Appendix C: Primary Sources Guide -- Annotated Key Documents
This appendix provides an annotated guide to 25 primary documents referenced throughout this textbook. Each entry includes the document's title, date, issuing body, a summary of its content, its significance for data governance, and where to find the full text. These documents form the legal, philosophical, and normative foundation of the field. Reading them firsthand -- not just reading about them -- is an essential part of becoming a literate practitioner.
Documents are organized into four categories: foundational texts, data protection laws and regulations, AI-specific frameworks, and philosophical and normative texts.
I. Foundational Texts
1. Universal Declaration of Human Rights, Article 12 (1948)
Issuing body: United Nations General Assembly
Date: December 10, 1948
Summary: Article 12 states: "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks."
Significance for data governance: This is the earliest international legal recognition of privacy as a fundamental human right. It establishes that privacy is not merely a matter of individual preference but a right that states are obligated to protect. The article's language -- "arbitrary interference" -- has been interpreted to mean that privacy can be limited, but only through lawful, necessary, and proportionate measures. This proportionality principle runs through all subsequent privacy frameworks (Chapter 7).
Where to find it: un.org/en/about-us/universal-declaration-of-human-rights
2. OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980, updated 2013)
Issuing body: Organisation for Economic Co-operation and Development (OECD)
Date: Originally adopted September 23, 1980; updated July 11, 2013
Summary: The OECD Privacy Guidelines establish eight foundational principles for the protection of personal data: (1) Collection Limitation, (2) Data Quality, (3) Purpose Specification, (4) Use Limitation, (5) Security Safeguards, (6) Openness, (7) Individual Participation, and (8) Accountability. The 2013 update added guidance on privacy management programs, security breach notification, and the global dimension of privacy.
Significance for data governance: These eight principles are the ancestor of virtually all modern data protection laws. The GDPR's processing principles, APEC's Privacy Framework, and national laws from Japan to Brazil trace their conceptual lineage to these guidelines. Understanding the OECD principles is essential for recognizing the shared DNA across diverse regulatory frameworks (Chapter 20). The guidelines also established the principle that data protection should not be used as an excuse to block international data flows -- a tension that persists in debates about data localization and digital sovereignty (Chapter 23).
Where to find it: oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm
3. Fair Information Practice Principles (FIPPs) (1973)
Issuing body: U.S. Department of Health, Education, and Welfare (HEW Advisory Committee)
Date: 1973
Summary: The HEW report, "Records, Computers, and the Rights of Citizens," proposed five principles for the fair handling of personal information: (1) There must be no secret data-record-keeping systems. (2) Individuals must be able to find out what information is in their record and how it is used. (3) Individuals must be able to prevent information obtained for one purpose from being used for another without consent. (4) Individuals must be able to correct or amend their records. (5) Organizations creating, maintaining, or disseminating personal data records must assure the reliability of the data and take precautions to prevent misuse.
Significance for data governance: FIPPs are the earliest articulation of what became the modern data protection framework. They influenced the U.S. Privacy Act of 1974, the OECD Privacy Guidelines, and through them, virtually all subsequent data protection law. Understanding FIPPs provides historical context for evaluating whether modern frameworks have advanced beyond their 1970s origins or merely reformulated the same principles (Chapter 2).
Where to find it: Search for "HEW Advisory Committee Records Computers Rights of Citizens 1973" at epic.org
4. Convention 108 -- Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (1981)
Issuing body: Council of Europe
Date: January 28, 1981 (modernized as Convention 108+ in 2018)
Summary: Convention 108 was the first legally binding international instrument on data protection. It requires signatory states to enact legislation guaranteeing fair and lawful data processing, data quality, purpose limitation, and the rights of data subjects. The 2018 modernization (Convention 108+) added provisions for algorithmic decision-making, biometric data, and stronger enforcement.
Significance for data governance: Convention 108 established the principle that data protection is a matter of international law, not just domestic policy. It predates the GDPR by decades and applies to all Council of Europe member states (47 countries, including non-EU members). It also established January 28 as Data Protection Day (Data Privacy Day in the US) (Chapters 20, 23).
