Georgetown Law
Technology Review

Data privacy has become an increasingly important and popular topic in recent years, especially with the large-scale introduction of artificial intelligence (AI) in a variety of sectors. In 2021, legislators across twenty-nine states introduced state data privacy bills, marking a 106% increase from the year before. According to EPIC’s Executive Director Alan Butler, a national, cohesive standard has become necessary: “we need to recover our shared understanding of and respect for privacy online. The only way to do that is by setting a strong national standard for data protection.” On October 23, 2023, the White House issued an Executive Order titled “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.” In the Executive Order, federal agencies are directed to focus on privacy-preserving research, technologies, and techniques for AI, as well as develop privacy guidance and legislation that addresses AI risks. Now, more than ever, understanding data privacy—what it truly is and how it should be implemented—is important. In the effort to define data privacy and integrate it into legislation and regulation, it is equally important to ensure that everyone’s data privacy is sufficiently protected—which includes not only the data itself, but also the data subject’s (a person with data) control over their data.

Indigenous peoples are often excluded when in discussions of data privacy. While this exclusion is occurring, Indigenous communities are suffering from data genocide. This Legal Impression seeks to bring the important concept of data genocide to conversations of data privacy in an effort to end data genocide.

Definitions: Data Genocide and Indigenous

Data genocide is a term used to describe the erasure or omission of data of Indigenous peoples. The term is often used in relation to health data, but can apply generally to all data and statistics related to Indigenous peoples. Abigail Echo-Hawk, a citizen of the Pawnee Nation of Oklahoma, and the director of the Urban Indian Health Institute, states: “A genocide is happening through data. We are being eliminated [from] the data. We are not being reported in the data, and if our data is there, it is very often not disaggregated in a way that allows for our tribal leaders to get the information that they need . . . .” 

Discussions of data genocide first require an understanding of the term “Indigenous.” This term has been used to distinguish those who are “native” from the “others” (non-natives). The United Nations has not adopted an official definition, but instead relies on criteria such as self-identification, culture, historical links to pre-colonial/settler societies, and a strong link to a specific territory to curate what it means to be Indigenous in different parts of the world. Those who identify as American Indians and Alaska Natives are considered Indigenous and will be the focus of this Essay. 

The current practices of both data collection and analysis of Indigenous data commit data genocide. A prevalent example is found in the high midlife mortality that Indigenous communities suffer from. Narratives of overdose, suicide, and alcoholic liver diseases are often categorized as “[w]hite American problems,” according to doctors Joseph Friedman, Helena Hansen, and Joseph Gone, erasing the fact that these issues are also prevalent in Indigenous communities. This narrative erasure was only made possible “by the erasure of data describing Native American mortality.” They also state that, “[t]he omission of these data for Native American groups is commonplace, with serious implications for attending to and remedying health inequities, underfunded programmes, and inaccessible services.”

Carving out Indigenous Data Privacy Rights

Government data collection efforts, particularly as it pertains to health data, contribute heavily to data genocide. Some examples include: 

• forgoing the enforcement of mechanisms to ensure data is being accurately reported (contributing to both data omission and erasure);
• focusing on “single race” data (forcing data subjects into the single category of American Indian/Alaska Natives) which skews data (and contributes to erasure) as it pertains to Indigenous people who are multi-race; or
• choosing to exclude Indigenous communities in the data collection process (contributing to both data omission and erasure because without adequate knowledge about and from Indigenous data subjects, the research will be incomplete). 

Researchers, data controllers, and data processors in all sectors can contribute to data genocide by using these, and other, harmful methods. Further, the narrative erasure that follows data omission or erasure exacerbates the harm at the policy level. Without adequate data, there will not be an accurate understanding of Indigenous communities. This inhibits policymakers’ ability to, according to the Urban Indian Health Institute, “make data-driven decisions for equitable policy and resource allocation.” Creating equitable policies for Indigenous communities necessitates a focus on their data privacy rights (or lack thereof).

