Case Study: Aotearoa New Zealand's Data Governance Framework

"Data is a taonga (treasure). It carries the stories, the whakapapa (genealogy), and the mana (authority) of the people it comes from. It must be governed with the care and responsibility that any taonga demands." — Maui Hudson, Te Kotahi Research Institute

Overview

Aotearoa New Zealand occupies a distinctive position in the global data governance landscape. A small, geographically isolated nation of five million people, it has developed data governance frameworks that are among the most innovative in the world — not because of advanced technology or regulatory firepower, but because of a foundational commitment: that data governance must reflect the values and authority of the indigenous people whose data it governs.

The Maori concept of data sovereignty — articulated through the work of Te Mana Raraunga (the Maori Data Sovereignty Network) and embedded in national data governance frameworks — represents one of the most developed examples of indigenous data governance in practice. It challenges the assumptions of both Western individual-rights frameworks (like the GDPR) and state-centered models (like China's approach to data governance), proposing instead a relational model in which data is governed through relationships of trust, reciprocity, and collective responsibility.

This case study examines how Aotearoa New Zealand has integrated Maori data sovereignty principles into national data governance, what this integration looks like in practice, and what it offers to the global data governance conversation.

Skills Applied: - Analyzing indigenous data governance as a distinct governance paradigm - Evaluating the integration of indigenous and Western governance frameworks - Connecting relational governance to the participatory models discussed in this chapter - Assessing the transferability of indigenous governance principles to other contexts

Te Mana Raraunga: Maori Data Sovereignty

Origins

Te Mana Raraunga (the Maori Data Sovereignty Network) was established in 2016 by Maori researchers, activists, and community leaders who recognized that data about Maori — health data, education data, justice data, social services data, cultural data — was overwhelmingly collected, stored, and analyzed by government agencies and institutions that did not reflect Maori values, priorities, or governance structures.

The problem was not simply that Maori data was poorly governed. It was that data governance itself embodied a particular worldview — one rooted in individual rights, state authority, and market logic — that was incompatible with the Maori understanding of knowledge, identity, and collective responsibility.

Te Mana Raraunga articulated Maori data sovereignty as: the inherent rights and interests that Maori have in the collection, ownership, and application of Maori data.

Core Principles

Maori data sovereignty rests on several principles that differ fundamentally from Western data governance frameworks:

Whakapapa (genealogy/relationships). Data does not exist in isolation. It is connected to people, communities, histories, and places through relationships that carry obligations. Governing data requires understanding these relationships — not just the data's content but its relational context.

Mana (authority/power). Data about Maori carries the mana of the communities it describes. Those communities have the authority to govern how that data is used — an authority that derives from the Treaty of Waitangi (Te Tiriti o Waitangi), the foundational constitutional document of Aotearoa New Zealand, which established a partnership between the Crown and Maori.

Taonga (treasure/valued possession). Data is a taonga — a treasure that must be treated with respect, care, and governance commensurate with its significance. The concept of taonga carries legal weight in New Zealand law, as the Treaty of Waitangi guarantees Maori "full exclusive and undisturbed possession of their taonga."

Kaitiakitanga (guardianship/stewardship). Those who hold data are not its owners but its guardians. They have a responsibility to manage it in ways that serve the communities from which it derives — a concept closer to the data trust model (fiduciary stewardship) than to the property model (ownership), but grounded in Maori rather than Western legal tradition.

Collective rights. Western data governance frameworks center individual rights — the individual's right to privacy, consent, access, and deletion. Maori data sovereignty centers collective rights — the community's right to govern data about its members, its lands, and its cultural heritage.

National Integration

The Algorithm Charter for Aotearoa New Zealand

In 2020, the New Zealand government published the Algorithm Charter for Aotearoa New Zealand — a set of commitments for the responsible use of algorithms by government agencies. The charter was notable for explicitly incorporating Te Tiriti o Waitangi (Treaty of Waitangi) principles, committing government agencies to:

• Embed a Te Ao Maori (Maori worldview) perspective in the development and use of algorithms
• Maintain transparency with Maori about how algorithms use Maori data
• Ensure that algorithms do not perpetuate bias against Maori
• Partner with Maori in the governance of algorithms that affect Maori communities

This was not merely a symbolic gesture. The charter committed government agencies to concrete actions: consulting with Maori communities before deploying algorithms that use Maori data, publishing algorithmic impact assessments, and establishing ongoing governance relationships with Maori data governance institutions.

