Csaba Csáki
email: csaki.csaba@uni-corvinus.hu

Towards open data quality improvements based on root cause analysis of quality issues

Keywords: open data, open data reuse, data quality framework, open data quality, public procurement, data cleansing, root cause analysis

Commercial reuse of open government data in value added services has gained a lot of interest both as practice and as a research topic over the last few years. However, utilizing open data without proper understanding of potential quality issues carries the risk of undermining the value of the service that relies on public sector information. Instead of establishing a data quality assessment framework this research considers a review of typical open data quality issues and intends to connect them to the causes leading to these various data problems. Open data specific problems are concluded from a case study and then theoretical and empirical arguments are used to connect them to root causes emerging from the peculiarities of the public sector data management process. This way both practitioners could be more conscious about appropriate cleansing methods and participants shaping the data management process could aim at eliminating root causes of data quality issues.

Introduction

While the idea of open government data (OGD) has been around for some time, every few years there is a rejuvenated scientific interest in the topic. The motivation had been changing from promoting accountability and transparency to supporting e-Government to the push for open government. The latest trend is based on economic interest, namely the idea of innovative, commercial reuse of public sector information (PSI) [START_REF] Jetzek | Data-driven innovation through open government data[END_REF]. The changing focus came with changing research goals and shifts in research objectives. One of the main conditions of successful reuse is quality data [START_REF] Dawes | Information Strategies for Open Government: Challenges and Prospects for Deriving Public Value from Government Transparency[END_REF]. It is no surprise, therefore, that over the years a lot of scientific and on-the-field efforts have been reported to address the issue. One well-quoted are deals with the question of provenance [START_REF] Pignotti | Provenance Principles for Open Data[END_REF] with the leading idea covering the maturity level of linked open data published [START_REF] Berners-Lee | Linked Data[END_REF]. However, the shortcoming of the five star model is that it focuses almost exclusively on the area of linked open data, thus only addresses the related subset of quality features (such as traceability, linking standards, and machine readability). There are ample results that offer frameworks dealing with a wider range of quality dimensionsboth in general [START_REF] Wormell | Information quality: definitions and dimensions[END_REF][START_REF] Naumann | Assessment methods for information quality criteria[END_REF] or focusing on OGD in particular [START_REF] Erickson | Open Government Data: A Data Analytics Approach[END_REF] -, but these approaches mostly cater for the assessment of datasets [START_REF] Batini | Methodologies for Data Quality Assessment and Improvement[END_REF][START_REF] Vetrò | Open data quality measurement framework: Definition and application to Open Government Data[END_REF][START_REF] Zaveri | Quality assessment for linked data: A survey[END_REF]. While the ability to judge the quality of a given data set is useful, typically there are no guidelines how to address these issuesneither how to eliminate them on the producer side, nor what to do about them before (secondary) utilization. While considering the outcome could improve certain aspects of structuring and storing data, existing frameworks are unable to consider the bigger picture of policies and regulations or the organizational context [START_REF] Zuiderwijk | Barriers and development directions for the publication and usage of open data: A socio-technical view[END_REF]. So, although there are ample proposals about organizational preparation or guidelines considering technology, even these best practices do not seem to be enough regarding quality of the content [START_REF] Zuiderwijk | The negative effects of open government data -investigating the dark side of open data[END_REF]. The assumption here is that guidelines related to various aspects of quality are no help mainly because they do not focus (enough) on the root causes of ODG quality issues. Thus while there is considerable research efforts addressing certain specific areas related to producing good quality open data, relatively less attention is paid to why data quality issues are still present despite the best efforts and available experience.

The research reported here was focusing mainly on the latter problem and its objective was to understand the root causes of quality issues affecting the publication of PSI intended for reuse. This paper is organized as follows: the next section reviews frameworks of open data quality and considers characteristics of the public sector as context. The methodology section raises research questions and presents the methodology followed. Then the attention is turned to a review of public sector data quality issues through a case study. This is followed by a discussion of potential root causes of issues identified along with their generalization. The paper closes with conclusions and the usual recommendations of future research ideas.

2

Open government data and related quality considerations

The push for open government data

The term open data as a popular concept was first used in 2006 when the Open Knowledge Foundation (OKF) has announced its Open Knowledge Definition [START_REF]OKF -Open Knowledge Foundation[END_REF][START_REF] Davies | Open Data Barometer[END_REF]. This was a general call for opening up scientific and other data for further use or reuse. There are other forces behind publishing public sector data, however, some of which are rooted in early civil society movements, albeit the dawn of the Internet and related technologies have also played a major role in an increased interest (by providing new possibilities). Meeting integrity and accountability goals in democratic societies is anchored by transparency that in turn assumes a requisite level of openness whereby non-government actors (the public) have mechanisms to know what governmental actors are doing [START_REF]The Oxford Handbook of Public Accountability[END_REF]. Thus, data about governmental behavior may be used to hold actors of the public sphere to account [START_REF] Parks | The open government principle: applying the right to know under the constitution[END_REF]. Over time the goal of promoting accountability and transparency has been overtaken by the motivation to use technology in support of e-Government initiatives [START_REF] Grönlund | Introducing e-gov: history, definitions, and issues[END_REF], and later by the push for open government [START_REF] Yu | The new ambiguity of open government[END_REF] also fueled mostly by advances in technology. In the former technology was an enabler of open data, while in the context of open government open data became the main piece of the puzzle as an enabler of advanced participative democracy [START_REF] Tygel | Contributions of Paulo Freire for a critical data literacy[END_REF]. However, the latest push for publishing data generated or controlled by public actors considers commercial utilization of such data. Indeed, reusing public sector information in innovative value added services is turning into a serious market [START_REF] Network | How Open Data Can Help Achieve the G20 Growth Target[END_REF].

Since more and more data and information generated in various public policy domains are being captured, digitized, and stored, it would be difficult (at least in democratic regimes) to argue for completely shielding such digital records from public scrutiny on the one hand or potential utilization on the other. While users of public or open government data are assumed to be able to utilize them with ease, the fact is that open data is not free of quality issues [START_REF] Bertot | Big data, open government and e-government[END_REF]. The higher demand for more open data does not necessarily come with increased quality. Assessing the quality of data in general or open data in particular is not a straightforward exercise.