The main goal of data privacy, according to privacy scholar and professor Daniel Solove, is “to provide individuals with control over their personal data.” The European General Data Protection Regulation (GDPR), a comprehensive data privacy law, and several American privacy laws provide individuals with control. The GDPR mandates specific data privacy rights that all data subjects must get such as the right to be informed, right to erasure, and right of access. These rights are constructed to be important for anyone that controls or processes data: all data controllers or processors must give data subjects their privacy rights. However, the data controllers or processors can only be concerned with, and responsible for, the data that they are processing or controlling. When Indigenous peoples’ data is excluded, it is not processed or controlled in the first place, furthering data genocide. 

The pandemic offers a good example of data genocide. Indigenous people were not included in data about COVID-19. A 2021 report on U.S. states’ quality of Indigenous data collection found that “[p]oor data collection and reporting standards by U.S. [s]tates has resulted in a substantial gap in understanding the disproportionate impact of COVID-19 on American Indians and Alaska Natives.” When data genocide occurs, Indigenous peoples do not truly have data privacy. If the main goal of data privacy is control, how can Indigenous peoples gain control over their data and ensure that they are included should they choose? Within discussions, policies, and executive orders, there must be an active inclusion of Indigenous peoples and their specific privacy rights in order to prevent data genocide from occurring.

Ending Data Genocide: Solutions

This Legal Impression seeks to actively reclaim the privacy rights of Indigenous peoples: Indigenous peoples should be included within conceptions of data privacy. Indigenous people must have the right to have their data included, and policy, legislation, or regulations must immediately incorporate such a right for Indigenous people to ensure their data privacy. For example, had the right to have their data included been integrated into the White House Executive Order, that would have potentially changed the mandate for federal agencies regarding privacy-preserving techniques and technologies. The guidelines, standards, and best practices that the Executive Order mandates would then include Indigenous peoples’ rights to control their data and extend federal resources to support and collaborate with tribes. Should they choose for their data to be included in, for example, COVID-19-related data, they should get that option. 

The data of Indigenous peoples are often grouped in with other racial groups, or simply excluded. An active involvement in the data privacy discussion of Indigenous peoples’ data would mean that their data would be thought of and included as a category of their own. Similarly important is the continued understanding of control: Indigenous data subjects should be extended the same amount of control over their data as anyone else. Tribal nations should also be afforded support, sovereignty, and control as it pertains to data, data collection, and data analysis. Indigenous communities have already been fighting for equitable data governance and data sovereignty. In an attempt to achieve their goals and forward the conversation, the push to include Indigenous data subject control and choice of inclusion in privacy conversations would also allow Indigenous peoples’ voices to be heard. Nonetheless, it is important to remember a popular mantra that is related to conversations of Indigenous data governance: “as open as possible, as closed as necessary.” This again includes the right of Indigenous people to choose to be included, but does not give data collectors and processors free reign when it comes to Indigenous data. Their practices still need to comply with data protection principles. 

Preventing (Data) Genocide: Consequences

Unfortunately, the word “genocide” is apropos. Without data, there is no true way to track progress or trends. An illustrative example is the lack of Indigenous data collection and inclusion during the COVID-19 pandemic. When Indigenous people were left out of the data, they were also left out of efforts to, for example, provide more federal financial help. According to a 2021 study, “Native Americans experience substantially greater rates of COVID-19 mortality compared with other racial and ethnic groups . . . .” Because there was no way to track how Indigenous peoples were faring during the pandemic and no way to ensure that they were getting the help that they needed, this data genocide could have led to their deaths. 

The pandemic is not the only context where Indigenous lives are in danger: as stated, without accurate data, equitable resource allocation for healthcare is impossible leaving Indigenous communities without the resources they need to lead healthy lives. By taking advantage of the popularity of privacy discussions, perhaps the extremely necessary data privacy rights of Indigenous peoples can be realized.