The CARE Principles

Te Mana Raraunga played a leading role in developing the CARE Principles for Indigenous Data Governance, adopted internationally in 2019:

• Collective Benefit — Data governance should benefit the collective interests of indigenous peoples
• Authority to Control — Indigenous peoples have the right to govern the collection, ownership, and application of their data
• Responsibility — Those who work with indigenous data have a responsibility to demonstrate how data are used to support indigenous peoples' self-determination
• Ethics — Indigenous peoples' rights and well-being should be the primary concern at all stages of the data lifecycle

The CARE Principles complement (and in some ways challenge) the FAIR Principles (Findable, Accessible, Interoperable, Reusable) that dominate mainstream open data governance. While FAIR emphasizes making data maximally accessible for research and innovation, CARE emphasizes that accessibility must be governed by the communities from whom data derives. Data can be FAIR and still violate CARE — if it is findable and accessible but used in ways that harm the communities it describes.

Stats NZ and the Integrated Data Infrastructure

Stats NZ (Statistics New Zealand) manages the Integrated Data Infrastructure (IDI) — a large database containing linked administrative data from multiple government agencies, used for research and policy analysis. The IDI contains data on virtually every person in New Zealand, including health, education, justice, and social services data.

The governance of the IDI has increasingly incorporated Maori data sovereignty principles:

• Maori advisory groups participate in decisions about which research projects can access Maori data in the IDI
• Protocols for disaggregation govern when and how data about Maori can be separated from general population data — recognizing that disaggregated data about a small population can create identification and harm risks
• Access restrictions limit the use of Maori data for research that does not serve Maori community interests
• Capacity building programs support Maori researchers in accessing and analyzing data about their own communities

What Aotearoa New Zealand Demonstrates

Data Governance as Relationship

The most fundamental lesson from Aotearoa New Zealand is that data governance can be grounded in relationships rather than rules. Western data governance frameworks are primarily rule-based: they define rights, obligations, and prohibitions. Maori data governance is primarily relational: it defines relationships of trust, reciprocity, and accountability between data holders and data communities.

This relational approach has practical implications. A rule-based framework asks: "Does this data use comply with the regulation?" A relational framework asks: "Does this data use serve the relationship between the data holder and the community the data comes from?"

The relational approach is not merely philosophical. It produces different governance outcomes. When Stats NZ consulted Maori advisory groups about a proposed research project using Maori health data, the advisory group did not simply check whether the project met regulatory requirements. They asked: Will this research benefit Maori communities? Will Maori researchers be involved? Will findings be shared with Maori communities before publication? Will the data be used to challenge deficit narratives about Maori, or will it reinforce them?

These questions go beyond compliance to accountability. And accountability, in the relational model, is maintained not through enforcement mechanisms but through ongoing relationships — relationships that can be strengthened or withdrawn based on how data holders behave.

Challenging Universal Frameworks

Aotearoa New Zealand's experience challenges the assumption — implicit in the GDPR and similar frameworks — that data governance can be universal. The GDPR assumes that data governance is about individual rights exercised against data controllers. Maori data sovereignty assumes that data governance is about collective rights exercised through relational accountability. Both are legitimate governance logics, but they start from different premises and arrive at different governance structures.

This does not mean that universal frameworks are impossible. It means they must be flexible enough to accommodate fundamentally different governance traditions — not as exceptions to the rule but as alternative expressions of the same underlying commitment to governing data responsibly.

Discussion Questions

1. Is the relational governance model described in this case study transferable to non-indigenous contexts? Could workplaces, neighborhoods, or online communities adopt relational data governance? What would it look like?

2. The CARE Principles and the FAIR Principles can conflict — a dataset can be maximally "findable and accessible" while violating indigenous communities' authority to control how it is used. How should this conflict be resolved? Should CARE override FAIR, or should they be balanced?

3. Eli observed: "Maori data sovereignty is about the same thing my community is fighting for — the right to govern data about ourselves. The language is different, but the principle is the same." Is this parallel valid? What are the similarities and differences between Maori data sovereignty and Eli's Community Data Governance Charter?

4. The Algorithm Charter commits government agencies to embed Te Ao Maori perspectives in algorithm development. How would you operationalize this commitment? What does it mean in practice for a government data scientist building a predictive model?

5. Consider the GovernanceSimulator. Which model — cooperative, trust, commons, or hybrid — best captures the Maori data sovereignty approach? Or does the Maori approach represent a fifth model that the simulator does not capture?

Further Investigation

• Read Te Mana Raraunga's Charter and publications (available at temanararaunga.maori.nz).
• Research the CARE Principles for Indigenous Data Governance and compare them with the FAIR Principles.
• Examine how other indigenous communities (e.g., First Nations in Canada, Aboriginal Australians, Native Americans) are developing data sovereignty frameworks, and compare with the Aotearoa New Zealand approach.