Where to find it: coe.int/en/web/data-protection/convention108-and-protocol
II. Data Protection Laws and Regulations
5. General Data Protection Regulation (GDPR) (2016/2018)
Issuing body: European Parliament and Council of the European Union
Date: Adopted April 14, 2016; entered into force May 25, 2018
Summary: The GDPR is the most comprehensive data protection regulation in the world. It applies to any organization processing the personal data of individuals in the EU, regardless of where the organization is located. Key provisions include: seven processing principles (lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, accountability); six legal bases for processing (including consent, legitimate interest, and legal obligation); data subject rights (access, rectification, erasure, portability, objection); data protection by design and by default (Article 25); mandatory Data Protection Impact Assessments for high-risk processing (Article 35); mandatory Data Protection Officers for certain organizations (Article 37); 72-hour breach notification (Article 33); and fines of up to 4% of global annual turnover or 20 million euros.
Significance for data governance: The GDPR is the reference standard for data protection worldwide (Chapter 20). Its extraterritorial reach (applying to non-EU companies that process EU residents' data) has created the "Brussels Effect" -- a global regulatory pull that has influenced legislation in Brazil (LGPD), India (DPDP Act), and many other jurisdictions. Every chapter in Parts 2-5 of this textbook references the GDPR. The regulation's emphasis on accountability (demonstrating compliance, not just claiming it) and its risk-based approach to data protection have shaped the field's understanding of what effective governance looks like.
Where to find it: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
6. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) (2018/2020)
Issuing body: State of California Legislature / California voters (ballot initiative)
Date: CCPA enacted June 28, 2018; CPRA adopted by voters November 3, 2020
Summary: The CCPA grants California residents the right to know what personal information is collected about them, the right to delete personal information, the right to opt out of the sale of their personal information, and the right to non-discrimination for exercising these rights. The CPRA (Proposition 24) expanded these rights, adding: the right to correct inaccurate information, the right to limit use of sensitive personal information, and the creation of the California Privacy Protection Agency (CPPA) as a dedicated enforcement body.
Significance for data governance: The CCPA/CPRA is the most significant state-level data protection law in the United States and the closest American equivalent to the GDPR. It has influenced privacy legislation in other states (Virginia, Colorado, Connecticut, and others) and is pushing toward a de facto national standard through market pressure. Its "sale of personal information" framework introduces an economic perspective on data governance not present in the GDPR (Chapters 11, 20).
Where to find it: oag.ca.gov/privacy/ccpa
7. Health Insurance Portability and Accountability Act (HIPAA) (1996)
Issuing body: United States Congress
Date: August 21, 1996
Summary: HIPAA's Privacy Rule (effective 2003) establishes national standards for the protection of protected health information (PHI) held by "covered entities" (health plans, healthcare clearinghouses, and healthcare providers that conduct certain electronic transactions) and their "business associates." It defines 18 identifiers that must be removed for data to be considered "de-identified" and establishes the minimum necessary standard (only the minimum amount of information needed for a particular purpose should be disclosed).
Significance for data governance: HIPAA is the primary U.S. health data protection law and the regulatory framework that VitraMed navigates throughout this textbook (Chapters 12, 24). Its entity-based scope (protecting data held by covered entities rather than all health data) creates significant gaps as health-relevant data migrates to consumer devices and wellness apps. HIPAA's de-identification standard has been challenged by re-identification research (Sweeney, de Montjoye -- see Appendix B).
Where to find it: hhs.gov/hipaa/index.html
8. Children's Online Privacy Protection Act (COPPA) (1998)
Issuing body: United States Congress / Federal Trade Commission (implementing regulations)
Date: October 21, 1998; updated rules effective July 1, 2013
Summary: COPPA requires commercial websites and online services directed at children under 13 (or that knowingly collect information from children under 13) to: provide clear notice of information practices, obtain verifiable parental consent before collecting personal information, give parents access to their children's information, not condition a child's participation on providing more information than necessary, and maintain the security of collected information.
Significance for data governance: COPPA is the primary U.S. law protecting children's privacy online (Chapter 35). Its age threshold of 13 has become a de facto standard that other laws and platform policies reference. However, the law has been criticized for failing to protect teenagers (ages 13-17) and for being enforced primarily through FTC actions against egregious violators rather than systematic compliance oversight.
