The Global Risks Forum (GRF)
GRF · AI and Digital Governance
Situational awarenessEvents, outlooks and readiness for those who decide
Digital systems collect, infer and act on personal information at a scale that tests the rights to privacy, data protection, non-discrimination and free expression. Rights depend on enforceable law, independent authorities and remedies people can use. This page sets out how digital rights are protected and eroded, the records that show enforcement, and the institutions that decide.
Rights and public digital infrastructure. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Systems infer health, beliefs and relationships from data people did not knowingly provide. Consent-based models struggle when the use is invisible and the inference is new.
Data collected for one purpose are reused for others, including by public authorities. Purpose limitation and legal bases slow this only where authorities enforce them.
Facial recognition, location tracking and bulk data access give states and firms new powers. Necessity and proportionality tests and independent authorization decide where limits fall.
Complaints to data protection authorities and courts can take years, and cross-border cases depend on cooperation between authorities. Slow remedies weaken deterrence.
The instruments, mandates, actors and accountability arrangements a policymaker, diplomat or development agency works with, citing the agreements that set them. Structures follow the frameworks named. Any state or progress drawn is illustrative, not a record.
The kinds of instrument available on digital rights and privacy, by level of government and cooperation.
| Instrument type | Local | National | Regional | Global |
|---|---|---|---|---|
| Regulatory | Zoning, building codes | Laws, standards, licensing | Harmonised rules | Conventions and treaties |
| Economic | Local levies, grants | Budget lines, taxes, insurance schemes | Risk pools, regional funds | Financing mechanisms |
| Information | Local warnings | Disclosure, early warning, statistics | Data sharing arrangements | Global monitoring and reporting |
| Institutional | Local committees | Lead agencies, coordination councils | Regional bodies and secretariats | Multilateral mandates |
| Cooperative | Community agreements | Partnership compacts | Memoranda and joint programmes | Agreements and joint commitments |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Comprehensive data protection law in force | yes or no | on change | UNCTAD data protection tracker | Published statistics |
| Independent data protection authority | yes or no, with budget | annual | Authority reports | Published statistics |
| Complaints received by data protection authorities | count | annual | Authority annual reports | Published statistics |
| Fines imposed for data protection breaches | count and currency | annual | Authority enforcement records | Published statistics |
| Government requests for user data | count by country | half-yearly | Platform transparency reports | REPORTED |
| Internet shutdowns recorded | count and duration in hours | annual | Civil society monitoring | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| UNCTAD data protection and privacy legislation worldwide | Status of data protection law by country | Free, UN terms |
| European Data Protection Board and national authority annual reports | Complaints, investigations and enforcement | Public, EU and national reuse terms |
| Access Now KeepItOn shutdown data | Documented internet shutdowns by country | Free to read, terms to check |
| Platform transparency reports | Government data and removal requests | Free to read, terms per platform |
| UN Special Rapporteur on the right to privacy reports | Analysis of privacy in the digital age | Free, UN terms |
AI and Digital Governance prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Legislatures | What data protection and surveillance law requires | Comparative laws and enforcement records |
| Data protection authorities | Which complaints and investigations to pursue and what sanctions to impose | Complaint data, case law and cross-border cooperation records |
| Courts | Whether processing or surveillance breached rights | Records presented by parties; the page serves context only |
| Platforms and data controllers | How to respond to data requests and design for privacy | Legal requirements and transparency practice |
Rights effects depend less on technology than on design choices and governance. The same identity system can be built to minimize data and protect against tracking, or to centralize data and enable it. Why now: digital identity and data-sharing systems are expanding under the banner of digital public infrastructure, endorsed in the Global Digital Compact (2024), while rights safeguards vary widely. The platform is designed to convene authorities and rights specialists on safeguards, without assessing any system.
Digital-only services can exclude people who cannot use them, turning convenience into a barrier.
Linking records across services creates detailed profiles and risks function creep beyond the original purpose.
Centralized systems concentrate personal data, so a single breach can expose whole populations.
Identifying which rights a system affects and how. Limits: rights interact and can conflict.
Data minimization, selective disclosure and decentralized architectures, studied under digital identity and public digital systems. Limits: may add cost or complexity.
Assessing risks to individuals before processing begins. Limits: quality varies widely.
Supervision by data protection authorities and civil society scrutiny. Limits: authorities are often under-resourced.
Nexus Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.