How GDPR Fails Indigenous Data: Sámi Scholars Offer a Fix

Europe’s flagship data protection law, the General Data Protection Regulation, is widely celebrated as the world’s most robust framework for governing how personal information is collected, reused, and stored. But according to a new Perspective published in PLOS Medicine, the GDPR has a blind spot with far-reaching consequences: it protects individuals, not peoples. For Indigenous communities such as the Sámi, whose health data carries collective cultural and political weight, that gap leaves fundamental rights exposed. Researchers Susanna Ragnhild Andersdatter Siri of UiT The Arctic University of Norway, Christina Storm Mienna and Per Axelsson of Umeå University argue that health research involving Sámi populations requires a governance layer the GDPR simply does not provide, and they map out how existing Sámi ethical guidelines can fill it.

The core problem is one of legal architecture. The GDPR treats data as a matter of individual privacy, built on personal consent and the rights of individual data subjects. Indigenous self-determination, however, includes the authority of a people to govern data about that people as a collective. Open science practices guided by the FAIR principles, which demand that data be Findable, Accessible, Interoperable, and Reusable, can actively collide with this authority, since unlimited openness and reuse of Indigenous data can violate collective rights. In response, the global Indigenous data sovereignty movement developed the CARE principles, Collective Benefit, Authority to Control, Responsibility, and Ethics, designed to complement FAIR by insisting that data remains embedded in the social, cultural, and legal contexts of the peoples from whom it originates.

The Sámi are the Indigenous people of Sápmi, a vast region spanning northern Norway, Sweden, Finland, and the Kola Peninsula in Russia, with distinct languages, traditions, and cultural practices. Country-specific Sámi Parliaments in Norway, Sweden, and Finland serve as the highest governing bodies for the Sámi, and Truth and Reconciliation Commissions in Norway and Finland, along with a Truth Commission in Sweden, are currently documenting the historical harms of assimilation policies while proposing measures to strengthen Sámi self-determination. Against this backdrop, the question of who controls health research data about Sámi communities is not abstract. It sits at the intersection of historical injustice, contemporary law, and the future of biomedical science.

Norway currently offers the strongest formal protection. Under Norwegian rules, collecting or using Sámi data for health research, with limited exceptions, requires both individual and collective Free Prior Informed Consent, known as FPIC. Collective consent is triggered when research involves the Sámi as a group or covers regions where Sámi people form a significant share of the population. In 2020, the Norwegian Sámi Parliament appointed an Ethical Committee for Sámi Health Research to review applications and grant that collective consent, ensuring projects proceed in a culturally safe manner and in genuine partnership with Sámi communities. The guidelines are grounded in Sámi core values of respect, responsibility, partnership, and self-determination, with an explicit aim of collective benefit for present and future generations, and they affirm that Sámi participants hold rights to control and access research data held in registries and biobanks.

Sweden and Finland present a sharper contrast in enforcement. Sweden lacks Sámi ethical research guidelines for health and other disciplines, although the Swedish Research Council incorporated the CARE principles into its Good Research Practice in 2024, an acknowledgment that stops short of concrete guidance. In the absence of national rules, researchers increasingly turn to the guidelines published in 2019 by Sámiid Riikkasearvi, an interest organisation representing Sámi members of reindeer herding communities and Sámi associations. The SSR policy makes individual and collective FPIC mandatory, requires a formal agreement covering current and future data management, and even offers researchers a preparatory course in cultural sensitivity. Finland’s 2024 Sámi ethical guidelines are multidisciplinary and applicable across Sápmi where local guidelines are missing, requiring researchers to agree with communities on what data is collected, how it is processed, reused, and stored, who owns it, and whether it is shared, all through self-regulation, since no review board oversees implementation.

The SAMINOR study, a population-based survey of health and living conditions in regions with both Sámi and non-Sámi populations, demonstrates what operational Sámi data governance looks like in practice. The university acts as data controller with dedicated infrastructure and management units, and SAMINOR data are available from open platforms, but the metadata flag their sensitive nature and the requirement for Sámi collective consent. Applications are evaluated by the project board, which verifies that applicants know Sámi culture, language, and society, that collective consent is secured, and that the project fits the study’s aims and has ethical approval. Approved applicants receive a time-restricted contract, and handling sensitive individual data requires a dynamic Data Protection Investigation Assessment describing re-identification and anonymisation safeguards. Because universities and funders often mandate FAIR compliance, a Data Management Plan and either a Joint Controller Agreement or Data Processing Agreement are also needed, depending on the depth of collaboration.

At the transnational level, the Saami Council, a cross-border Sámi non-governmental organisation, adopted the Sámi Ownership and Data Access, or SODA, principles in 2024. Building on CARE, SODA aims to strengthen Sámi ownership, control, and access to data in support of Sámi dignity, wellbeing, and autonomy. Its inclusion of ownership echoes the OCAP principles, Ownership, Control, Access and Possession, developed by First Nations in Canada in 1998. This creates friction with European research institutions, because universities are typically data controllers under the GDPR and assert ownership of research data, a stance that directly conflicts with SODA’s conception of collective ownership.

Examined against the CARE framework, the Sámi guidelines show both strengths and gaps. All of them emphasise the use of Sámi languages wherever possible across every stage of research, from data collection to scientific writing. The Finnish guidelines explicitly address capacity-building and recommend storing Sámi data in Sámi museums, institutions, or archives, with written agreements on data collection, processing, reuse, storage, ownership, and sharing. Collective Benefit is embedded in the Norwegian, Finnish, and SSR requirements for equal partnership and risk assessment covering harms and benefits for future generations. Authority to Control is most explicit in the Finnish and SODA guidelines. Responsibility, however, is not directly named outside SODA, although all guidelines require researchers to acquire knowledge of Sámi health, reindeer herding, values, traditions, history, traditional knowledge, language, social relations, and culture before engagement begins.

The authors’ central recommendation is to close the enforcement gap. Outside the ethics review board in northern Norway, there is currently no formal mechanism within institutions or ethical review processes in Sápmi ensuring that collective consent is actually obtained for research involving Sámi people, leaving the question largely to the discretion of individual researchers. Their Perspective integrates the CARE principles with Sámi ethical guidelines and shows how each requirement can be addressed within the GDPR framework, using the existing instruments of data management plans, data processing agreements, and joint controller agreements to encode collective rights into the paperwork universities already produce.

The broader stakes extend well beyond Sápmi. As research data infrastructures globalise and open science norms spread, Indigenous peoples everywhere face the same structural dilemma: individual consent regimes that ignore collective interests, and FAIR mandates that ignore data sovereignty. The Sámi case, with its patchwork of national rules, a working model in SAMINOR, and new transnational SODA principles, offers a concrete template for how CARE can be operationalised inside existing legal systems. For health researchers, the message is increasingly unambiguous: respecting the collective rights of the peoples whose data makes their science possible is not a bureaucratic hurdle, but a condition of ethical research in the twenty-first century.

Subject of Research: Indigenous data governance and collective consent in Sámi health research ethics

Article Title: Collective interests, health research ethics and data governance for Indigenous Sámi populations

Article References: Siri, S. R. A., Mienna, C. S., & Axelsson, P. (2026). Collective interests, health research ethics and data governance for Indigenous Sámi populations. PLOS Medicine, 23(9), e1005250. https://doi.org/10.1371/journal.pmed.1005250

Image Credits: AI Generated

DOI: 10.1371/journal.pmed.1005250

Keywords: Sámi, Indigenous data sovereignty, GDPR, CARE principles, FAIR principles, data governance, health research ethics, collective consent, SODA principles, SAMINOR study, Sápmi, PLOS Medicine