Who owns my data?

Who owns my data? In this question, if you replace data with a physical object, like a car or a house, the answer would obviously be “me”. That’s true not only of physical objects, but also of content because the latter is governed by copyright laws. The principle is you are the owner of the content you create, such as a photograph, because it would not have come into existence but for your labour. In the past, when you sent a film for developing and printing, the studio did not assert any rights over your pictures; their lien over your property ended when you paid for the services.

However, the concept of ownership has undergone a fundamental shift in the digital world. For example, if you take a picture and publish it on any platform or, in some cases, even store it in an online “drive” or a “cloud”, then you give to the concerned platform or even the device a “worldwide, royalty-free, non-exclusive license to use, distribute, reproduce, modify, adapt, publish, translate, publicly perform and publicly display such content.” Your smart gadget may not deliver the convenience for which it is advertised, unless you store your content to the “cloud” and thereby create property rights for the entity that licensed the use of the device or platform to you.

Beyond ownership over the content, there are issues of data protection relating to data that identifies you (personal data) and data that describes you (which may have been created by observing you, your content and your activities). These platforms assert that information, such as “your name, mailing address, phone number, email address, contact preferences, and credit card information about you” may be shared by these platforms with their affiliates, strategic partners or other service providers. To this may also be added occupation, language, zip code, area code, unique device identifier, referrer URL, location, and the time zone. Some of this could include information about friends and family too. Further, your physical location and online activities are aggressively tracked using a variety of technological means, and often without you being aware of it.

Unfortunately, what has happened is the entities in the value chain have assumed full ownership of this data, while the “real owner” does not seem to have any right on the same. The privacy policies of many such entities (typically the device manufacturers or portals on the internet) shift the balance in favour of these entities to such an extent that the owners’ rights on the data are extinguished completely. Thus, it is the device company, through these “agreements”, that acquires an absolute right on this data to share with various entities for commercial and other purposes. With advances in AI (artificial intelligence) and Big Data, this data has become very valuable. The terms and conditions used in these agreements are often deliberately opaque and unintelligible. Big tech companies thus acquire every right on your personal data to keep, use, sell and even lose the data, all for free.

Imagine what will happen tomorrow when the Internet of Things (IoT) becomes ubiquitous. Who owns the data collected by smart wearables, transport and energy systems and billions of other connected devices, is going to be a very complex question. As the numbers of stakeholders in the process of generation, collection, storage and processing increase, the question of ownership and responsibilities among them shall become very complex. Each one of these entities will be interested in using, holding, transmitting and selling/monetising the data.

Therefore, there is an urgent need to create a technology framework to ensure that the data owners have full control on their data and every entity which holds and uses the data follows the broadly accepted principles of notice, choice and consent, collection limitation, purpose limitation, access and correction norms, disclosure of information norms, security, openness, and accountability.

Similarly, there is a need to create a policy framework which should recognise and formalise the ownership, rights and responsibilities of various entities in the value chain. It should also create analogous frameworks for data as in the case of normal properties, such as those dealing with inheritance. There is an urgent need to create a citizen-centric data eco-system that empowers individuals with control and visibility over their data.

The writer is chairman, TRAI. The views expressed are personal

For all the latest Opinion News, download Indian Express App