Information quality dimensions

There are different frameworks allowing for discussion over data or information quality (DQ/IQ) and within which DQ/IQ may be assessed (for simplification we do not enter into a theoretical discussion about the difference of data and information, we simply regard information as data in use, as that fits the problem at hand). The technical view associates quality with the accuracy of the data in products such as databases looking at timeliness of update, system reliability, system accessibility, system usability and system security [START_REF] Levitin | Quality dimensions of a conceptual view[END_REF]. Another, the machine readability approach [START_REF] Zaveri | Quality assessment for linked data: A survey[END_REF] is concerned with linking, finding, relating and reading data typically using automated processes, and characteristics usually considered include number of formats, traceability, automated tracking, use of standards, or provenance. Perhaps the most commonly used simple definition of user side information quality interprets the term as "fit-for-use" [START_REF] Wang | Beyond accuracy: What data quality means to data consumers[END_REF]. However, IQ defined this way remains a relative construct whereby data considered appropriate for a given use may not display acceptable attributes in another setting [START_REF] Tayi | Examining data quality[END_REF]. Furthermore, fit-for-use does not immediately allow for ready measurability and it requires additional detail in order to be operationalized [START_REF] Frank | User centred methods for measuring the quality of open data[END_REF].

When it comes to actually assessing DQ/IQ, it is typically related to "a set of 'dimensions' that are usually defined as quality properties or characteristics" ([22] p. 2). However, this approach has led to a proliferation of features and dimensionsas various models proposed distinguished sixteen [START_REF] Kahn | A Model for Delivering Quality Information as Product and Services[END_REF], twenty-eight [START_REF] Dedeke | A Conceptual Framework for Developing Quality Measures for Information Systems[END_REF], or even thirtytwo [START_REF] Van Zeist | Specifying software quality with the extended ISO model[END_REF] different dimensionsalthough the most important dimensions appear to overlap. It is possible to organize these features along a natural timeline of the steps normally taken when exploring new data: Awareness and availability, Accessibility, Readability, Technical qualities of the data, Content and structure, Traceability, Usability, Fit-for-purposeeach in turn including several sub-features (depending on the framework). However, the quality of the data as stored, accessed and manipulated can substantially differ from the quality of the information that the data contains or that the data can offer in terms of information gleaned from it.

Some special characteristics of the public sector

As an important step towards understanding why quality issues may happen in public context, it is worthwhile to look at a few fundamental characteristics of the public sphere. One essential difference between the private and the public sector is that public policies are created based on public interest while private corporate goals serve private interest. Public value cannot be defined by commercial categories only, and governments thus have responsibilities related to fulfilling non-commercial goals which in turn increases costs [START_REF] Erridge | Public Procurement and Social Policy in Northern Ireland: The Unemployment Pilot Project[END_REF]. In addition, governmental choices have lasting, long-reaching effects. Indeed, the policy making function creates theformal and legalenvironment within which society and economy operates. [START_REF] Self | Government by the Market?[END_REF] points out that the notion of public interest does require some form of sympathy with the needs of others which, therefore, may not be reconciled with the market notion of maximizing economic opportunities and personal wealth.

Regarding data management, governmental functions are guided by laws and regulations influencing related processes, tasks, roles, and responsibilities. Furthermore, there are specific regulations controlling the release of data (typically in the context of the so called 'right to information' law). Thus, utilizing data from public websites presumes some level of legitimacy on the part of the immediate publisher. This setting has an impact on the way of producing and collecting data as well as the way open data is generated from the data stored. Information collection is usually done through forms defined by the corresponding law such as a relevant act. All in all, these result in a data lifecycle that is different from its counterpart in the private sector: the data does not connect, rather open data as published sharply separates the supplier from the consumer. In addition, changing any part of the data producing side would require changes in the corresponding regulatory component -which might take time (due to the formal processes involved).

Open government data quality frameworks

Despite the difference in context, open data specific 'quality frameworks' often offer similar categorizations. One ODQ stream considers technical standards and abilities as well as processes and outcomes of producing and managing datasets, but also considers the timeliness of data (i.e. whether it is out-of-date). Another stream is centered on the availability and accessibility of various types of data or data in certain categories, while also measures whether intended audiences are aware of the availability of relevant datasets and if data is easy to find [START_REF] Davies | Open Data Barometer[END_REF]. Yet another set of frameworks is concerned about specific sectors and take into account the content of the datasets. Finally, it is customary to ask about the value of open data, which, in general terms considers the needs of end users [START_REF] Frank | User centred methods for measuring the quality of open data[END_REF]. However, irrespective of the approach, there is a tendency here too to favor characteristics that are measurable. The current disposition of open data quality characteristics is aptly demonstrated by [START_REF] Zaveri | Quality assessment for linked data: A survey[END_REF] which, in pursuit of the measurability of ODQ, define and operationalize 68 metrics along 6 dimensions. Most of these characteristics do not differ from 'regular' data quality dimensions, although there are some additional concerns related to access to and freshness of dataas well as to potential fees charged. However, irrespective of the assessment methods, there are still typical problems with public data made available. Therefore, the objective of this research was to understand and map the root causes why (and where) certain

types of public open data quality issues and errors happenwith the ultimate intent to make recommendations what to do about them.

Methodology: Theoretical arguments with a case study

Under the above objective the following research questions are proposed: 1) What is the status of the quality of Open Government Data from the point of view of 'content'? 2) What are the main reasons (root causes) behind OD content issues in public context? 3) What to do about improving content quality of OGD? This paper focuses on the second question, using the first as supportbut would not have the room to address the last question here.

To demonstrate typical content errors in public sector data sets along with their causes a case study methodology was designed [START_REF] Yin | Case study research. Design and methods[END_REF]. To explore the reasons behind the quality issues of open government data the research plan contained the following steps: 1) review typical data quality issues (that impact reuse); 2) illustrate them through examples from the case; 3) use the case study to identify potential causes of errors; 4) propose a generalization of those root causes.

This was an intrinsic [START_REF] Stake | Qualitative case studies[END_REF], single case [START_REF] Eisenhardt | Theory building from cases: Opportunities and challenges[END_REF] research study, where the exploration of the case (i.e. data collection) involved a) investigating a complex open data set; b) reading documents describing the data set (including its structure and known issues); and c) email communication with a representative of the issuer of the data for further clarification. To establish root causes of issues presented in the case theoretical arguments from relevant literature were applied. Finally, in the last step the generalization was based on the understanding of the immediate context and process of producing open government data (concluded from the literature review).

