Everyone is obsessed with the property rights debate over personal dataMuch have been said about the the property rights debate over personal data. On one side, we have critics like Brookings’ Cameron Kerry and John Morris argue that data ownership is the wrong approach to data privacy. On the other side, Stanford Graduate School of Business’ Christopher Tonetti counters that giving consumers ownership rights over their personal data would not only give consumers greater control over their privacy, but also encourage the sharing of data, which would be a plus for consumers and society as a whole. Siding with Tonetti is musician and entrepreneur, will.i.am, who wrote for The Economist, “The ability for people to own and control their data should be considered a central human value. The data itself should be treated like property and people should be fairly compensated for it.”
With the issue gaining mainstream momentum, regulators are also weighing in on this debate. Earlier this year, in California, Governor Gavin Newsome proposed the idea of a “data dividend” that will allow California residents to profit from their online data. Shortly after, Senator John Kennedy (R-LA) introduced the “Own Your Own Data Act of 2019,” which provides that “each individual owns and has an exclusive property right in the data that individual generates on the internet” and requires social media companies to obtain licenses for the use of data. More recently, Senators Mark Warner (D-VA) and Josh Hawley (R-MO) introduced a bill that will require Facebook, Google, and other large collectors of data to disclose the value of personal data they collect and the Securities Exchange Commission to develop a method or methods for calculating the value of user data.
“The ideas behind “idatity” are becoming understood … I’d say “idatity” again because i.am my data, and my AI agent should be my personal data scientist. But in five years, I believe this will be the norm. Tomorrow’s entrepreneurs will create virtuous companies that honour people’s data. They will make use of my data with my consent but I will always own it.”
And just last week, the US Senate Committee on Banking, Housing and Urban Affairs held the hearing titled, “Data Ownership: Exploring Implications for Data Privacy Rights and Data Valuation,” just one in a series of Senate hearings exploring possible frameworks for facilitating privacy rights to consumers. The hearing called upon four witnesses at different points of the spectrum of this debate. First, Jeffrey Ritter of the American Bar Association Committee on Cyberspace Law testified that data ownership is critical to privacy law reform, noting that whoever establishes and maintains control over data determines ownership. Chad Marlow from the American Civil Liberties Union, on the other hand, testified about the ACLU’s strong concerns about the data-as-property model, because it poses adverse privacy risks and would result to a digital divide where the wealthy can afford to protect their privacy but the less privileged cannot. The American Action Forum’s Will Reinhardt is also skeptical that data property rights are the best policy mechanism for ensuring privacy, pointing that valuing personal data is particularly challenging, and even going so far as to claim that any privacy law will create unavoidable costs from compliance. Certainly not the least, DrumWave CEO Michelle Dennedy pointed out that there are existing models for the data-as-property model — for example, intangible property law, such as trademark, copyright, and goodwill. The witnesses’ full written testimonies are publicly available here.
It goes without saying that the subject of personal data monetization is a highly contentious one, driving a wedge even amongst privacy practitioners. It is with this tumultuous backdrop that I pile on top of this mess the following points.
Let’s not forget that privacy is about individual control over personal data — this necessarily includes the choice to monetize it
The cornerstone principle underlying privacy is not secrecy or limiting disclosure; instead, it is that individuals should have control over their own personal data. Critics of the data-as-property model are rightfully concerned that treating personal information as property to be licensed or sold may induce people to trade away their privacy rights for very little value. But the answer is not to take away people’s choice to monetize their own data when companies have been doing so, almost exclusively, for years.
Instead, the better question is how we structure these data transactions in a way that truly represents and protects individual choice — choices as to what data she wants to monetize, for what specified uses, for how long, and the parties with whom she wishes to transact. We need to innovate and find a way to structure data transactions in a way that is specific, defined, and delivers value to both individuals and businesses, as opposed to the one-sided status quo of companies offering consumers “free services” or take-it-or-leave-it discounts. Otherwise, maintaining the status quo breathes life to the criticism that consumers will be unlikely to strike a good deal for their data.
Data valuation is hard because it’s contextualOne of the main criticisms of the data-as-property model is that valuation is extremely difficult. How much is personal data really worth? With every data point supporting data’s significant value (for example, a man Federico Zannier’s sale of his online data for $2,733), there is at least another counterpoint (such as when WIRED editor Gregory Barber sold his location data, Apple Health data, and Facebook data for a paltry $0.003). To add to the complexity, similar data sets could fetch different amounts: Facebook’s reported annual revenue per US user is about $130, but the global average goes down to $25. The unsatisfying answer to the question of how much personal data is worth is: it depends on the context.
Data valuation is contextual, which makes it challenging. But this does not mean that the challenge is not worth solving. There are existing, evolving, and proposed data valuation models, some based on brand or tied to cyber insurance, while others are based on income, market rates, and even shadow prices. Why not put all of them to a test?
None of this complexity negates the incontrovertible fact that personal data has value that is already being monetized inequitably against consumers. The more interesting question is whether we are going to empower consumers to meaningfully share in their data’s value.
If we really want to consider the data-as-property model, ownership can’t be exclusiveAnother criticism of the data-as-property model rests on the difficulty of attributing ownership over a piece of personal data. But who says that ownership rights need to be exclusive? As Michelle Dennedy touched upon in her Senate testimony, there are a number of imperfect analogies and models to help guide the way, including intangible property, where the right to use such property can be non-exclusive.
Besides, the law always lags behind innovation, so it’s unlikely that an existing legal framework will be the perfect fit for this digital dilemma. It might be that we need to borrow from intangible property law principles. Or it might be that we need to come upon with new ones. Or both.
What is befuddling is that we are letting archaic, limiting, and ill-fitting concepts such as ownership exclusivity dictate how we navigate this complex, emerging data marketplace development. We need to come up with a better framework that fits our modern and digital world and addresses the issues of privacy, innovation, information flow, and valuation.
New property rights are not necessary to empower individuals to monetize their own dataBeyond property law, current privacy regimes, such as the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) already provide for individual control over data. Individual privacy rights to access, correct, delete, port, restrict sale, and restrict general processing of data are on the rise all over the world. These privacy rights have been labeled “property-like,” without going as far as to create an exclusive ownership right.
These existing rights allow individuals to exercise control over their data and start monetizing it — should they choose to do so. A consumer can exercise their access right and request a copy of their data from Facebook or other company controlling their data. They can then exercise their portability right and take that copy to another service that will provide them with compensation or to a platform that will facilitate its monetization. They can choose to transact with brands they trust, and exercise their deletion right towards brands they don’t trust. They can also rely on their right to restrict sale or processing of their data to prevent entities from further selling or sharing their data with other third parties.
As the point made earlier in this article, one of the cornerstones of privacy is individual control over one’s personal data. This necessarily extends to the ability to transact and monetize one’s own data, supported by existing rights. These rights provide guidance for legislatures that are concerned about people’s ability to exercise control over and share in the value of their data.
The property rights debate detracts from the inequity and privacy violations crystallized in the status quoThis obsession over property rights detracts from the inequity and privacy violations crystallized in the status quo. It is a status quo that is one-sided and untenable, disproportionately benefitting data brokers and data companies like Facebook and Google. Not only are regulators paying attention, but consumers are also catching on, and ethical technologists and entrepreneurs are seeing the opportunity to innovate and tackle this pain point.
As digital citizens, we all need to make known our sentiments on how we feel about the status quo. In turn, regulators and policymakers need to listen and act to protect our citizens’ digital rights. As for the entrepreneurs and technologists, we need to do better and innovate for the good, overturn the inequitable status quo, and provide digital citizens meaningful tools to share in the value of their data.