Nobody Knows Where the Data Came From — And That Is the Whole Problem

There is a question most enterprises cannot answer about their most valuable asset: where, exactly, did this come from?

Not which system houses it. Not which team owns it. The harder question — under what terms was it gathered, from whom, with what understanding, and has anything about that understanding changed since? For a substantial share of any large organization's data holdings, the honest answer is that nobody knows. And until that changes, every other fair data initiative is built on sand.

How Origin Stories Get Lost

Provenance rarely erodes in one dramatic failure. It decays through ordinary corporate life.

A dataset is collected for a product launch. The launch ends; the dataset survives. It gets copied into an analytics environment, then into a data lake, then into a feature store. Each migration strips a little context. The engineer who understood the original consent flow leaves the company. The vendor that supplied the enrichment data is acquired, and its terms of use are folded into a master services agreement no one has reread. Five years later, a data science team trains a model on the whole accumulation, treating it as raw material rather than as an artifact with a history.

Chain of custody breaks the same way evidence breaks in a courtroom — not through malice, but through unlogged transfers. And like contested evidence, data with a broken chain of custody cannot be fully trusted or fully vouched for, no matter how well it is currently secured.

Why Provenance Is a Fairness Problem, Not Just a Technical One

It is tempting to file provenance under data quality, alongside schema documentation and pipeline monitoring. That framing misses what is actually at stake.

Fairness toward data subjects requires knowing the terms of the relationship. If an organization does not know whether a record was collected with explicit consent, purchased from a broker, inferred from behavior, or scraped from somewhere it arguably should not have been scraped from, it cannot honor the obligations attached to each of those origins. It cannot honor a deletion request completely, because it cannot trace the data's spread. It cannot assess whether a model discriminates, because it cannot evaluate the collection practices baked into its training corpus. It cannot tell a regulator, a partner, or a customer the truth about its data, because there is no truth available to tell.

In this sense, provenance is the precondition for every downstream ethical practice. Consent management presupposes knowing what was consented to. Minimization presupposes knowing why data exists. Accountability presupposes knowing what you are accountable for. Organizations that skip provenance are not choosing a narrower ethics program; they are choosing an impossible one.

The Case for Rebuilding the Record

The uncomfortable corollary is that many enterprises need to reconstruct provenance they never captured — a forensic exercise that is expensive, imperfect, and necessary anyway.

A pragmatic approach starts with triage. Not all data deserves equal effort. Provenance reconstruction should prioritize records that feed consequential decisions: credit, employment, pricing, healthcare, and anything else with material effect on individuals. For these, the organization should document what can be established about origin, flag what cannot, and treat unresolvable gaps as a risk factor — sometimes a reason to re-collect with proper terms, or to stop using the data altogether.

Going forward, provenance capture should be automatic, not aspirational. Collection context — source, legal basis, consent state, acquisition terms — should travel with the data as metadata that pipelines preserve by default. Migrations and transformations should be logged the way custodians log evidence transfers. Vendor agreements should require provenance disclosure upstream, because your chain of custody inherits everyone else's breaks.

There will be a temptation to declare the reconstruction complete too early, or to accept plausible inference as documented fact. Resist both. A provenance record that is 80 percent accurate is not 80 percent as good; it is a record with an 80 percent core and a 20 percent lie embedded in it.

An Opinion, Stated Plainly

Enterprises talk about data ethics as though it were primarily a matter of intention — of wanting to do right by the people in the data. Intention is cheap. What is expensive, and what actually constitutes fairness, is the institutional memory that makes good intentions actionable.

An organization that cannot say where its data came from is not in a position to promise anything about what it will do with that data. Rebuilding the origin story — record by record, system by system, however tedious — is not a preliminary step toward fair data practice. It is fair data practice, in its most foundational form. Everything else follows from it, and nothing much survives without it.