Privacy, intellectual property and Indigenous data governance
The system's engineering separates public discovery of an asset from private access to its source information. A catalogue may say that a qualified algorithm exists and is available for a specified use. That is not permission to publish the data used to develop it, identify a person mentioned in a source record or transfer a community's confidential knowledge. Sensitive data may have to remain in a controlled institution, with computations brought to it under strict conditions or the entire use refused.
Canadian privacy and public-sector information laws apply according to the organization and activity. In British Columbia, private organizations and public bodies may be governed by different statutes. Institutions should identify the correct legal basis, permitted purposes, affected individuals' rights, retention and security obligations before granting access. Labour agreements, intellectual-property contracts, research ethics and cross-border export restrictions may also matter.
Indigenous data sovereignty is not exhausted by a checkbox or individual consent screen. Indigenous governments and communities may have collective governance principles and legitimate authority over information about their peoples, territories and knowledge. Any system involving such information must be developed through appropriate relationships, defined authority and community-controlled limits. Sometimes the correct decision is that the information should not enter a marketplace.