Crowdsourced data contributions governance

Introduction

Crowdsourced data contributions governance refers to the legal, institutional, and technological framework governing the collection, submission, verification, storage, sharing, and utilisation of information voluntarily contributed by individuals, communities, researchers, and organisations through digital platforms or collaborative initiatives.

Crowdsourcing enables organisations to collect large volumes of information from multiple contributors without depending exclusively on traditional institutional research methods. It is increasingly used in biotechnology, healthcare, environmental monitoring, agricultural research, pharmaceutical development, genetic studies, and public health surveillance.

For example, individuals may contribute health information through digital applications, researchers may submit genetic observations to scientific databases, and communities may provide environmental information concerning biodiversity and microbial populations.

Although crowdsourced data can accelerate scientific discovery and improve public participation, it creates important legal concerns relating to informed consent, data ownership, privacy, intellectual property, accuracy, cybersecurity, commercial exploitation, and accountability.

Effective governance is therefore necessary to ensure that contributors understand how their information will be used and that organisations collecting such information comply with applicable legal and ethical requirements.

Legal framework governing crowdsourced data contributions

Crowdsourced data governance is influenced by data protection legislation, intellectual property laws, research ethics standards, and international data governance principles.

The General Data Protection Regulation (GDPR), 2016, establishes important requirements where crowdsourced contributions contain identifiable personal information and the regulation applies. Article 5 establishes principles of purpose limitation, data minimisation, accuracy, and accountability. Article 6 establishes lawful bases for processing, while Article 9 provides additional protection for sensitive information, including genetic and health data.

The UNESCO Recommendation on Open Science, 2021, encourages scientific collaboration, accessibility of research information, and responsible participation in knowledge creation.

The OECD Privacy Guidelines, 2013, also provide principles concerning transparency, individual participation, security safeguards, and accountability.

Other relevant frameworks include:

UNESCO Universal Declaration on Bioethics and Human Rights, 2005: Establishes ethical principles concerning consent, privacy, and human dignity.

TRIPS Agreement, 1994: Establishes international intellectual property protection standards.

WIPO Copyright Treaty, 1996: Addresses copyright protection in digital environments.

FAIR Data Principles: Promote data that is findable, accessible, interoperable, and reusable.

CARE Principles for Indigenous Data Governance: Emphasise collective benefit, authority to control, responsibility, and ethics in the governance of Indigenous data.

These frameworks collectively support responsible collection and utilisation of publicly contributed scientific information.

Informed consent and contributor participation

Informed consent is a fundamental requirement when crowdsourced contributions involve personal, medical, genetic, or other sensitive information.

Individuals contributing information through digital platforms should receive clear explanations about the purpose of collection, the identity of the collecting organisation, intended research activities, possible commercial applications, and arrangements for sharing information with third parties.

For example, a healthcare research platform may invite individuals to submit information about their medical conditions and treatment experiences. If the organisation later intends to use this information for pharmaceutical research, it must establish whether the proposed processing is covered by the original consent or another applicable lawful basis.

Consent should not be treated as unlimited permission for every future use.

Important governance requirements include:

Transparent contributor information.

Clear identification of research objectives.

Appropriate consent mechanisms.

Disclosure of commercial research intentions.

Procedures for handling withdrawal requests.

Protection of contributor identities.

Appropriate restrictions on secondary data use.

Where children or vulnerable individuals contribute information, additional legal and ethical safeguards may be necessary.

Data ownership and intellectual property rights

One of the most complicated issues in crowdsourced data governance concerns ownership of contributed information.

A contributor may submit original photographs, scientific observations, genetic research findings, survey responses, or technical datasets to a digital platform. The organisation operating that platform may wish to use these contributions for commercial research, artificial intelligence development, or scientific publication.

However, submitting information does not automatically transfer every intellectual property right to the platform.

Under copyright law, original literary, artistic, photographic, and certain database materials may receive protection. In India, the Copyright Act, 1957, governs these rights.