The data set used (as the case) was the public procurement (PP) open data of the European Union (EU), selected based on its special characteristics regarding size, complexity, regulatory context and multiple stakeholders. Counterarguments may be that the EU PP legal context is complex and further burdened by a multinational setting. However, while understanding the depth of the case might be a challenge for some readers outside PP, the descriptive power of the case well offsets the efforts required. As part of its broader e-Government initiative the European Commission (EC) has been an advocate of the open data movement for some time. "The European Data Portal" (https://www.europeandataportal.eu/) offers public sector information originated in the member states and portal data may also be repurposed. Through the Directive 2003/98/EC the EC has set up the legal framework to allow the reuse of public sector information. One key component of the EU Open Data initiative (https://ec.europa.eu/digital-single-market/en/open-dat) is the Tenders Electronic Daily dataset comprised of public procurement data of the twenty-eight member states. While the data is accessible as part of a daily journal (the online version of "Supplement 32 to the Official Journal of the European Union"), there is an annual release of summarized historical data in CSV format (dating back to 2006 at https://data.europa.eu/euodp/en/data/dataset/ted-csv). Data covers purchases of public procurement that fall above given threshold amounts stipulated in EU regulations for procurement. Other than EU members, affiliated countries also publish tender and award notices in the TED Journal to gain access to the EU market. Data in the Journal are collected from standardized public procurement forms as required by the corresponding EU Directives (2014/17 and /18) and their Annexes. The data originally recorded store information captured from the contract notices reported in standard forms #2, #4, #5, or #17. These forms announce information concerning a future purchase (i.e. call for tender). Another set of data covers contract award notice information on the outcomes of the procurement obtained from standard forms #3, #6 or #18. Data is entered through online versions of these forms, one notice at a time. The open datasets published annually come with a codebook [START_REF] Ted | TED Processed Database: Notes & Codebook[END_REF] describing the fields in the files made available. In addition, for advanced users of the CSV datasets a user guide is available [START_REF] Ted | TED Advanced Notes[END_REF] providing information about known issues and difficulties.

The TED open data is very complex because the CSV data files have three levels of procurement information embedded: a) contract notices (CN); b) contract award notices (CAN); and c) contract awards (CA) (the last two published in one file, of course). While the process of public procurement is inherently complicated, for now it should suffice to state that one and occasionally two CNs lead to one CAN (this is because a CN may have a preliminary notice with a separate CN ID), but one CAN may lead to one or more CAs associated with it (as a single call may have several parts or lots with each leading to a separate contract being awarded under the same CAN ID but individual award CA IDs). Issuers of notices are called "contracting authority". Each annual dataset is published in CSV format using UTF-8 coding. All data files were (first) downloaded January 17, 2017. There were two types of datanotices and awardsfrom 2009 to 2015 (the first three years had to be omitted), and the size of the sixteen files was over 2 GB (each ranging from 130 to 280 MB). MS Excel and MS Access (both from Office 2010 on Win7 OS) have been utilized to open and investigate the structure and content of the files. In addition, SPSS (v22.2) and Oracle Database (11g r. 11.2.0.4) were also used to investigate data quality.

Typical quality issues in the caseand their root causes

While access related features (Availability, Accessibility and Readability as well as Traceability) are important as a starting point for OD utilization, they are less relevant in our context of actual reuse. On the other hand, content related characteristics (such as Technical qualities, Content and structure, as well as Fit-for-purpose) are main concerns that immediately influence usability. According to literature, data content errors are typically organized into four categories (based on [START_REF] Tayi | Examining data quality[END_REF]): Missing data (missing field or missing value); Duplication (physical duplication or logical duplication); Error with meaning or interpretation (syntactical error, out of bounds, format error, data does not make sense in context); and Inconsistency (inconsistency between data fields, data tables, databases or outside sources).

Case problem: Successful opening of the file(s) is followed by the investigation of the Technical qualities of the data. Due to the nature of CSV, the original dataset as published does not carry datatypes. The typical result is formatting errors. Even in Excelthe tool users would use to open CSV -, fields containing data that look like (calendar) date would indeed be interpreted as calendar date, resulting in automatic corrections, which are often faulty (e.g. 2004 may become 2004 January 1).

Root cause analysis: These issues are related to the process of generating open data and the publishing format being used. For example, a formatting error may be the result of inadequate consideration and lack of flexibility in data formats (especially in international, multi-language context). Also, lack of data type information in simple standard formats may lead to misinterpretation by more sophisticated tools.

Case problem: Since EU members may use any of the official languages for their PP announcements, basic UTF-8 reading with a default language (such as English) resulted in scrambled characters for languages like Greek, Hungarian, Swedish, etc. Interestingly, each tool used had its own way of dealing with this problem: SPSS, and Oracle could only read setting of one language or another, MS Access had an "all" setting for UTF-8 font mixing, allowing for text from every EU language to be displayed properly, while MS Excel required the "import" function for proper UTF-8.

Root cause analysis: It appears that CSV does not carry language information, but UTF-8 requires a so called BOM character for font mixing.

Case problem: The case data files had a lot of text fields, some of them are quite longand for most tools the length of textual data is an issue: some truncate lines while others simply drop whole records with fields of inappropriate sizes. So, as the result of the above, the actual data as opened may have missing fields, missing content, or inappropriate content or even inconsistencies within the dataset.

Root cause analysis: The loss of information is due to technical issues such as the lack of data type information or the use of long text in one field.

Case problem: The most important step (before any use), is the checking of content and its validity. The outcome of a procedure (CN) may be a successful award (CAN with one or more CA), modification, cancellation, or cancellation with a new call. Unfortunately, cancellation and modification information are not always recorded properly (cancellation or modification flag is missing from the form) leading to either missing information or duplicate records. As a result, the CSV output generated had missing flags and duplicate CN IDs.

Root cause analysis: The cause of such problems is rooted in the mode of entering data into the forms, especially online: a) the forms themselves could be faulty (such as having missing fields); b) there could be human error (using the wrong form or lack of knowledge about how to fill out the form) on part of the contracting authority personnel; and c) these may be combined with inappropriate sanity check or lack thereof. In addition, d) the algorithm generating the OD output file may be misled by the inappropriate information.

Case problem: Another form of information loss happened when there were multiple values in one field and most tools could not separate them. This happened in two ways: a) when there were two winners to be announced, instead of two separate award (CA) IDs the name of both winners were entered into the corresponding field; b) categorization of the product to be purchased is based on so called CPV codes, but complex purchases may require one main and several secondary CPVs.

Root cause analysis: Situation "a)" is clearly a human error; while "b)" relates to the way forms are defined (instead of allowing for recursion, repeated values are entered into the same field using some separators). The latter issue causes a problem either way when output records are generated.

Case problem: There were duplicate lines where certain CN IDs were erroneously coupled with CAN IDs from other calls. While CANs may appear several times in case of multiple awards for one call, calls (a given CN ID) should not be repeated.

Root cause analysis: This appears to be a CSV generation issue, as checking such duplicates on the TED search page returns only one item for a given CN ID. Furthermore, in 2014 there was a change in formsand generating the CSV data from data captured using the old forms were executed according to new forms leading to irregular duplications (which could have easily been filtered out).

Case problem: There were inconsistent values: each type of call should use the corresponding form, however, there are a reasonable number of records where the form number in the record does not match the type of call.

Root cause analysis: This is a data validation issue during the submission of the form (likely coupled with human error).

