First Nations Data Governance and the Challenge of Anonymous Research

Introduction

Anonymous research instruments, such as surveys, are often considered a best practice for protecting privacy. When no names or personal identifiers are collected, participants may feel safer sharing information and organizations can reduce privacy risks.

However, in research involving First Nations communities and their citizens, anonymity can have unintended consequences: it can remove First Nations’ ability to steward and govern how information about them and their citizens is interpreted, used, linked, shared, and reused.

Created by the First Nations Information Governance Centre (FNIGC), the Ownership, Control, Access, and Possession (OCAP®) Principles aim to support First Nations’ inherent and constitutionally supported rights to data sovereignty and self-determination. OCAP® emphasizes that data about First Nations peoples and communities should remain under their authority throughout the data lifecycle, not just at the point of collection.

As organizations place greater emphasis on working respectfully with Rights-Holders within an OCAP® framework, we examine the attribution needed to uphold and realize these principles in practice. While privacy protections remain essential within robust research, anonymization does not address the collective dimensions of Indigenous data governance.

Collective Rights and Data Governance

First Nations’ rights to self-determination are recognized under Section 35 of the Constitution Act, 1982, and affirmed through international instruments such as the United Nations Declaration on the Rights of Indigenous Peoples (UNDRIP), which Canada adopted in 2021.

These commitments emphasize free, prior, and informed consent and recognize Indigenous Peoples’ authority over decisions, policies, laws, institutions, and programs affecting their communities and citizens without coercion, in advance, and with full, understandable information, through their own decision-making institutions. In practice, this includes respecting community-led governance over the collection, use, storage, and sharing of their data.

Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Privacy Act, focuses primarily on protecting individual privacy. Collective understandings, time-tested through Traditional Knowledge, are lost due to the emphasis on individual privacy protection. While anonymization is recognized as a safeguard for individuals, these statutes essentially do not address the collective and community dimensions of Indigenous data governance embodied in OCAP®.

As a result, anonymizing data poses a significant challenge to fulfilling broader legal obligations to respect First Nations’ collective authority over their information and cultural knowledge.

Research Ethics and Community Interests

The Tri-Council Policy Statement (TCPS 2) – Canada’s research ethics policy – governs research funded by the Canadian Institute of Health Research (CIHR), Natural Sciences and Engineering Research Council (NSERC), and the Social Sciences and Humanities Research Council (SSHRC), all of which permit the use of anonymous data.

At the same time, the policy emphasizes that research involving Indigenous communities should engage community governance and ethical review (aligned with OCAP®) when there is potential for community identification or impact. In fact, TCPS 2 highlights that most research affecting Indigenous communities often involves collective interests. Ethical research practice therefore includes engaging communities in governance, interpretation, and decision-making – even when individual participants cannot be identified.

Why Anonymous Data Can Create Challenges

Research that does not collect individual or community identifiers may appear appealing for privacy reasons or for administrative simplicity. However, when data relate to First Nations communities and their citizens, anonymity can create challenges and undermine First Nations members’ Charter rights in several ways.

Loss of Community Control and Ownership

First Nations have the right to transparently regulate how information about their communities is gathered and used. Anonymous data removes the ability for communities to exercise community choice in key data processes, such as validation, contextualization, interpretation, and linkages. Without attribution, data become untethered from community context and decision-making authority.

Barriers to Access and Stewardship

OCAP® emphasizes that First Nations should be able to access and manage their data, regardless of where it is stored. Anonymous datasets can prevent communities from verifying data accuracy, correcting errors, re-using data, or ensuring information is stored and used in ways that align with community priorities. If data cannot be linked back to a Nation, they cannot be meaningfully stewarded or repatriated.

Consent Limitations

Free, prior, and informed consent requires that individuals and communities understand how information will be collected, used, and shared. Anonymous data collection can make it difficult, or even impossible, to ensure that consent processes align with community protocols or cultural expectations. Additionally, while legislation, such as Ontario’s Personal Health Information Protection Act (PHIPA), recognizes the right to withdraw consent in certain contexts, withdrawal is not possible when data cannot be linked to individuals or communities.

What Rights-Aligned Research Can Look Like

Protecting individual privacy and respecting collective governance are not mutually exclusive. Personal anonymity may be appropriate in many contexts, while data remain attributable to the Nation of origin.

A rights-aligned collaborative approach to research recognizes that data should have a “Nation home,” ensuring communities can govern how information is interpreted, used, and shared. This approach embeds sovereignty and self-determination into every stage – from research question development to data access and future use – ensuring that the data collected can inform the researcher’s inquiry, while also having the opportunity to serve a Nation’s priorities, protocols, rights, and long-term well-being.

This approach could include:

Community-Led Governance

• Engagement with Indigenous leadership, health directors, Elders, and community members from project design onward.
• Ongoing oversight by a community governance body, circle, or designated authority.
• Decision-making authority over research questions, methods, consent processes, and data use and sharing.

Meaningful Consent Processes

• A focus on a free, prior, and informed consentmodel that aligns with an emphasis on self-determination and collective rights.
• Clear explanations of how data will be used, stored, accessed, and shared.
• Options for communities/individuals to limit participation or data use.
• Information explaining how collective rights are respected.
• Consent processes are reviewed and approved by community governance bodies.

Data Stewardship and Access

• Data stored in systems directed by or accessible to the First Nation.
• Access protocols are codified through community governance policies, resolutions, or charters.
• Clear procedures are established to triage and review third-party access requests (e.g., researchers, health agencies).

Community Interpretation and Use

• Data is not merely extracted; it is interpreted and applied to community-defined priorities.
• Joint analysis with local data workers or professional partners, where possible.
• Reports include community context, Traditional Knowledge framing(s), and culturally grounded interpretations.
• Reporting and interpretations are reviewed by the community prior to release.

Governance Beyond Project Completion

Community authority and governance do not stop when data collection is complete. Future sharing or reuse is governed by agreements that define:

• What data can be shared?
• For what purposes?
• For how long?
• Under what conditions?

Moving Forward

For research involving First Nations communities or affecting their interests, anonymity alone is not a substitute for ethical, culturally appropriate, and rights-aligned data governance.

Canadian research ethics frameworks increasingly recognize the importance of collective interests and community governance at every stage of the research process – from initial design to long-term storage and re-use. To be OCAP®-aligned and consistent with the Canadian Charter of Rights and Freedoms, research should be conducted under the authority of, and attributable to, the specific communities that consented to the research and data collection process.

At the same time, privacy statutes continue to evolve in their consideration of Indigenous data sovereignty. Advocating for Indigenous collective rights not yet fully operationalized in general privacy statutes is recognized as a responsibility we should all share.

Respecting First Nations data governance is not only an ethical responsibility; it is a practical step toward more accurate, contextualized, and meaningful research.