Where to find it: ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
9. Brazil's Lei Geral de Protecao de Dados (LGPD) (2018)
Issuing body: National Congress of Brazil
Date: August 14, 2018; entered into force September 18, 2020
Summary: The LGPD is Brazil's comprehensive data protection law, closely modeled on the GDPR. It applies to any processing of personal data of individuals located in Brazil, establishes ten legal bases for processing, creates data subject rights similar to the GDPR, and established the Autoridade Nacional de Protecao de Dados (ANPD) as the enforcement authority. Penalties include fines of up to 2% of revenue, capped at 50 million reais per violation.
Significance for data governance: The LGPD represents the extension of comprehensive data protection to Latin America's largest economy and is a key example of the GDPR's global influence. It is particularly significant for the textbook's analysis of cross-border data flows (Chapter 23) and Global South perspectives (Chapter 37).
Where to find it: gov.br/anpd (Portuguese; unofficial English translations available)
10. China's Personal Information Protection Law (PIPL) (2021)
Issuing body: Standing Committee of the National People's Congress
Date: August 20, 2021; entered into force November 1, 2021
Summary: The PIPL is China's comprehensive personal information protection law. It establishes consent as the primary legal basis for processing, grants data subject rights (access, correction, deletion, portability), requires data localization for critical information infrastructure operators, and imposes fines of up to 5% of annual revenue. Cross-border data transfers require security assessments, standard contracts, or certification.
Significance for data governance: The PIPL demonstrates that comprehensive data protection is not exclusively a Western or democratic concept. It creates significant compliance obligations for multinational companies operating in China and raises questions about the relationship between individual privacy rights and state access to data in a non-democratic context (Chapters 20, 23).
Where to find it: Official Chinese government sources; unofficial English translations available through law firm publications.
11. India's Digital Personal Data Protection (DPDP) Act (2023)
Issuing body: Parliament of India
Date: August 11, 2023
Summary: The DPDP Act establishes a consent-based framework for personal data processing in India. It creates the Data Protection Board of India as the enforcement authority, grants data principal rights (access, correction, erasure, grievance redressal), and establishes obligations for data fiduciaries including purpose limitation, data minimization, and accuracy. The Act includes significant government exemptions and provisions for "deemed consent" that have been criticized by privacy advocates.
Significance for data governance: As the data protection framework for the world's most populous country and a major digital economy, the DPDP Act will shape global data governance norms. Its approach to government access, deemed consent, and its interaction with India's Aadhaar digital identity infrastructure raise important questions about the relationship between data protection and state power (Chapters 20, 37).
Where to find it: meity.gov.in
III. AI-Specific Frameworks
12. EU Artificial Intelligence Act (2024)
Issuing body: European Parliament and Council of the European Union
Date: Formally adopted March 13, 2024; phased implementation through 2027
Summary: The EU AI Act is the world's first comprehensive regulation of artificial intelligence. It establishes a risk-based classification system: prohibited practices (social scoring, subliminal manipulation, real-time remote biometric identification in public spaces with limited exceptions); high-risk systems (AI in critical infrastructure, education, employment, law enforcement, immigration, credit scoring) subject to conformity assessments, risk management, data governance, transparency, human oversight, accuracy and cybersecurity requirements; limited-risk systems subject to transparency obligations (chatbots must identify themselves as AI); and minimal-risk systems with no additional requirements. General-purpose AI models face additional obligations including technical documentation and copyright compliance.
Significance for data governance: The AI Act represents the most significant regulatory intervention in AI governance to date (Chapter 21). Its risk-based approach has influenced regulatory thinking globally. The Act's interaction with the GDPR creates a comprehensive regulatory framework that governs both the data that feeds AI systems and the AI systems themselves.
Where to find it: eur-lex.europa.eu -- search for "Artificial Intelligence Act"
13. OECD Principles on Artificial Intelligence (2019)
Issuing body: Organisation for Economic Co-operation and Development
Date: May 22, 2019
Summary: The OECD AI Principles articulate five principles for responsible AI: (1) AI should benefit people and the planet (inclusive growth, sustainable development, well-being); (2) AI systems should respect the rule of law, human rights, democratic values, and diversity (fairness, transparency); (3) AI systems should be transparent and explainable; (4) AI systems should be robust, secure, and safe throughout their lifecycle; (5) Organizations and individuals developing, deploying, or operating AI should be held accountable.