Generalization of the causes behind OGD quality issues

It follows from the nature of public sector activities, namely that they are governed by policy (with underlying strategies) and corresponding laws and regulations, that legal foundation for publishing OGD could already have an influence on the data that may, must, or should not be released and how they were supposed to be published [START_REF] Huijboom | Open data: an international comparison of strategies[END_REF]. The legal frame controls what may be published, in what format or by whom. This carries a certain risk of errors when it comes to content and format of data being made openly accessible. Implementation of the regulations poses a challenge as wellorganizationally, process-wise and regarding technological support. In the case presented, the EC directives stipulate that the collecting and entering of data is organized around filling out specific forms. These are not always on-line, thus entering data online often means copying from hand-filled forms. This is a major source of typos and errors. Even with online forms there is a possibility of inappropriate completion of data fieldssome of which are deliberate [START_REF] Ted | TED Advanced Notes[END_REF]. Individual behavior and lack of control mechanisms built-in when uploading data using the forms will eventually lead to error in generating the output format from data stored. Fields may be missing from the form, data is not even entered into the form (field left empty). Even if data was entered, often the data is a dummy value just to fill in the field (to avoid being caught by validation if the field is empty). Allowing multiple values in the same field is a serious form issue, resulting in serious challenges during statistical analysis.

Understanding the meaning of various fields requires in depth knowledge not only of public procurement in general but specific details of EU procedures, including the intent and use of various forms. For example, fields in the csv files did not fully reflect either the fields in the TED DB (presented as documents through an online inter-face) or the original forms contracting authorities required to use when submitting data related to calls and results. This is not unusual for public sector data collection typically based on forms. Based on the analysis in the previous section and on the understanding of the role of forms in the public data management process, Table 1 summarizes the generalization of root causes identified. Although there are human errors, often certain basic errors may or may not be detected by the sanity algorithms;

Overall, it can be concluded from the table (and the examples presented in the analysis section), that in the context of the public sector quality of open data is far from being a simple technical issue (or a DB problem). Issues with the official forms mandated, the complexity of the process, or even deliberate misrepresentation of data may hinder the usability of the data eventually publishedon top of regular technical challenges of formats, representation, and readability. In addition, the process of generating the data set version intended for open publication may bring in further errors.

Conclusions and practical results

This research paper has argued that while current OD quality frameworks are strong tools when it comes to assessing OD quality or measuring maturity of data released, they are inadequate when it comes to helping public organizations how to release their data in better shape and how to improve quality as experienced by the end user during reuse. It was proposed, that an investigation of the root causes leading to lower quality PSI/OGD is needed and the idea and its possibilities were demonstrated through a case study. It was demonstrated through the causes identified that ensuring quality of open government data is not simply a technical exercise and often even good organizational practices might not be enough. Although proper data governance principles augmented with well-organized data management and release processes could certainly im-prove, quality starts at the forms and rules set out in regulations. Therefore, for deeper quality improvements changes need to reach as far as the level of policy frameworks.

During the execution of the case study data quality issues identified in the TED csv datasets had been communicated to the issuer of the data. As a result, first the aforementioned "advanced notes" [START_REF] Ted | TED Advanced Notes[END_REF] had been released, and later improvements have been made to the production of the TED ODwith latest datasets released during the completion of this paper (i.e. changes could not be included here). In addition, the codebook [START_REF] Ted | TED Processed Database: Notes & Codebook[END_REF] has been updated as well. An obvious next step is to investigate the content and changes of the new datasets. The publishing team could also be contacted again in order to collect information about the actions taken to improve quality: this could help further validating the root cause analysis presented here, potentially leadto advanced guidelines for issuers of PSI/OGD.

Table 1 .

 1 Overview of issues and causesthrough examples

	Type	Case examples	Root cause	Reasons generalized
			Date is not interpreted	Representation and	Either in the DB or during
			properly;	data type issue;	generation of the open ver-
	Format issues		Scrambled characters	UTF-8 does require	sion inconsistent formatting is used -and most often data type information is lost; Machine readability of even
			appeared for certain	BOM for font mixing;	standard forms have lan-
			countries;		guage dependencies;
			No indication of cancel-	Form error;	Public sphere data collection
			lation;		forms are part of the regula-
					tion but often are out of sync
	Missing data			Data entering error;	with the process; Due to the complexity of legally controlled processes, mistakes are easy to make;
				Error in checking the	Checking relationships be-
				validity of filling out	tween data being entered and
				the form;	data in the DB is not straight-
					forward in this context;
	Logical duplication		CNs are mixed with CAN belonging to a different procedure;	Output generation error: During the generation of the open version (CSV), rec-ords were connected inappropriately;	Data recorded in form (using online of pdf) are then stored in various databases and the open version is generated using a dedicated process (and algorithm) which may introduce errors;
	Physical du-	plication	Two winners an-nounced in the same field instead of using two separate award (CA) IDs;	The form allows for long text fields and it is difficult to detect whether there are one or more winners;	Lining up the process and the forms is difficult -which makes any automatic detec-tion of form errors compli-cated;
	Content	error	Long text of purchase data is truncated by certain tools;	No limit on size of text fields;	Forms collecting data allow for lengthy textual infor-mation;
			CPV codes may have	Multiple values are	IT is a typical form defini-


Bram Klievink

Marijn F W H A Janssen

Haiko Van Der Voort

Sélinde Van Engelenburg
email: vanengelenburg@tudelft.nl

{ A J Klievink

H G Vandervoort

Regulatory Compliance and Over-Compliant Information Sharing -Changes in the B2G Landscape

Keywords: Business-to-Government, B2G, Regulatory Compliance, Supervision, Information Sharing

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Ever since their inception, information and communication technologies (ICTs) have played a big role in inter-organisational information exchange. We are here concerned with a specific domain for information exchange; that between businesses and government (or B2G information exchange). Electronic B2G information exchange is useful for all kinds of data that businesses must provide to government, for example for supervision purposes, taxation and statistics. Companies must comply with many laws and regulations and the information they collect and hold can be vital in demonstrating compliance to government actors and other stakeholders [START_REF] Bharosa | Tapping into existing information flows: The transformation to compliance by design in business-to-government information exchange[END_REF][START_REF] Bharosa | Challenging the Chain: Governing the Automated Exchange and Processing of Business Information[END_REF]. ICTs help companies collect evidence about compliance and support the exchange and evaluation of that evidence. The added efficiency that this brings, has been one of the main drivers for interoperability, standards and inter-organisational systems in this domain. To demonstrate compliance, the way that companies themselves collect and process information requires certain controls and standardised formats and access by government [START_REF] Ruano | Governance and Collaboration in Regulatory Supervision: A Case in the Customs Domain[END_REF][START_REF] Veenstra | Information Exchange in Global Logistics Chains: an application for Model-based Auditing[END_REF].

Such B2G reporting is highly regulated, with obligations pertaining to scope, scale, timing and format for sharing. Standardised data formats and interfaces as well as regulatory and supervisory instruments such as EDP auditing, play an important role in how ICTs assist companies in demonstrating compliance -and governments in assessing it. The introduction of electronic data exchange several decades ago, can be seen as the tipping point for digital B2G exchange. Many e-government systems that are meant to collect or receive business information accept documents according to standardised data and messaging formats. These highly structured, yet age-old formats are still widely used due to their large installed base. Yet, we can now witness a new tipping point based on the increasing amount of data and the technical capability to share and act on original source data in near real time.

