Bottom-up data Trusts: disturbing the ‘one size fits all’ approach to data governance

Abstract

From the friends we make to the foods we like, via our shopping and sleeping habits, most aspects of our quotidian lives can now be turned into machine-readable data points. For those able to turn these data points into models predicting what we will do next, this data can be a source of wealth. For those keen to replace biased, fickle human decisions, this data—sometimes misleadingly—offers the promise of automated, increased accuracy. For those intent on modifying our behaviour, this data can help build a puppeteer’s strings. As we move from one way of framing data governance challenges to another, salient answers change accordingly. Just like the wealth redistribution way of framing those challenges tends to be met with a property-based, ‘it’s our data’ answer, when one frames the problem in terms of manipulation potential, dignity-based, human rights answers rightly prevail (via fairness and transparency-based answers to contestability concerns). Positive data-sharing aspirations tend to be raised within altogether different conversations from those aimed at addressing the above concerns. Our data Trusts proposal challenges these boundaries. The current lack of legal mechanisms that may plausibly empower us, data subjects to ‘take the reins’ of our personal data leaves us vulnerable. Recent regulatory endeavours to curb contractual freedom acknowledge this vulnerability but cannot, by themselves, remedy it—nor can data ownership. The latter is both unlikely and inadequate as an answer to the problems at stake. We argue that the power that stems from aggregated data should be returned to individuals through the legal mechanism of Trusts. Bound by a fiduciary obligation of undivided loyalty, the data trustees would exercise the data rights conferred by the GDPR (or other top-down regulation) on behalf of the Trust’s beneficiaries. The data trustees would hence be placed in a position where they can negotiate data use in conformity with the Trust’s terms, thus introducing an independent intermediary between data subjects and data collectors. Unlike the current ‘one size fits all’ approach to data governance, there should be a plurality of Trusts, allowing data subjects to choose a Trust that reflects their aspirations, and to switch Trusts when needed. Data Trusts may arise out of publicly or privately funded initiatives. By potentially facilitating access to ‘pre-authorized’, aggregated data (consent would be negotiated on a collective basis), our data Trust proposal may remove key obstacles to the realization of the potential underlying large datasets. This article proceeds from an analysis of the very particular type of vulnerability concomitant with our ‘leaking’ data on a daily basis, to show that data ownership is both unlikely and inadequate as an answer to the problems at stake. We also argue that the current of top-down regulatory on contractual freedom is both and the particular type of vulnerability at needed. The latter to a to data subjects when to data governance to the rights by like the GDPR can be as in a to as use of their exercise is both and unlikely to be as when As a governance that is of into the in the we the potential in data Trusts. This potential the between on one and collective aspirations on the The the Trust data subjects to choose to the rights they their personal data within the legal of a data is that there be a of data Trusts, out of a of publicly and privately funded initiatives. Trust will a particular of aspirations, in the terms of the Bound by a fiduciary obligation of undivided loyalty, data trustees will exercise the data rights the Trust to particular to a we data can be in a and the to of data may be to to rights is there as as our proposal is is the to regulatory as the GDPR and what of The of those rights will the of data Trusts in Our to the of our data Trusts proposal with the legal to different of personal from and data to The a of from Trust aspects to and to data of We by the way in an of data Trusts and that to those within the of regulatory as the The promise of the is that our will be able to us, our like of a of that can from to the of of on the way at like of the The to we with is and a personal but our at we can turn the to on or the out of way of the on the of from a an personal data is and a source of that is to us, and to in our The of this is to the data as a that may be with data governance, the the as as the a very of in this data a of on in the and of the that data to the a different of is by the data we daily by to we may be The of data our lives to be to an us may be a of we and what us is a to be us on the of our personal of these can be by legal the of and to challenges they to be to of the may be as as when to the exercise of data rights a of and of these to a where a of can a different our The way in we our as as the of the particular challenges to our the we to be to an by our in as by the to be but in a is the of this that is by our legal do we this by a of the mechanisms through we to our is ownership. As an of the of ownership as the to other or to the to may the of their also as a other of as in the of rights to data ownership is as a in to to the in the This of ownership with to on a of is in the is the of access to a a with the and can be as points different of (or different of data is (or The type of rights data can to the rights in a that by their can on the use of that of like they can The between those and the to into to This is when a of data as that to data rights rights be to to an is unlikely to the of is also a answer to the type of problems at of the that to the of data on the and on human as the data This turn to human rights reflects the of the that can from the of personal through they also to through Unlike most (or very of us the or to of our data we to and what The of data that most do as the Data us into data subjects and data to these The data but of and where an is to their there is a between the subjects and the This the data from to and into the the or data to data the the to data and The by the GDPR on data in from an that data subjects in a position to from the to power those on contractual freedom also from an of the that a contractual to data governance is to aspirations that the very of these aspirations is a to the of Our of is to a data to to This us vulnerable. This vulnerability can be in a way that our to of our our to a that is at out by us is as the vulnerability of the the or the can be with or can be in the of to and an of The of that is concomitant with the potentially personal by data is at as to of in is and in a position to above vulnerability that of of those in of what of our personal data can be and and what in a position to the particular that from the of our machine-readable or this position of power is concomitant with personal the data to from the underlying their Data in an will data an We of the challenges