Significance for data governance: Adopted by 46 countries (OECD members plus partner countries), these principles represent the broadest international consensus on AI governance. They have influenced national AI strategies, corporate AI ethics frameworks, and the G20's AI principles. They provide a useful baseline for comparing national approaches (Chapters 20, 29).
Where to find it: oecd.org/going-digital/ai/principles/
14. Asilomar AI Principles (2017)
Issuing body: Future of Life Institute
Date: January 2017
Summary: Developed at the Asilomar conference on beneficial AI and signed by over 1,200 AI researchers and practitioners, these 23 principles cover research issues (research goals, funding, science-policy link), ethics and values (safety, failure transparency, judicial transparency, responsibility, value alignment, human values, personal privacy, liberty and privacy, shared benefit, shared prosperity, human control, non-subversion, AI arms race), and longer-term issues (capability caution, importance, risks, recursive self-improvement, common good).
Significance for data governance: The Asilomar Principles represent the AI research community's first major collective statement on AI governance. While non-binding, they established norms that influenced subsequent corporate and governmental frameworks. Their emphasis on human control and value alignment has been central to debates about autonomous systems (Chapter 19).
Where to find it: futureoflife.org/open-letter/ai-principles/
15. CARE Principles for Indigenous Data Governance (2019)
Issuing body: Global Indigenous Data Alliance (GIDA) / Research Data Alliance International Indigenous Data Sovereignty Interest Group
Date: 2019
Summary: The CARE Principles provide a framework for governing indigenous data: Collective benefit (data ecosystems should benefit indigenous peoples); Authority to control (indigenous peoples should govern the collection and use of their data); Responsibility (those working with indigenous data have a responsibility to share how data is used); Ethics (indigenous peoples' rights and wellbeing should be the primary concern).
Significance for data governance: The CARE Principles challenge the assumption that data governance is primarily about individual rights. They center collective rights, relational accountability, and self-determination, offering an alternative framework that is increasingly influential in discussions of data colonialism, indigenous data sovereignty, and non-Western approaches to governance (Chapters 3, 32, 37). They complement the FAIR Principles (Findable, Accessible, Interoperable, Reusable) by adding an ethical dimension to data management.
Where to find it: gida-global.org/care
16. UNESCO Recommendation on the Ethics of Artificial Intelligence (2021)
Issuing body: United Nations Educational, Scientific and Cultural Organization (UNESCO)
Date: November 23, 2021
Summary: Adopted by all 193 UNESCO member states, this recommendation establishes values (human rights, diversity, environment), principles (proportionality, safety, fairness, transparency, human oversight, responsibility, awareness, governance), and policy areas (data governance, environment, gender, education, health, economy, culture) for AI ethics. It is the first global standard-setting instrument on AI ethics.
Significance for data governance: As the only AI ethics framework adopted by nearly every nation on earth, the UNESCO Recommendation represents the broadest consensus achievable. Its inclusion of environmental concerns and indigenous rights distinguishes it from frameworks focused primarily on Western concerns (Chapters 34, 37).
Where to find it: unesco.org/en/artificial-intelligence/recommendation-ethics
17. NIST AI Risk Management Framework (2023)
Issuing body: U.S. National Institute of Standards and Technology
Date: January 26, 2023
Summary: The NIST AI RMF is a voluntary framework for managing AI risks throughout the AI lifecycle. It is organized around four functions: Govern (establishing and managing AI governance), Map (identifying and understanding AI risks), Measure (analyzing and assessing AI risks), and Manage (prioritizing and responding to risks). The framework emphasizes characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
Significance for data governance: As the US alternative to the EU's regulatory approach, the NIST framework represents a voluntary, risk-management approach to AI governance. It is increasingly referenced in US corporate AI governance programs and may form the basis for future US regulation (Chapters 20, 29).
Where to find it: nist.gov/artificial-intelligence/ai-risk-management-framework
IV. Philosophical and Normative Texts
18. Warren and Brandeis — "The Right to Privacy" (1890)
(See Study 1 in Appendix B for full annotation. Included here as it is both a legal document and a foundational philosophical text.)
19. John Rawls — A Theory of Justice, Chapters 1-3 (1971)
Author: John Rawls
Date: 1971
Summary: Rawls proposed a theory of justice based on two principles chosen from behind a "veil of ignorance" -- a hypothetical position where decision-makers do not know their place in society. The first principle guarantees equal basic liberties. The second principle (the difference principle) holds that social and economic inequalities are just only if they benefit the least advantaged members of society.
