional bodies, and its associated processes. At the intersection of technology and intellectual property law, Frischmann and colleagues (2014) have a point noting that “a patent applicant must demonstrate that the invention claimed in the application possesses an ‘inventive step’, such that the invention represents a sufficiently great technical advance over the existing art.” This is a good example of how law creates a proprietary resource (ready to be economized), in the same way as technology turns a public good into a limited resource. By subverting the relation between commons and commoning, de Angelis (2017) then contends that “if the origin of commons rights is in commoning, we are in the presence of a social system generated by its own operations, codes and values.” In other words, it is commoning that precedes and foregrounds the commons, not the other way around. From here, building upon the tech-legal institutionalization of federated data, data commoning can complement the EU’s digital strategy in the direction of a more ecosystemic process based on sharing as value, rather than sharing (solely) as profit.

More to the point, we claim here that data commoning shall be (1) systemically fair; (2) contextually communitarian; (3) iteratively participatory. First, data commoning shall enact systemically fair governance mechanisms able to trade off among different interests in view of an overall equilibrium. This understanding of fairness overcomes both a reductionist and an essentialist definition of the term. Within the first group fall those attempts which seek to provide a mathematical definition of fairness. (Wong 2020). The main limitation of such a standpoint lies in the reduction of fairness to a computational matter, overlooking its contextual dependency. On the other hand, an essentialist standpoint does account for the context-dependency of fairness, and yet it still considers it as a core quality of a given technology or data process (Lee et al. 2021). This understanding falls short of producing a systemic enactment of fairness, remaining anchored to specific scenarios. A governance aiming to regulate a data ecosystem fairly identifies roles and rules to represent the data interests of all actors, as well as mechanisms to adjudicate situations, where conflicts among actors and/or values might arise. Such ecosystem shall be regarded not much as an arena, where different players are connected, but as a process that constantly reshapes its own power relations, in view of general interest.

This leads to the second aspect. Data commoning shall be designed through a cognizant rooting into the current and past socio-economic–environmental dynamics that make a given data ecosystem emerge. As Frischmann and colleagues (2014) contend, “resources, community, and goals often depend significantly on narratives of creation and on history”. This means, more broadly, to explore what makes a community, and how this gets entangled with an operative notion of general interest: what are the shared priorities a certain community prioritize? How has it arrived to do so? Who is involved? Only a contextualized analysis can provide answers in this respect.

A (data) community is a fractal concept (Tannier and Thomas 2013) as far as its scale is concerned in that it depends on the interplay among three components: infrastructures (e.g., ICTs), institutions (e.g., national policies, regional directives, city’s orders), and locals’ knowledge (e.g., people’s practices and relations relevant to and framed within a given place; Brown and Duguid 1991). As long as these components are ideally co-extensive (i.e., they overlap), then authority and territoriality are fully legitimate, and the exercise of power coincides with (and can be scrutinized in) the interest of the whole community. Whenever the co-extensiveness of the three is not guaranteed, as it often happens—e.g., a community’s infrastructure extends well beyond the human relations bound to the territory or an international actor comes in play in a small community under international market laws—then we have a weakening of legitimacy because of a discrepancy between authority (who takes the decision) and territoriality (reduced or no community’s agency). This is when self-organization fades, being substituted by top-down-only or global-market approaches.

This implies that the general interest of a community is inevitably subjected to ongoing (re)negotiation. Already today, national, and supra-national legal frameworks are in place for disentangling individual and collective interests concerning the access and (re)use of (personal) data. This is so because “general interest” is an entangled concept that demands ongoing contextualization. From an empirical perspective, the concept reflects the diversity of interests of all actors involved in a given situation (Healey 1997); from an ethical perspective, it constitutes the synthesis (not necessarily the sum) of all actors’ interests (Innes and Booher 2015). In fact, such synthesis is never given once and for all; it is based on discontinuities across the community. Concretely, this demands the design of an iterative process able to reflect upon itself—and its own condition of existence—in a participatory way.

When de Angelis (2017) writes that “the subjects of this movement, the commons, are not here understood as individual subjects, but as already systemic subjects”, he points exactly to the co-dependence between individual and collective stances and to commoning as a practice that negotiates between the two. At the same time, there must be a moment of “fixation” (for analytical purposes) of the commoning “dance” de Angelis (2017) envisions; this is why the whole process needs to be iterative and to be so in a participatory way. Two issues are at stake when we speak of participation: what kind of participation? How is participation designed? According to Arnstein, it is only when citizens get effective and direct accountability and deliberative powers over the decisions to be taken that participation is valuable (Arnstein 1969). To have successful participation in data commoning, then, it is crucial to “manage the system as a process of continuous innovation, learning and adaptation” (Toots 2019), whereby new competences and skills are constantly acquired and put to use.

This addresses the second question on how to design participation to/for data commoning. In this respect, participation needs to be regarded as open-ended, that is, designed in such a way that it can host “conflict and dissonance” (Sennett 2018). Participation, then, is inclusive to the extent it is plural and yet always incomplete. Commoning itself is entangled with participation to the extent to which participation sets the boundaries of systemic autonomy and self-regulation (de Angelis 2017): commoning, in other words, establishes its own existence, defining lines of inclusion and exclusion on a rolling basis and based on contextual needs, in view of the ecosystem’s blossoming. Given the multifarious evolution of digital transformation, a data commoning approach can only accommodate participation as an open horizon; a horizon that requires constant monitoring by and through commoners.

6 An open agenda

The critical review we conducted on recent EU’s policy-orienting documents and pieces of legislation in matter of digital transformation showed that, while summoning a citizen-centric vision that brings together individual fundamental rights, as well as collective principles, the EU’s digital strategy gravitates around a tech-legal-economic bundling which prioritizes private actors, economic value, and individuals as consumers. To emerge is a federated data system, as both a tech infrastructure and business model, that guarantees secure data sharing and privacy, but overlooks societal and collective-level dimensions of digital transformation which cannot be reduced to individuals nor to their sum. The risk, then, is to encounter the same sociotechnical barriers that open data initiatives have manifested over the last decade.

To redress this—we argued—it is necessary to twist the perspective and tackle digital transformation as a whole ecosystem in the making. In this regard, we explored a commoning approach as a complementary way to the EU’s current approach, infusing into its federated data model a societal and collective-level outlook by default that brings together top-down and bottom-up stances. The coupling of federated data with data commoning can contribute to realize a truly citizen-centric digital transformation, beyond the glamouring cooptation of this concept.

The idea we outlined, however, remains at a conceptual level and demands further testing to identify barriers and enablers to its operationalization. To concretely do so, preliminary steps can be taken to overcome current limitations afflicting data commons initiatives. Notably systemic efforts are necessary to build (1) long-term tech-legal capacity in the public sector; (2) data literacy in citizenry; and (3) trust across institutional and non-institutional actors. It is a whole process that needs to be recognized and defended, and this requires mobilization of educational programs, conjoint public–private funding, as well as political support.