There is a host of enterprise information systems (EIS), monitoring systems and inter-organisational systems (IOS) that all collect, produce and/or store information. This information is not just key to the operations of the company, governments can also use the information. Scholars, companies and government are now working on new ways of information sharing, that are based on applying the same formats and systems for both business operations and B2G, instead of B2G exchange being a derivative of the full source data as they exist in the enterprise systems [START_REF] Bharosa | Tapping into existing information flows: The transformation to compliance by design in business-to-government information exchange[END_REF][START_REF] Bharosa | Challenging the Chain: Governing the Automated Exchange and Processing of Business Information[END_REF]. This allows piggybacking on original business data by governments [START_REF] Tan | Accelerating Global Supply Chains with IT-Innovation[END_REF] and that support new value creation by going beyond the formal reporting and compliance relationship [START_REF] Klievink | The collaborative realization of public values and business goals: Governance and infrastructure of public-private information platforms[END_REF]. The emphasis then shifts from the old practice of identifying formal data elements and reports, to identifying and deciding which information may or should be shared to create value for regulatory supervision and/or other purposes. It may even enable governments to do data analytics and identify patterns that they otherwise could not. We summarise this as "over-compliant" information sharing, by which we mean that businesses open up more information than that they are legally required to.

Although over-compliant B2G information sharing is technically feasible and looks promising, a significant part of the 'business case' is related to innovation in supervision that are enabled by it. A prominent example here are companies that share original business records with more information than is formally required, who may be 'rewarded' with less inspections or a lower administrative burden). However, the work on such innovations do mention but rarely focus on the implications of additional data sharing on the compliance and supervision relationship between the parties involved. The work that does address this topic, often does that from the perspective of a single case or project in which over-compliance (our term) plays a role. This paper aims to address this gap by exploring three projects on over-compliant B2G information sharing and what that means for the relationship for the relationship between the companies and supervision or oversight bodies. To this end, we study three research projects on over-compliant information sharing and look for insights across those cases to identify the implications that such forms of sharing may have on B2G information exchange. Specifically, we do that from a perspective of regulatory compliance based on B2G information sharing.

The paper is structured as follows: in the next section, we discuss the current paradigm of B2G information sharing, which heavily relies on inter-organisational systems and standardised information exchange. We also there discuss the recent literature on over-compliant information sharing. In the third section, we briefly explain our approach and the three projects we study. In section four, we present our findings. Finally, in section five, we summarise those in terms of conclusions.

Background

There are many considerations for businesses to (not) share data with government. For instance, technical considerations and capacity considerations, the risks of data ending up with competitors, and the risk of sharing inaccurate data seem to be relevant. From a more political viewpoint, being transparent towards a regulator might put the business in a vulnerable position for the obvious reason that regulators may have enforcement instruments that may hurt the business. This way of opening up may involve risks to the business and the way businesses want to manage these risks are relevant for regulators seeking compliance. As we are interested in the relationship between over-compliant B2G information sharing and regulatory governance, in this section we discuss the relevant background of both. We first dive into how IT supports and changes this relationship. The main part of this section follows after that: we discuss regulatory governance literature to find the main context variables that affect compliance and the relationship between supervision agencies and businesses.

Information sharing

The introduction of information systems has greatly transformed the practice of information exchange between businesses and governments. Governments have put in place information systems for exchanging data with companies, including data for taxation, business reporting, statistical purposes, and for establishing compliance to relevant policies and regulation. Many of these systems are directly relevant for operational processes at both the business and the government side. Hence, their operations become mission-critical to at least some of the organisations involved. Pressing impediments and project risks are salient and need to be addressed [START_REF] Van Veenstra | IT-induced public sector transformation[END_REF][START_REF] Urciuoli | Drivers and barriers affecting usage of e-Customs -A global survey with customs administrations using multivariate analysis techniques[END_REF][START_REF] Gil-Garcia | Collaborative E-Government: Impediments and Benefits of Information-Sharing Projects in the Public Sector[END_REF]. The antecedents of use of information systems has been a topic of interest for a few decades now [START_REF] Robey | Theoretical Foundations of Empirical Research on Interorganizational Systems: Assessing Past Contributions and Guiding Future Directions[END_REF]. Among the key factors that influence adoption and diffusion of IOS, are the characteristics of the system, their benefits, institutional forces, resource dependence and readiness [START_REF] Robey | Theoretical Foundations of Empirical Research on Interorganizational Systems: Assessing Past Contributions and Guiding Future Directions[END_REF]. The implications on the organisation are often profound and may require restructuring of the organisation and changes in and standardisation of the information function in the organisation to adapt to inter-organisational information sharing landscape. As ICT may reinforce dependencies, organisations may be hesitant to deeply integrate them in their own systems, for example to avoid a lock-in by partners [START_REF] Hart | Power and trust: Critical factors in the adoption and use of electronic data interchange[END_REF]. Trust in sharing partners is key to reap full benefits yet is difficult to develop. Even though this may be less of a problem in B2G information sharing, at least some of the information shared with governments will depend on information of (trading) partners and also the risks and benefits may be at the network level instead of at the level of the individual organisation [START_REF] Klievink | Facilitating adoption of international information infrastructures: a Living Labs approach[END_REF]. In sum, B2G information sharing used to be mainly about standardised information exchange via interoperable systems, to enhance efficiency in reporting and processing data.

In the current day and age, the information flow from business to government can be based directly in business information systems or allowing governments to tap into information flows that are used for multiple purposes [START_REF] Bharosa | Tapping into existing information flows: The transformation to compliance by design in business-to-government information exchange[END_REF][START_REF] Tan | Accelerating Global Supply Chains with IT-Innovation[END_REF]. To enable this shift, internal and external control over companies' operations are crucial. As many operations are at least supported by information systems, the control objectives also concern the information systems [START_REF] Ruano | Governance and Collaboration in Regulatory Supervision: A Case in the Customs Domain[END_REF]. Forms of over-compliant B2G information sharing, as presented in the introduction [START_REF] Tan | Accelerating Global Supply Chains with IT-Innovation[END_REF][START_REF] Klievink | The collaborative realization of public values and business goals: Governance and infrastructure of public-private information platforms[END_REF] present challenges that may alter the relationship between regulator or supervision agency and the company providing the information. Studies that touch upon over-compliant information sharing often acknowledge that this is the case, yet rarely cover this change thoroughly. The benefits are often phrased as: re-using data collected for other purposes saves costs, sharing more information allows supervision bodies to make better decisions which would lead them to not burden over-compliant companies, and there might also be reputational gains [START_REF] Ruano | Governance and Collaboration in Regulatory Supervision: A Case in the Customs Domain[END_REF][START_REF] Zuidwijk | The value of information in container transport[END_REF][START_REF] Bharosa | Towards a leangovernment using new IT-architectures for compliance monitoring[END_REF]. At the same time, new incentive schemes are surely required, as companies typically incur costs and are susceptible for additional risks if they give more detail than necessary. But then what does over-compliant information sharing mean for compliance and the supervision by governments?