Significance for data governance: The veil of ignorance is the most widely used thought experiment in data ethics education (Chapter 6). It provides a method for evaluating data governance decisions from a position of impartiality: if you did not know whether you would be a data subject or a data collector, a wealthy user or a vulnerable population member, what governance rules would you choose? The difference principle provides a standard for evaluating whether data systems that create unequal outcomes can be justified -- they can, but only if the least advantaged benefit.
Where to find it: Rawls, J. (1971). A Theory of Justice. Harvard University Press. Available through academic libraries.
20. Michel Foucault — Discipline and Punish, Part Three: Panopticism (1975)
(See Study 2 in Appendix B for full annotation. Included here as a foundational philosophical text on surveillance and power.)
21. Helen Nissenbaum — "Privacy as Contextual Integrity" (2004)
(See Study 12 in Appendix B for full annotation. Included here as the foundational philosophical text for the contextual integrity framework.)
22. Shoshana Zuboff — The Age of Surveillance Capitalism, Chapter 1: "Home or Exile in the Digital Future" (2019)
(See Study 13 in Appendix B for full annotation. The opening chapter provides the conceptual framework for the entire book and serves as an accessible entry point to Zuboff's argument.)
23. Luciano Floridi — "The Ethics of Artificial Intelligence" (2023)
Author: Luciano Floridi
Date: 2023
Summary: Floridi's work develops the concept of "information ethics" -- an ethical framework that treats informational entities (not just sentient beings) as having moral worth. He argues that the ethical challenges of AI cannot be addressed by simply extending existing ethical frameworks but require a new ethical vocabulary: beneficence (promote well-being), non-maleficence (do no harm), autonomy (preserve human agency), justice (promote fairness), and explicability (operate transparently).
Significance for data governance: Floridi's framework provides philosophical grounding for the responsible AI development principles discussed in Chapter 29 and has influenced the EU's approach to AI ethics through his work with the European Commission's High-Level Expert Group on AI.
Where to find it: Floridi, L. (2023). The Ethics of Artificial Intelligence: Principles, Challenges, and Opportunities. Oxford University Press.
24. Ruha Benjamin — Race After Technology, Introduction: "The New Jim Code" (2019)
(See Study 18 in Appendix B for full annotation. The introduction provides the theoretical framework for the book's analysis of race, technology, and inequality.)
25. Elinor Ostrom — Governing the Commons, Chapter 1: "Reflections on the Commons" (1990)
Author: Elinor Ostrom
Date: 1990
Summary: Ostrom's Nobel Prize-winning work demonstrated that communities can successfully manage shared resources (commons) without either privatization or government regulation, through self-organized governance institutions. She identified eight design principles for successful commons governance: clearly defined boundaries, congruence between rules and local conditions, collective-choice arrangements, monitoring, graduated sanctions, conflict resolution mechanisms, recognition of rights to organize, and nested enterprises for large-scale resources.
Significance for data governance: Ostrom's framework is the theoretical foundation for data cooperatives, data trusts, and data commons discussed in Chapter 39. Her eight principles provide concrete criteria for evaluating whether proposed data governance models are likely to succeed. Her work challenges the assumption that data must be either privately owned or state-regulated, opening a third path of community governance.
Where to find it: Ostrom, E. (1990). Governing the Commons: The Evolution of Institutions for Collective Action. Cambridge University Press.
Using This Guide
These documents vary enormously in length, difficulty, and accessibility. For students beginning their study of data governance, we recommend starting with:
- UDHR Article 12 -- one paragraph, foundational
- OECD Privacy Guidelines -- the eight principles that started it all
- GDPR Articles 1-11 -- the core principles of the most influential modern law
- CARE Principles -- a concise alternative framework
- Rawls veil of ignorance (from secondary sources if the original is too dense)
For advanced students and practitioners:
- EU AI Act -- the full risk classification framework
- Nissenbaum's contextual integrity -- the original article
- Foucault's panopticism chapter -- the theoretical foundation of surveillance studies
- Ostrom's eight principles -- the foundation for participatory governance
All documents listed here are either freely available online or accessible through academic libraries. Primary source engagement is not optional for serious work in data governance -- it is the difference between understanding the field and merely knowing about it.