Like most people here I'm fairly hard line when it comes to personal data abuses but I still struggle with the concepts of owning data about yourself. It's a confusion I see amongst less technically literate people when a well meaning person explains to them the importance of some latest data breach and they try to understand the concept that they owned this data, it was theirs but now it has been "stolen" or abused in some way.
I would consider going as far to say that framing the data as owned by you is a bad approach, but maybe I'm just being pedantic about the language. Company A does have data about me, but I don't own it, and they have responsibilities to protect it (or delete it if requested), but I don't see any ownership in the equation, especially when the nature of the data can become quite abstract while still maintaining some reference to you.
Not to take away from the intention or sentiment of framing it that way though, I'm just musing.
I don't entirely agree. People may be confused about data, but they are not confused about ownership. They understand ownership quite well. By sticking with that framing, you only have to get them to understand this ephemeral thing. Once you do, they can immediately apply all their concepts of ownership to it. To replace ownership with something else, well, now you've still got to get them to grasp the data, but also this something else, which might necessarily be somewhat abstract.
I'm not even quite convinced they can't grasp the concept. People think they 'own' their digital copy of The Rescuers Down Under, when technically they've leased it. They generally understand they shouldn't post their credit card numbers online. I think it's more likely that they just don't understand the consequences, and even if they did, generally feel dis-empowered to do anything about it. That's a dynamic that has existed since before the internet.
The problem fundamentally is yes it's your data. It's what makes you, you. The reason this is important is because if you can't control this data it can be used against you. At some point in the near future if not already you'll have job applications rejected based on third party data you didn't sign up for and can't opt out of. It will impact your healthcare, your loans, what prices you see when you shop and what items are shown. In essence what makes you, you is used solely for controlling you and the options available to you.
The issue then isn't the data, but the fact that it could be used in those ways. Because if it's legal for companies to use that data (even if it's owned/controlled by the user), they will incentivize people to share it in order to give them better prices/service, and the end result will be the same.
This comment made me think about how uneven the expectations are about whether data is owned by the person who collected it or the person who it was collected about.
I think most people would agree that if you take a photo of someone who agrees to you taking it, you own the rights to that photo. But if a company collects data about someone voluntarily using that company's product, the person owns that data? I don't understand where the line is drawn.
I don't see the article's idea of ownership as universal control, but more focused on being able to use whatever instance of the data you have without needing to rely on a third party.
For example, if I own a book then I can read it, doodle on it, or lend it out at any time. I can't prevent other people from reading/defacing/whatever their copies of the book.
You could argue in the past that PII data was just name, birthday, SSN, etc. However, nowadays pretty much anyone can be identified by their metadata so that's where I think this broad sense of ownership comes from.
consider the concept that lots of businesses operate perfectly fine whilst temporarily having full physical control over
physcial objects owned by their customers
why not treat data the same way ?
yes it will be very disruptive to some businesses. i hope.
Like most people here I'm fairly hard line when it comes to personal data abuses but I still struggle with the concepts of owning data about yourself. It's a confusion I see amongst less technically literate people when a well meaning person explains to them the importance of some latest data breach and they try to understand the concept that they owned this data, it was theirs but now it has been "stolen" or abused in some way.
I would consider going as far to say that framing the data as owned by you is a bad approach, but maybe I'm just being pedantic about the language. Company A does have data about me, but I don't own it, and they have responsibilities to protect it (or delete it if requested), but I don't see any ownership in the equation, especially when the nature of the data can become quite abstract while still maintaining some reference to you.
Not to take away from the intention or sentiment of framing it that way though, I'm just musing.