The legal position depends on the nature of the contribution:

Original photographs and written descriptions may qualify for copyright protection.

Original software and technical documentation may receive copyright protection.

A collection or arrangement of information may receive protection where statutory originality requirements are satisfied.

Raw facts and individual observations are not automatically protected by copyright.

Patent protection may apply to eligible inventions, but not merely to the submission of scientific information.

Crowdsourcing platforms should therefore establish clear licensing agreements explaining whether contributions can be reproduced, modified, published, redistributed, or commercially exploited.

Data accuracy, verification and accountability

Crowdsourced information may contain errors, incomplete observations, duplicated submissions, manipulated records, or misleading scientific claims.

This becomes particularly important in biotechnology and healthcare, where inaccurate information may influence scientific research, public health decisions, or medical investigations.

For example, a crowdsourced disease surveillance platform may receive reports from thousands of individuals. Without appropriate verification, incorrect reports could distort disease prevalence estimates or public health assessments.

Organisations must therefore implement quality-control mechanisms.

These may include:

Contributor identity and source verification where appropriate.

Scientific review of submitted information.

Automated error detection.

Duplicate record identification.

Independent validation of important findings.

Documentation of data limitations.

Procedures for correcting inaccurate contributions.

Platform operators should also establish clear responsibilities for reviewing, moderating, and maintaining submitted information.

Privacy and cybersecurity protection

Crowdsourced platforms frequently collect personal information through mobile applications, websites, research portals, and connected devices.

In biotechnology and healthcare, contributions may include genetic information, medical histories, health measurements, and biological research observations.

Such information may reveal sensitive details about individuals and, in certain circumstances, their relatives.

The GDPR provides additional safeguards for health and genetic data where applicable. In India, the Digital Personal Data Protection Act, 2023, regulates digital personal data processing within its scope.

Organisations must consider applicable requirements concerning consent, lawful processing, security safeguards, and individual rights.

Important protective measures include encryption, access controls, pseudonymisation, secure storage, regular security audits, and incident-response procedures.

Indian legal and regulatory framework

India does not have one comprehensive statute exclusively governing crowdsourced data contributions. Instead, several existing laws and regulatory frameworks apply depending on the nature of the information and the activity.

1. Digital Personal Data Protection Act, 2023

The Act establishes requirements for processing digital personal data, including consent, specified legitimate uses, security safeguards, and data fiduciary responsibilities.

It is relevant where crowdsourced contributions contain identifiable personal information.

2. Information Technology Act, 2000

The Act provides the broader framework for electronic information systems, cybersecurity, and certain forms of unauthorised access and disclosure.

Sections 43 and 66 address specified computer-related misconduct, while Section 72A concerns disclosure of personal information in breach of a lawful contract in specified circumstances.

3. Copyright Act, 1957

The Act protects eligible original contributions, including photographs, written materials, software, and certain original compilations.

Section 14 defines the exclusive rights associated with copyright, while Section 17 establishes the general rule concerning first ownership, subject to statutory exceptions.

4. Patents Act, 1970

The Act governs patentable inventions developed through research involving crowdsourced information. However, the mere collection or submission of scientific observations does not automatically create patent rights.

5. Indian Council of Medical Research Guidelines

The ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017, provide ethical standards for biomedical research involving human participants, including consent, confidentiality, and responsible handling of research information.

These guidelines are particularly relevant when crowdsourced contributions form part of organised human biomedical research.

Case laws and judicial decisions

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), (10) SCC 1

The Supreme Court of India recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy and emphasised that personal information requires protection against arbitrary collection, processing, and disclosure.

Legal significance: The decision establishes an important constitutional foundation for crowdsourced data governance. Digital platforms collecting personal or health-related contributions must respect privacy and ensure appropriate legal safeguards.

2. Shreya Singhal v. Union of India (2015), (5) SCC 1

The Supreme Court examined the constitutional validity of Section 66A of the Information Technology Act, 2000, and considered intermediary liability under Section 79.

