Personal Data Ownership
Legal, Economic, and Political Reasons for Individual Ownership of Personal Data
“Data” and “privacy” are among the most frequently used buzzwords nowadays. Contact tracking, surveillance, and data usage have been subjects of many debates among policymakers, economists, and consumer rights advocates.
One of the most prominent debates revolves around answering a key question: who should own personal data and data that is generated by cell phones and smart devices? The vast majority of us would agree that individuals should be the owners of the data they generate.
Current Approach: Focus on Access, not Ownership
This may come as a surprise to you, but individual data ownership rights, which would give individuals the right to own and control their personal data, are not yet recognized in any jurisdiction. Nor are any such rights to personal data ownership recognized in legal scholarship. In fact, the most esteemed legal thinkers and think tanks are of the opinion that, as of right now, “there is no legal principle or theory that would justify the allocation of exclusive property rights over data.”
The prevailing view among legal experts is that instead of talking about ownership, we should focus on access to data. This approach was also favored in the recently published European Strategy for Data 2020 and the European White Paper on AI. Accordingly, many initiatives are built around data portability and interoperability among various organizations (companies, research organizations, government agencies, etc.).
Emerging Technologies Will Change the Debate about Personal Data Ownership
We are living in an interesting period of time, in which new technologies are changing literally every aspect of our lives. The emergence of these new technologies opens new opportunities for individual consumers (not just companies) to take control of their data and manage and control how that data is used.
We believe that the question about personal data ownership — and whether individual consumers should have legal ownership over their personal data — must be reconsidered in the light of these new technologies.
More specifically, we believe that many people who have rejected the idea of personal data ownership by individuals will change their minds once they are exposed to technology solutions that help individuals collect their personal data in one spot (let’s call it a “personal data cloud”) and control how that data is used.
Technologies Built on User-Centric Data Model
Currently, we’re witnessing the emergence of new technological solutions based on a so-called “user-centric” data model. The main premise of the user-centric data model is that individuals hold master copies of their own data in “personal data clouds” (think of it as a Dropbox folder where all the data is kept). Every personal data cloud is supported by software that organizes the data.
All data held in a personal data cloud comes from one of the two sources. First, some data is manually added by the individual, such as uploaded copies of driver’ s licenses, financial statements, and monthly bills. Second, some data is gathered from third-party data aggregators or data processors. This process is fully automatic and can be conducted by software that “lives” in an individual’s personal data cloud. Retrieving personal data from third-party service providers is possible thanks to legal regulations that require data aggregators and data processors to provide individuals with copies of all data that companies have collected about them, as stipulated in Article 15(3) of GDPR, “right to obtain a copy of data” and Article 20 of GDPR, “right to data portability”.
By being able to assemble personal data in one place, individuals actually gain control over their data. Just like any other online account, only the individual user has access to her personal data cloud. Furthermore, data that is held in a personal data cloud is constantly updated by software embedded in the personal cloud. The data that is gathered in a personal data cloud is also “normalized,” making it legible for users.
Adopting a user-centric, user-held data model has three important ramifications.
(a) Ownership and control
First, in the user-centric model, the individual has ultimate control over how data is used and with whom data is shared. This applies both legally and practically.
(b) Accessing customer data with customer’s prior consent
Second, companies will be able to gain access to information about their customers directly from their customers. This will be granted via prior expressed consent by each individual, and will allow individuals to determine what data is used for what purposes (think of a digital watermark).
(c) New opportunities with data
Third, user-centric, user-held data models are opening new markets for new types of data uses. A whole new type of applications will be created to help individuals get better insights into their personal data (“data widgets”) and “activate” personal data (e.g., movie recommendations that are generated based on data collected from Netflix, Hulu, Amazon Prime video and IMDB). From a technological standpoint, the most fascinating aspect is that these new data apps will run locally “on top” of user-held data (data will never leave the user’s cloud or device, even when used in applications).
In the next sections, we’ll discuss issues that relate to granting individual consumers legal ownership rights over personal data.
(1) What Data Do You Own?
Defining personal data that could belong to the individual has been a historic problem in legal debates about data ownership. More specifically, much debate has focused on what kind of data is “personal” and what data data giants could claim as their own. The other challenge was related to the fact that a lot of data is actually held by service providers (Google, Facebook, etc.).
User-centric, user-held data technologies approach this quandary from a very practical perspective. Once data “enters” a personal data cloud, it physically lives within the exclusive control of the individual, as nobody but the individual can access the cloud.
As to the question: What data should the individual own?
the short answer is: all data that is in the personal data cloud.
Once data about the individual is collected into a personal data cloud, this data is automatically “normalized” (i.e., unified and categorized) and thus becomes a new object, with its own unique structure and layout.
