Digital Repatriation Is Not Mailing Back a Hard Drive: Museums, Indigenous Communities, and Authority over Cultural Data

Museums often use “digitization” as evidence of progress. Glass-plate negatives are scanned, audiotapes converted, and field notes moved to the cloud, where a database makes them searchable by keyword. The institution then announces that it will provide the digital files to the communities from which the materials originated. This sounds like a long-overdue return—until someone opens the hard drive and finds filenames made up of serial numbers, misidentified people, places classified according to colonial administrative boundaries, sensitive material with no access tiers, and terms of use that still declare, “The museum reserves all rights.”

If repatriation means only making another copy of a file, colonial arrangements can be backed up at high speed as well.

Genuine digital repatriation is not a matter of mailing back a hard drive. It requires renegotiating authority over cultural data: who may name them, view them, reuse them, say no to their use, revise the rules in the future, and share in the educational, research, and commercial benefits they generate. A file’s location can change overnight. The underlying power relationship does not update automatically when someone issues a download link.

Ask “Whose Data Are These?” Before Asking Only “Who Preserves Them?”

Collecting institutions often infer rights from physical custody: the materials are held, catalogued, and maintained here, so the institution decides how they may be opened. Yet rights in cultural data are far more complex than ownership of a hard drive. A researcher may have made a recording, but community members supplied its content. A museum may own a photographic negative, while the people, clothing, landscape, and knowledge depicted remain embedded in community relationships. Field notes may belong to the researcher who wrote them, but document ceremonies, kinship relations, place names, or healing knowledge that were never intended for public disclosure.

Copyright, physical ownership, and cultural governance authority must therefore be considered separately. An institution may legally possess a file and still have an ethical duty to respect the source community’s decisions about its content, context, and access. Conversely, a community’s claim to governance authority should not be reduced to a demand to lock every record away forever. The task is to establish rules grounded in relationships and responsibilities, not to choose between unrestricted access and complete closure.

Filenames and Descriptions Are Not Neutral Administrative Work

The first layer most easily overlooked in digital repatriation is authority over description. An incorrect name for an Indigenous people, an obsolete place name, or a catalogue entry reading “unknown ceremony” directly shapes search, education, and AI training. Faulty metadata are not a minor defect. Once entered into a system, they reproduce themselves as new knowledge.

Source communities must be able to correct names, languages, places, dates, and events, and to add notices where public description would be inappropriate. Some knowledge cannot be adequately represented by dividing it into the standard museum fields of object name, material, dimensions, and function. It may be connected to family, season, land, gender, age, responsibility, and prohibition. Compressing relational knowledge into a neat row of fields can produce technical order while severing cultural relationships.

Two-Eyed Seeing does not mean placing Western database knowledge in one column and Indigenous knowledge in another. It means allowing knowledge systems to work together without either absorbing the other. A museum may retain its conservation records, dating, and material analysis, while a community contributes names, histories, conditions of use, and cultural boundaries. These accounts need not be forced into a single definitive version, and no single institution should hold final interpretive authority.

Access Is More Than “Public” or “Private”

Most digital platforms offer crude permission models: public, private, or password protected. Cultural-data governance may require much finer distinctions. Some material may be available to all members of an Indigenous people but closed to outsiders. Other material may be restricted to particular families, ages, or people who hold specific responsibilities. A recording might be authorized for language teaching but not for editing into commercial music. An image might be viewed in a research room but neither downloaded nor added to an AI training dataset.

Such rules are neither superstition nor an impediment to science. They express the institutional relationship between knowledge and responsibility. Contemporary databases already use tiered access for medical records, trade secrets, data about children, and national security. It is striking that, when Indigenous culture is involved, some people suddenly insist that “knowledge should be free”—as if freedom required marginalized communities to disclose their knowledge but placed no obligation on platforms to disclose their algorithms or revenue.

A sound digital-repatriation system should support role-based permissions, time-limited authorization, restrictions by purpose, access logs, download controls, and community review. More importantly, it must allow rules to change. Consent to public access today does not eliminate the possibility of withdrawal tomorrow. A new generation of community members may reassess an older agreement, and use may need to pause if the original consent is found to have been defective.

Consent Is an Ongoing Relationship, Not a One-Time Signature

Research consent has traditionally been treated as a one-time document: an interviewee signs, and the researcher acquires long-term permission to use the material. Digital data, however, can be copied indefinitely, recombined, transferred across borders, and applied to technologies that did not exist when consent was obtained. Agreement twenty years ago to use a recording in academic research is not agreement to train a speech model today. Permission to play it in a local exhibition is not permission to upload it to a global video platform.

