_Note:_ Data on “regulatory quality” and “voice and accountability” are from the world governance indicators. The regulatory quality score reflects perceptions of the ability of the government to formulate and implement sound policies and regulations that permit and promote private sector development. This indicator has a correlation of 0.45 with the safeguard score and 0.60 with the enabler score. The voice and accountability score reflects perceptions of the extent to which a country’s citizens are able to participate in selecting their government, as well as freedom of expression, freedom of association, and a free media. This indicator has a correlation coefficient of 0.45 with the safeguard score and 0.50 with the enabler score.

The first point to note is that the safeguard and enablers scores show quite a high correlation with the wider regulatory quality index from the World Governance Indicators (figure 12a). This makes sense as countries with a relatively strong regulatory culture tend to do well on regulation across a wide range of sectors, including data. The regulatory quality indicator reflects the public’s trust in the government’s ability to formulate and implement sound policies and regulations that permit and promote private sector development. Moreover, more regulatory good practices in enablers are associated with greater confidence in various government functions and entities, including public services, the civil service and its independence from political pressures, policy formulation and implementation and the government’s commitment to policies. This could be related in particular to the dimension of public intent data under the enabler pillar, which aims to facilitate the use/reuse of public data to improve government efficiency.

Furthermore, the author finds that more robust regulatory frameworks for data governance are associated with countries where citizens feeling more empowered in terms of both voice and accountability, as reflected in their perceived ability to participate in selecting their government, along with their freedom of expression, freedom of association, and a free media (figure 12b).

Though no causal relations can be drawn from these correlations, the high level of positive associations indicate that the regulatory framework for data does not exist in isolation from a country’s wider governance framework and tends to do better in country contexts where citizen perceptions indicate relatively high levels of trust in the regulatory environment. One additional caveat is that the World Governance Indicators measure public trust in governance environment in general, rather than direct measurements of public trust in data economy.

# **5. COVID-19-specific provisions**

The ongoing COVID-19 pandemic makes a robust data governance environment more salient than ever, as many governments have been exploring data-driven options to halt the spread of the virus. For instance, “contact tracing” mechanisms hinge upon the collection and processing of personal data by public authorities—and private actors on their behalf such as app developers. Data protection and cybersecurity concerns regarding such initiatives are rapidly rising. This calls for transparent and consistent rules and regulations on enabling data usage for public health purposes while safeguarding individual rights.

As the pandemic unfolded during the implementation of this diagnostic, the team examined the adoption of COVID-19 emergency regulations in the surveyed countries to assess whether emergency regulations led to the implementation of additional data protection safeguards or the suppression of the existing ones. Overall, 15 countries in the diagnostic sample adopted emergency regulations that had data protection implications. Nine of them had a preexisting data protection law (including Armenia, Côte d’Ivoire, Israel, Korea, Madagascar, Mauritius, Morocco, Peru, and the United Kingdom) and the remaining six did not (Brazil, China, Indonesia, the Islamic Republic of Iran, Jordan, and Papua New Guinea).

For countries that had a pre-existing robust regulatory framework for personal data protection, the legislation usually contained provisions specifying legal grounds or conditions enabling public authorities to collect personal data to preserve public safety and permitting private actors to do so for the public interest.

27