The longer answer to the question of ownership, however, requires some further clarification. If we analyze the data collection practices of technology companies, we can identify four layers of data: (a) input data, which is manually provided by the user; (b) metadata; (c) observable and observed data; and (d) derived data.
Let’s use Instagram as an example: if you upload a photo to your personal Instagram account, there are four layers of data that Instagram is able to generate:
- Input data: All the data that the individual is manually adding (e.g., the photo itself, photo captions, comments, hashtags, etc.);
- The metadata in the photo: GPS data that is attached to the photo as well as details about the camera, resolution, and other information that travels with the photo.
- Observed data: Data on how that photo is used. This data is neither created by Instagram nor the individual. It is also clear that the individual has no access to it.
- Derived data: Based on all of those three categories of data mentioned above, Instagram uses inference to generate an information profile of the user (e.g., preferences, behavior patterns, hundreds of insights about the individual, etc.).
Currently, technology giants are claiming that they legally own observed and derived data (categories #3 and #4 above).
However, in the user-centric model, data that (a) individuals are able to retrieve from third-party service providers by means of exercising their GDPR and CCPA rights and (b) is stored in a personal data cloud accessible only to the individual should be deemed within the individual’s actual possession and control. Besides, since that data is arranged in a unique way, it is possible to claim that the individual should also be deemed its rightful and lawful owner.
(2) What Rights Does the Individual Have?
Legal scholars have repeatedly raised questions regarding the scope of rights that individuals should have over their data. The property regime — copyright or another intellectual property right, trade secret, or a new type of property regime (so-called sui generis right) etc. — under which personal data should fall was also widely discussed. It seems that the majority of the authors agreed that personal data does not belong in any of those categories.
Actual possession and control were the core missing pieces needed to qualify personal data as an object that could be legally owned by individuals. However, as the new user-centric, user-held data solutions emerge, there are no other objections to classifying such data as an individually owned object in property law.
It is true that every country’s property regime is different and that each has different requirements that need to be met to deem an object as a “thing” of property law. For example, in British common law, four main requirements have to be met to deem an object as a “thing” in strict property law view: certainty, exclusivity, control and assignability (per Mummery LJ opinion in case Fairstar  EWCA Civ 886 (19 July 2013)).
Data that is held in a user’s personal data cloud meets all of these requirements: (a) it can be identified with certainty, (b) the individual has the power to exclude others from accessing it, © the individual can obviously exercise control over that data, and (d) the individual can assign or transfer that data to any third party (if she wants to).
Recognizing ownership rights over personal data means the individual has the following four “classical” rights associated with ownership: the right to possess her personal data; the right to use and enjoy that data as she pleases; the right to dispose of the data; and the right to get value from that personal data.
Personal Data Ownership Is Common Sense
That individuals should own their personal data is common sense. The majority of individuals would agree that they should own their personal data.
This perspective is identical to the argument that the data technology companies (GAFA) take with regard to the data they collect. If large companies can claim that the data they have collected over time forms proprietary assets and trade secrets, so should individuals be able to claim that they have ownership over data they have aggregated in their personal data cloud.
Finally, the argument that individuals are rightful owners of the personal data held in personal data clouds does not by any means require a revolution in the existing legal frameworks. Instead, it should be seen as a natural evolution caused by developments taking place in digital space.
Acknowledging that individuals own their personal data has important social, legal, economic, and technological implications.
First, user-held data is technologically superior: as mentioned before, user-held data represents the most accurate data about the individual. It is the most up-to-date data. No other organization could have more accurate and reliable data than the individual herself.
Second, user-held data is legally superior. Recognizing the right of individual ownership over data solves a number of problems that businesses are currently facing. In the user-centric model, individuals give third-party service providers access to their data via prior express consent. As a result, organizations will be able to comply with data minimization requirements and lawfully access and process all data.
Third, user-held data creates opportunities for businesses to build new types of applications that run on top of user-held data. This will make digital interactions more secure: the likelihood of data breaches will drop because there will be less customer data held in centralized servers. Besides, user-held data will let companies make more personalized offers and provide bespoke services to their customers.
Finally, user-held data is socially superior. By creating practical tools that give individuals granular control over their personal data, individuals will become more data-literate. Additionally, interactions with service providers will be more equal, as individuals will set the terms under which data is accessed by third parties. This is likely to contribute to a changing perception of the value of personal data; rather than being a disposable object, personal data will emerge as an asset that generates long-term value.
Join the movement!
If you are interested in joining a community working user-centric, user-held data solutions, I would like to invite you to join “Liberty. Equality. Data.” Slack group.
If you have other ideas about data ownership or privacy and would like to discuss them with me, please comment on this post or get in touch with me directly.