Compliance and supervision

This subsection covers the literature on regulatory compliance and takes a political view. In the literature, we distinguish five context variables: 1) Compliance motives of the regulated, 2) Compliance enforcement strategies of the regulator, 3) Compliance relationships, 4) Public compliance regimes, 5) The broader institutional context. Compliance motives of the regulator is a classic concern in regulatory literature. Kagan and Scholz made an authoritative typology of regulated businesses informed by both their motives and capabilities to comply [START_REF] Kagan | The Criminology of the Corporation and Regulatory Enforcement Strategies[END_REF]. The typology includes "amoral calculators" and "political citizens" as businesses that under some conditions are noncompliant. The first is informed by their own interest and the second with the moral ambivalence or regulation [START_REF] Hawkins | Environment and Enforcement, Regulation and the Social Definition of Pollution[END_REF]. A third type of non-compliant business as identified by Kagan and Scholz are the "organisational incompetent", being those that might want to comply, but are not able to. The willingness and ability to comply may not only determine the eagerness to open up. The motives also suggest that the decisions what to share and how to share it are in their core of a strategic kind. If these decisions are perceived this way, data and sharing methods become strategic assets.

Compliance enforcement strategies. From the side of the regulator the enforcement style is relevant to the tendency of businesses to share data. In regulatory governance literature two main styles are distinguished [START_REF] Hawkins | Environment and Enforcement, Regulation and the Social Definition of Pollution[END_REF][START_REF] Braithwaite | To punish or persuade: Enforcement of coal mine safety[END_REF][START_REF] Sparrow | The regulatory craft: controlling risks, solving problems, and managing compliance[END_REF]. A first is the classic style of enforcing the law if a business violates it. This style is usually coined as deterrence [START_REF] Kagan | The Criminology of the Corporation and Regulatory Enforcement Strategies[END_REF][START_REF] Wingerde | The Limits of Environmental Regulation in the Global Economy[END_REF], penalism [START_REF] Reiss | Consequences of compliance and deterrence models of law enforcement for the exercise of police discretion[END_REF], coercion or the sanctioning style [START_REF] Bruijn | Law enforcement: The game between inspectors and inspectees[END_REF]. After incidents a call for stricter enforcement is commonly heard, however this strict style is plagued by principal-agent problems since regulators have to rely on data to detect law violations [START_REF] Sparrow | The regulatory craft: controlling risks, solving problems, and managing compliance[END_REF][START_REF] Bruijn | Law enforcement: The game between inspectors and inspectees[END_REF]. An alternative style is a coaching style that is more focused on learning by the business, better relations between regulator and business and development of professional norms to cope with moral ambivalence of rules [START_REF] Sparrow | The regulatory craft: controlling risks, solving problems, and managing compliance[END_REF]. These regulatory styles influence the strategic considerations for businesses to share data. The main consideration here is the probable impact of data about law violations on the business. If data show law violations and these violations will automatically result in public interventions such as fines, the regulated wouldn't be too eager to open up.

As a function of both the motive of the business and the style of the regulator, their compliance relationship is a context factor of considerable importance. De Bruijn et al. [START_REF] Bruijn | Law enforcement: The game between inspectors and inspectees[END_REF] found a seemingly endless amount of strategies both the regulator and the business have to confuse the other. Since the nineties, regulatory governance literature started to focus on the questions how the relationships between regulator and business can be made more productive-at least for the regulator. Typical topics are the responsiveness of regulators to the behaviour and motives of the businesses [START_REF] Ayres | Responsive regulation: Transcending the deregulation debate[END_REF], the way regulators interact with their regulatory counterparts within business such as compliance managers (Parker) and the way trust between regulators and businesses evolves [START_REF] Six | Trust in regulatory regimes; scoping the field[END_REF][START_REF] Van Der Voort | Trust and cooperation over the public-private divide[END_REF]. The relevance of these more relational issues is their capacity to make the behaviours around data exchange some more predictable. Some more stability of expectance about what is being done with the data may encourage opening up in the course of time.

A fourth variable is about regulatory policies rather than regulatory styles. On this level, public compliance regimes define the inspector's job. What are the rules the businesses have to comply with? May distinguishes prescriptive regulation, performancebased regulation and system-based regulation [START_REF] May | Regulatory regimes and accountability[END_REF]. They mainly refer to what the rules prescribe, which are actions, results and processes. These regimes matter for data exchange for at least two reasons. First, per regime, different types of data are needed and some data are more sensitive than others. Second, they imply different responsibilities of the business. For instance, performance-based regimes leave leeway to how results or outcomes are reached [START_REF] Coglianese | Managementbased regulation: Prescribing private management to achieve public goals[END_REF]. System-based regimes usually refer to management systems the businesses control themselves, and this way aim to reinforce the self-regulatory capacity of the regulated business. As such, these regimesmore than othersimply an own responsibility for businesses to collect compliance data and also imply a role for regulators to drive away from this data collection process and collect data on a metalevel (i.e. is there a management system in place?).

Finally, the broader institutional context of the relation between regulator and industry matter for decisions to share data. The relation between regulator and business doesn't develop in isolation. Regulated industries face many different public and private actors demanding responses, including banks, NGO's, insurance companies, trade organisations, and governments [START_REF] Bruijn | Law enforcement: The game between inspectors and inspectees[END_REF][START_REF] Gunningham | Smart regulation: designing environmental policy[END_REF]. In the 2000s a 'decentred view' on regulation became in vogue. With such a view government is no longer perceived to act as the central regulator of the public sphere. Regulation is essentially not state-centred, but rather a result of various public and private regulators seeking to impose rules to others [START_REF] Black | Decentring Regulation: Understanding the Role of Regulation and Self-Regulation in a "Post-Regulatory[END_REF][START_REF] Haines | The paradox of regulation: What regulation can achieve and what it cannot[END_REF][START_REF] Martinez | Risk-based approaches to food safety regulation: what role for co-regulation?[END_REF]. From this viewpoint, Black and Baldwin introduced the idea of 'really responsive regulation' [START_REF] Baldwin | Really responsive regulation[END_REF]. Regulators would not only respond to compliance of regulated firms, but also to their institutional environments, interactions of regulatory controls and changeamong other aspects [START_REF] Baldwin | Really responsive regulation[END_REF][START_REF] Black | Really responsive riskbased regulation[END_REF]. Data exchange cannot be isolated from its context. If perceived so nonetheless, special effects may happen. For example, media might be eager to publish about business performances based on data offered to governments, sometimes devoid from any nuance [START_REF] Van Der Voort | Measuring measures: Introducing performance measurement in the Dutch health care sector[END_REF].

