Who owns personal data?

The commercial value of personal data has prompted arguments that individuals should be allowed to commercialize their own data.¹ Granting individuals ownership rights over personal data is sometimes proposed to address data inequalities and to determine how such data can be used and by whom.² Yet “ownership” neither addresses these inequalities nor empowers individuals to control the use of data. Personal data “ownership” makes sense only if personal data are considered an “asset” with associated property rights.³ If personal data are property, they can be used as collateral and for commercial exchange, with the potential implication that individuals could even trade away the data that contain their digital identity.

Some scholars suggest that concepts of property rights should apply to personal data.⁴ Others suggest that market-based solutions should be used to protect data,⁵ called the “personal data economy.”⁶ The economic literature is mixed on whether data ownership rights could solve market failures or improve social outcomes.⁷ Some suggest that the optimal distribution of ownership rights would depend on factors including the investment required to create the data⁸ and the ability to monetize data.⁹ A regime based on property rights would likely increase the transaction costs involved in data sharing, by requiring negotiation of the terms of sale and use.

Ascribing data ownership rights to personal data also poses legal challenges. First, personal data often involve overlapping interests of different parties.¹⁰ These interests are present in the collection, creation, and use of the data.¹¹ If ownership were allocated to the “party with the clearest interest or who could make the most value out of it,”¹² it would be practically difficult to identify the party or parties meeting this definition.¹³ It is also unclear how to compensate interested third parties if their rights are breached through downstream data uses.¹⁴ Creating a data ownership right would require elaborating “necessary user” rights and rules to accommodate the public interest needs of such data,¹⁵ such as those raised in the COVID-19 pandemic response.

Second, “owning” personal data might incentivize poor and more vulnerable people to sell their personal data, exacerbating existing inequities. Under a rights-based approach to personal data protection, individuals have fundamental rights regarding their data. Perhaps ironically, these rights—more than “ownership”—give individuals control over their data, enabling them to negotiate the use of these data.¹⁶ These immutable rights—like due process under law—cannot be bargained away like chattel. Even current case law does not support ownership rights over personal data.