Digital repatriation must therefore redesign consent. At a minimum, it should establish the scope of the original consent, who may approve later uses, whether a community can withdraw or correct material, and whether governance covers derivatives such as transcripts, translations, annotations, vector databases, and model weights. It must also determine how the original institution will track and address violations after a third party downloads the data.

These questions are difficult. Difficulty, however, is not a justification for disregarding rights. Museums spent centuries building systems for collecting and preserving material; they must now devote time to building systems of responsibility after return.

Returning Data to a Community Also Requires Infrastructure That Can Endure

Giving several terabytes of files to an organization without reliable internet access, servers, staff, or a budget for backups is not empowerment. It is a transfer of maintenance costs. Genuine repatriation must include equipment, storage, backups, cybersecurity, format migration, training, and long-term funding. Otherwise, when a hard drive fails, the institution will once again say, “Fortunately, we kept a copy,” and authority will return to where it began.

A workable model need not remove every record from the museum. Options include community-owned servers, trusted hosting, federated access, a jointly governed platform, or encrypted copies held by both parties. What matters is that the community has substantive authority over the architecture and can determine where the data reside, who can access them, and what happens when the system fails.

Technology must also match local capacity. A platform that requires expensive licenses, dedicated engineers, and continuing cloud fees may collapse soon after a project ends. Repairability, exportability, freedom from vendor lock-in, and support for offline or low-bandwidth use often matter more than an impressive three-dimensional exhibition. A cultural-data platform is not a firework at a technology showcase. It is public infrastructure that must survive staff turnover, connectivity failures, and budget cuts.

AI Makes Digital Repatriation More Urgent

Generative AI makes cultural data easier to repurpose. Recordings can be used to generate new voices, photographs to generate new people, and texts to produce vector representations that are combined with other datasets. Even when an original file is not public, model training, retrieval-augmented generation, and annotation workflows may create new derivatives.

Digital-repatriation agreements must therefore address AI explicitly. Is training permitted? May data be used only in a closed model governed by the community, or also in public research? How will outputs identify their sources? How can communities challenge inaccurate generations? Can models and data be deleted? If a commercial product uses the material, how will revenue and seats in governance be allocated?

The most dangerous response is that “a model learns only patterns; it does not store the original text.” Cultural rights do not disappear because an engineer changes the technical vocabulary. If a model can imitate a voice, image, narrative, or style, the community has a legitimate claim to participate in setting the rules. Whether data exist as original files, embeddings, or parameters will affect the technical remedy, but it must not be used to evade ethical responsibility.

A Practical Roadmap for Digital Repatriation

The first step is a joint inventory: what files exist, where they originated, what the original consent covered, which communities are involved, and how sensitive the material is. The second is to establish a governance team that gives communities not merely an advisory role, but decision-making authority, veto power, and a budget. The third is to correct descriptions and define access tiers while retaining multiple accounts. The fourth is to choose the technical architecture, backup arrangements, and long-term maintenance model. The fifth is to create an ongoing review process so that rules can evolve with community needs and technological change.

Each step should assign responsibility: who completes it, when it will be reviewed, and who will resolve disputes. Repatriation is not a ribbon-cutting ceremony; it is long-term governance. If a project produces only a symbolic group photograph and a hard drive, it is too early to proclaim decolonization a success.

What digital repatriation must return is not only a set of files, but the capacity to decide how culture enters the future. When an Indigenous community can decide which records support language revitalization, which remain within a family, which may be used in collaboration with researchers, and which must never enter a commercial model, data cease to be only a collected past. They become a present that the community can actively use, protect, and pass on.

A hard drive can arrive the next day; governance authority requires institutions, resources, and trust. A museum willing to complete this work does not lose its authority. It gains an opportunity to rewrite the claim that it “preserves human culture,” replacing a unilateral declaration with a shared responsibility.

Further Reading and Sources from the Chinese Original

• United Nations | United Nations Declaration on the Rights of Indigenous Peoples (2007). Article 31 addresses rights in cultural heritage, traditional knowledge, and traditional cultural expressions.
• Global Indigenous Data Alliance | CARE Principles for Indigenous Data Governance (2019; updated continuously). CARE stands for Collective Benefit, Authority to Control, Responsibility, and Ethics.
• Local Contexts | Traditional Knowledge Labels (updated continuously). The labels help communities express their protocols; they are not a substitute for legal rights.
• Mukurtu CMS (updated continuously). The platform supports cultural protocols, tiered access, and community digital archives under locally determined deployment conditions.
• Carroll et al. | The CARE Principles for Indigenous Data Governance (November 4, 2020). The article discusses how CARE complements FAIR without treating either framework as a single global template.