The court struck down Section 66A as unconstitutional and clarified important aspects of intermediary liability and online expression.

Legal significance: The judgment is relevant to crowdsourcing platforms because it addresses the legal responsibilities of online intermediaries and the protection of freedom of expression in digital environments.

3. MySpace Inc. v. Super Cassettes Industries Ltd. (2016), Delhi High Court, FAO(OS) 540/2011

The Delhi High Court considered intermediary liability and copyright infringement involving user-uploaded content on a digital platform.

The judgment examined the distinction between general platform responsibility and knowledge of specific infringing material.

Legal significance: The decision is relevant to crowdsourced platforms that allow users to submit photographs, videos, research materials, and other copyright-protected contributions. It highlights the importance of addressing intellectual property violations while operating user-contribution systems.

4. Google Spain SL v. Agencia Española de Protección de Datos (2014), Case C-131/12

The Court of Justice of the European Union examined the processing of personal information by a search engine and recognised the right to request removal of certain search results under the applicable European data protection framework.

Legal significance: The judgment demonstrates that organisations collecting, organising, and making personal information searchable may have independent data protection responsibilities.

5. Fashion ID GmbH & Co. KG v. Verbraucherzentrale NRW eV (2019), Case C-40/17

The Court of Justice of the European Union considered the responsibilities of a website operator that incorporated a social media plugin resulting in the collection and transmission of user information.

The court clarified that an organisation may be a joint controller for the stages of processing whose purposes and means it helps determine.

Legal significance: This decision is relevant to collaborative data platforms because multiple organisations participating in the collection and transmission of contributed information may share data protection responsibilities.

6. Feist Publications, Inc. v. Rural Telephone Service Co. (1991), 499 U.S. 340

The United States Supreme Court examined copyright protection for factual compilations.

The court held that facts themselves are not protected by copyright and that a compilation must demonstrate the required originality in its selection or arrangement.

Legal significance: This decision is important for crowdsourced scientific databases because individual factual contributions do not automatically become copyright-protected merely because they are collected on a digital platform.

Governance challenges and institutional responsibilities

Crowdsourced data contributions create governance challenges because contributors and platform operators may have different expectations concerning privacy, ownership, commercialisation, and public access.

The major challenges include:

Unclear ownership of contributed information.

Insufficient or misleading consent procedures.

Unauthorised commercial use of contributions.

Inaccurate or manipulated scientific information.

Copyright infringement.

Cybersecurity vulnerabilities.

Unequal distribution of research benefits.

Lack of recognition for individual and community contributors.

Difficulties in withdrawing information from previously shared datasets.

Organisations should establish comprehensive contributor agreements and data governance policies before collecting information.

These policies should identify permitted uses, intellectual property arrangements, privacy safeguards, retention periods, verification procedures, third-party access, and dispute-resolution mechanisms.

Where contributions originate from Indigenous communities or traditional knowledge holders, governance should additionally consider collective rights, cultural interests, and appropriate benefit-sharing arrangements.

Conclusion

Crowdsourced data contributions governance is essential for ensuring the lawful, ethical, and responsible collection and utilisation of information contributed by individuals and communities. It plays an increasingly important role in biotechnology, healthcare, pharmaceutical research, environmental monitoring, and digital scientific collaboration.

The Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, Copyright Act, 1957, and applicable research ethics guidelines provide important regulatory foundations in India.

Judicial decisions such as Justice K.S. Puttaswamy v. Union of India, Shreya Singhal v. Union of India, MySpace v. Super Cassettes, Google Spain, and Feist Publications v. Rural Telephone Service establish important principles concerning privacy, intermediary responsibility, copyright protection, and the legal treatment of contributed information.

An effective governance framework must ensure informed participation, transparent data usage, appropriate intellectual property arrangements, reliable verification, cybersecurity, and fair recognition of contributors. These safeguards can strengthen public participation in scientific research while maintaining trust, accountability, and legal compliance.