Approach and project descriptions

This paper is concerned with the implications of over-compliant B2G information sharing on compliance and supervision. Recent work that does address this topic, often does that from the perspective of a single case or project in which over-compliance (our term) plays a role. In this paper, we seek to go beyond that and look across three of such projects to extract a more comprehensive view on the issues that over-compliant B2G information sharing presents for the compliance relationship between government and companies.

The three projects that we focus on are research or research & development projects. That makes sense, as implementing these solutions in practice lead to numerous challenges and issues. The three projects are: SBR (a public-private initiative in the Netherlands), CASSANDRA (an FP7 project), and JUST (a Dutch research project). The first two were active in the beginning of this decade, the latter is an ongoing project. All of them concern the Dutch situation, with the exception of Cassandra, which operated in various European countries (the Netherlands included). Given the explorative nature of this study, we did not employ a rigorous comparative design, yet revisit the documents and papers on these projects to extract what can be learned from them about the supervision relationship. The authors were involved in these projects [START_REF] Bharosa | Tapping into existing information flows: The transformation to compliance by design in business-to-government information exchange[END_REF][START_REF] Bharosa | Challenging the Chain: Governing the Automated Exchange and Processing of Business Information[END_REF][START_REF] Klievink | The collaborative realization of public values and business goals: Governance and infrastructure of public-private information platforms[END_REF][START_REF] Klievink | Facilitating adoption of international information infrastructures: a Living Labs approach[END_REF][START_REF] Klievink | Enhancing Visibility in International Supply Chains: The Data Pipeline Concept[END_REF][START_REF] Van Engelenburg | Design of a software architecture supporting business-to-government information sharing to improve public safety and security: Combining business rules, Events and blockchain technology[END_REF], which hurts replicability but we do trade that off with much in-depth, first-hand information. The study is thus based on participatory observation by the authors in these three projects as well as on the documentation in formal project deliverables and papers published on the projects.

3.1

Description of the projects SBR: Standard Business Reporting. The first initiative we reflect on is a Dutch initiative called Standard Business Reporting (SBR). It was developed and applied in the Netherlands to change B2G reporting. [START_REF] Bharosa | Tapping into existing information flows: The transformation to compliance by design in business-to-government information exchange[END_REF][START_REF] Bharosa | Challenging the Chain: Governing the Automated Exchange and Processing of Business Information[END_REF]. The specific issue addressed by SBR is that often companies have to provide similar (although not always the same) information to multiple government agencies, each with their own systems, formats and definitions. This leads to multiple interfaces, and checks on data elements, standards and definitions. Consequently, information is sometimes shared through separate reports (IOS, email), making the extraction of key information a time-consuming and error-prone process. The SBR project delivered a platform that builds on the eXtensible Business Reporting Language (XBRL). A key contribution of the project was to agree on standardization of data (syntax and semantics) [START_REF] Bharosa | Challenging the Chain: Governing the Automated Exchange and Processing of Business Information[END_REF][START_REF] Klievink | The collaborative realization of public values and business goals: Governance and infrastructure of public-private information platforms[END_REF]. CASSANDRA. Similar to SBR, the many actors that are involved in international trade also report much information to various government agencies as well as to other parties in the chain. As international trade is typically organised in supply chains involving many companies, there are many handovers between those actors, even before the information is supplied to the government by one of them. The information is therefore often fragmented and information quality can be poor [START_REF] Klievink | Enhancing Visibility in International Supply Chains: The Data Pipeline Concept[END_REF][START_REF] Hesketh | Weaknesses in the supply chain: who packed the box?[END_REF]. This project focused on leveraging IT innovations to improve the information exchange between actors worldwide by creating electronic connections between organisations. In the project, the systems of supply chain partners are interconnected and jointly formed an international information infrastructure [START_REF] Tan | Accelerating Global Supply Chains with IT-Innovation[END_REF][START_REF] Klievink | Enhancing Visibility in International Supply Chains: The Data Pipeline Concept[END_REF][START_REF] Baida | Preserving Control in Trade Procedure Redesign -The Beer Living Lab[END_REF]. Through the infrastructure, data can be shared among supply chain partners as well as with government. Government agencies involved in the supervision of international trade (e.g. customs, food and product safety, tax) can get a better view on the goods actually being traded and entering the country if they can get detailed information from the original source information systems at all of the parties involved in the shipment [START_REF] Klievink | The collaborative realization of public values and business goals: Governance and infrastructure of public-private information platforms[END_REF].

JUST. The JUST (JUridical and context-aware Sharing of informaTion for ensuring compliance) project is related to the infrastructures of the aforementioned projects yet focuses on an important development: context-awareness. The other projects did cover important issues on governance, collaboration and trust. However, they typically assume it is a onetime decision for companies; they either stick to formally reporting the information they are required to share, or they decide to open up more data than they are legally required to do. However, the developments towards context-aware systems mean that information gets shared. What that means, may depend on the context. That gives rise to a specific challenge with potentially great implications for B2G information sharing: context information about the requester of access to data, together with relevant business rules, can play a key role in the decision about whether to share data [START_REF] Van Engelenburg | Design of a software architecture supporting business-to-government information sharing to improve public safety and security: Combining business rules, Events and blockchain technology[END_REF]. Also the legality of the sharing of information can depend on various context variables, including the circumstances, jurisdiction, applicable regulations, original source of the data, business relationship between the company and the source, public interest considerations, and many other factors.

Businesses have to take these and other matters into account when deciding to share data with governments beyond their formal obligation. That means that sharing is not a decision that is made for all data and all time, but there are many factors that play a role and those factors may play out differently in different instances. For example, the information that a company shares from the operations in one supply chain may be in much greater detail, than what the same companies shares on operations in another supply chain (with other partners and data from different sources).

Findings: compliance challenges and consequences for supervision

The three projects each paint different pictures of the effects of over-compliant B2G information sharing on supervision. In brief, in SBR big challenges can be found in the interaction among government agencies, in Cassandra we find risks of getting punished for 'good behaviour' and in JUST we find that the technical developments towards context-awareness may have some implications. In this section, we discuss these findings, albeit a bit briefly.

Intra-governmental issues. The concept is often presented as an innovation in public-private interactions. In the SBR case, the core components were quickly considered public infrastructure and hence the responsibility of government. That would provide continuity and stability that is needed to make the change systemic to the way businesses store and report information. Furthermore, for some of the services based on the innovation, the law just states that they are the government's responsibility. Yet, several market representatives were involved in standard selection, taxonomy creation and decision-making. Apart from this being a challenge on the public-private interface, also within government there are many agencies and other organisations that act as supervisor on a specific area. Many companies have dealings with multiple of them (e.g. tax, customs, food and product safety, financial regulators, etc.) and the file-once principles requires that they are all able to act on the same data, using the same standards, following the same procedures. The lead agency in the project (the tax administration) thus had to make many decisions that would work for them, but also for the companies and other agencies. An important challenge here is what if others decide not to follow, for example because their task is less information intensive? The differences between government agencies is not trivial; legislation does not allow to re-use data collected for one purpose to be used for different purposes. Furthermore, as various agencies have different legal bases (e.g. tax or commercial) for their data requests, reports may use the same data but end up with different interpretations. These issues were also found in the Cassandra case.

Interoperability and openness of data is obviously a key issue when it comes to the information system aspects of the innovation. Yet, there are also major implications for compliance. In the cases we find situations in which data originally comes from third parties (i.e. the reporting company receives this data from a third party as part of their operations). In our cases that concern international trade data, data often gets updated in the business systems, for example as quantities or destinations change. In over-compliant information sharing, supervisors have access to the company data. However, in regulations, there are formal reporting moments (for example entry summary declarations for incoming goods); if data get updated after that formal reporting moment, what is then the status of that information? The update itself is information for the supervisor (both the update and the fact that is was updated), but does the regulatory regime allow the agency to act on that? And what does that mean for decisions based on the earlier data?

There are different speeds, which is especially visible in the SBR case. The first phases were relatively experimental and first movers faced high transaction costs. There were many incentives for businesses to wait and see, as old alternatives may be not efficient on paper, yet were in practice. It is attractive for them to free ride on the investments of first movers. It was to government to show the efficiency of SBR and make it attractive to step in as quick as possible. A catch 22 situation proved to be a risk: the project needed a critical mass of business to participate to mature, while businesses waited SBR to mature. Also among regulators some there were front runners and others were laggards. As a result, front runners are exposed to risk of failure. At the same time, the standards and customs developed by front runners may become de facto standards. The Dutch Tax Administration, as the main proponent of SBR, didn't always wait for other government agencies to participate. For instance, they developed their own system-to-system channel (BAPI), which reduced possibilities to find a collectively rational solution.

The disadvantages. Companies tend to focus on the benefits they might get when sharing additional data. Also for the government agencies, providing supervision-related benefits is key to incentivise companies to open up their information systems. In practice, however, we found that it is not uncommon that the data that is shared beyond their duty to share, at times also makes errors visible, such as underreporting or misreporting. These errors might not have been detectable under the 'normal' supervision regime, but now lead to fines precisely because of the over-compliance of the company. In the instances where we found this, the companies did not want to be punished for something that is a result of their attempt to be better than others. Also the supervision agencies would rather reward the companies than punish them. Yet, if an inspector finds something wrong, they have no choice but to act on that information, even if provided voluntarily. This shows that the compliance motives of the company are supported by the relationship with the supervisor and the way that over-compliance is reflected in the enforcement strategy, yet this spirit of collaboration at times finds itself at odds with the formal regime.

To follow up on the regulatory regime and style, the regulatory regime will have to allow for systems-based supervision to enable the benefits. Whether such supervision regime is possible depends on the data (transaction data, output data, meta data on the organisation) that is available and the extent to which supervisors depend on that kind of data of the regulated. Furthermore, as over-compliance is often new and sometimes restricted to the 'best in class', the style of the supervisor is often based on collaboration. This means that the supervisor will coach the company towards a situation that they are both happy with. This is also an intensive phase; although actual supervision for that company will over time take less resources, setting everything up, takes up more. The question is for what number of companies that can be done and what that would require of auditors. It also depends on the specific sector. For example, are there professional incentives for self-regulation?

Finally, context-awareness is an issue, especially for sensitive data. The new possibilities to process large amounts of data (e.g. data mining) make it harder to protect sensitive data. A data element is not necessarily sensitive in and by itself, but may become that when aggregated or combined with other data elements. It is challenging to keep track of which combinations are sensitive and who has (had) access to what data in case there are many parties involved, or there are large volumes of data with many different elements. To still protect sensitive data, the juridical and technical safeguards need to be aligned. That depends on the motives of both the regulated and the supervisor, but also on the institutional context and supervision regime.

Being aware of the context in which information is created and/or shared, is important for assessing the compliance of those companies. With the abundance of information available today, there are more data and meta-data available to feed (latent) variables that measure compliance. However, this situation also leads to new challenges and questions; for example on regulatory options for taking into account context as meta-data. Furthermore, if information sharing systems themselves become more context aware, how to know what is not being shared, what is altered and what is only valuable for a specific context? What is the role and value of internal control in those situations, and what does this mean for IT auditors? If information is not shared; how can government agencies know whether that is for good contextual reasons or when that is because of unwillingness to share? How can you know what information is being withheld, and assess whether that means something for establishing compliance or providing the benefits associated with over-compliant information sharing? Although recently studies have started to cover the technical challenges of such context-aware information sharing [START_REF] Van Engelenburg | What belongs to context?: A definition, a criterion and a method for deciding on what context-aware systems should sense and adapt to[END_REF], what that means in terms of the supervision relationship, has not yet been explored. This is an important research direction, as for the further development of context-aware, over-compliant information sharing, it is vital that the supervision implications of sharing decisions are known.

Conclusions

In this paper we have looked at three R&D projects to extract lessons on the implications that over-compliant B2G information sharing may have on the relationship between regulatory supervision and the regulated. In the cases we find that there are many variables and complexities that play a role in that relationship which are affected by the technical innovation. The work on the technical innovations tends not to focus too much on those. Especially regulatory benefits are easily counted on as a key incentive for companies to change the relationship with the supervisor into a much more collaborative one, in which they can share additional data in return for compliance benefits. However, as this is a field where the technical innovation meets soft variables, the effects of the innovation on the relationship and vice versa may not be so clear-cut. Apart from the known issues in public-private collaboration (e.g. control, autonomy, amoral behaviour, conflicting goals and interests), even collaborations that are genuinely committed to making over-compliant B2G information sharing work for both sides encounter push-back from the economic rationality for the company and the institutional and regulatory environment of the supervision regime. A changing relationship between regulator, supervisor, and the regulated, especially when enabled by data, will have to start from certain anticipation effects, such as trust and expectations. Yet, the challenges that we found in this paper (although probably only a small portion of all those out there) show that the institutionalisation of the previous relationship when combined with uncertainties of how new technologies will play out, make the process much more cumbersome than most parties set out with. The three projects covered in this paper have led to new supervision relationships, but only for a handful of companies and also government agencies are finding it hard to scale up. That is not strange, as even in face of great benefits, the new challenges are equally great. We have institutionalised so much value in the current supervision regimes, that we are only beginning to find out how to address things like internal control, external audits, control frameworks, discretionary freedoms, strategic selection, and many others have to be adapted to ever more data.