with the and way in we our Recent regulatory endeavours to curb contractual freedom by the between data and data The current lack of legal mechanisms that may plausibly empower data subjects one of the key underlying our The vulnerability that stems from the of our machine-readable can be or in a way that our to a that is at by Unlike the to as a the concomitant with this vulnerability our The above also to and The ‘one size fits all’ approach different individuals to choose different to data governance, both their to and their and the we we can these challenges through the mechanism of data Trusts. We data Trusts as a data subjects choose to the rights they their personal data within the legal of the our the data subjects tend to be both the and the of the the trustees to the data to the terms of the a fiduciary the data subjects of the We an of Trusts out of a of publicly and privately funded with different terms, allowing data subjects to choose different to data Trust would be in of data and be able to to data the of our the of data Trusts publicly in The legal mechanism of a data to the concomitant with the of data to the Trust is when a in a of is to and those the of other the from allowing of ownership the the a Trust the also to the particular at as they the undivided and to the and aspirations of the data subjects of the The fiduciary is a of a may be in of that the is to to is as the of that a would Our is where personal data is is the of underlying fiduciary is to the at the to to on behalf of the to the Trust a The that the of is is also the of a is the trustees to that they to the with of and undivided This is trustees can be their trustees from a and their to with those of the beneficiaries. This into those that to fiduciary data those the to the potential in Trusts as a legal mechanism a is by an data Trust is data subjects personal data with data collectors. The latter to be the This is the undivided our proposal the of Trusts, and the of independent trustees by the Trust’s and The latter can from one Trust to this an of Trusts, where a of data Trusts data subjects a of that their personal the also to different data within the that and to be to data in their these that make at from this data the data be in way to This proposal the power in our current of data is to out that in and to fiduciary their or This that they be their is that they an obligation of undivided their a is to from of would be in of fiduciary a data a in the data by data this in a between that and data Data in this position would be to both the of the personal data they the of and fiduciary data acknowledge the potential of to the a fiduciary obligation data subjects is with the data As to a fiduciary obligation from also an to to the and of the vulnerability in the data this the by would be placed in a position that is to that of a a on particular or a a to in that from the of fiduciary proposal to those in a contractual with this in a of in lack a contractual with a or with a that personal and to make this the of and in the that can be by in and large of may as or and on and is the of the at the remedy by is The remedy is to make the they and as a as they on the that would the hence of the of as The type of that is by the approach to data governance is one of or As the of our to a that is at by us our to our of as the of personal data or can when a answer when with that what may be as a of of to the of the data governance our proposal is to from the As a the data Trust is in a position to plausibly empower data to ‘take the reins’ of their This with the current on the or that from the current of our data by The also to to the of terms and the of data between data and to use data to an to in facilitating the of may out of the of that do the type of legal to be able to data of and legal is in with legal Trust to the above the we in Trusts, The collective of terms by the Trust is a way data subjects to their rights to a Trusts may be in a way that a collective or the of to empower the For the of a to their would the to the their to The terms of the Trust may a governance that the data to and with the and in that the Trust would in to a with fiduciary in the data Trusts may a may choose to to a of data governance by This data Trust is to regulatory those of the of those top-down will be in to one may an that of be in The and aspirations in data Trust will be by the of this data trustees to an in one can an of to to a We in a answer to the latter to be the of and is the Data trustees will also to make that by is in to by a data by the The latter be as and of a of data trustees would be by a or as a that to be with the of we unlikely to a data Trust to in that there be a of data Trusts, one particular way of data and Trusts may the of by data to may the of may on will be able to from one Trust to as and when their or aspirations The of between a of data Trusts will to of the that there of data and will also make that our data governance in with the and aspirations of be met an to the be of Trusts be and the data data be that the data is in Trusts may to on the terms to the data may be on and from be the that data subjects of their as in a personal data but the to exercise their rights and The above also a of data between Trusts and of the data a data personal data be between different data be from particular The of an of Trusts is on their to make use of the rights data and data Trust to power be able to make data but also be able to data from a particular is to of a particular of data the this to be able to data is by legal of the GDPR a to personal data in the the to a the is a of the data can be with that to the of the of the this is to that to a or and on the of (or of a the of access of the is and but this data can be in or article of the very aspects the of and the of rights to as the to other personal or by the when the or by the the of and access rights will in the within they to be GDPR that a access should be within a For data we Trusts to access within access would be by human to data The of those rights will also on and a the to a of access of a large in the of the out that of the out of or out of with the a to an answer with data that and these inadequate to the an the of the the that a to access in large personal data that they an access As a way this that use of the of access can help the power between and in of the a and both the and challenges in the of data subjects to their As a way of addressing the above our data Trust proposal the of those rights to a data would exercise on behalf of the Trust’s This is legal legal and governance by the Data This data is of in the legal and thus the of a legal in of the legal a of what we will this a of the of do we the current the to of data may plausibly be to to The latter is as our data proposal on this rights We the of on Trust as a legal to the contractual or in the as as challenges of what the of the above to that is of in the legal The of that to the that data is an of most the latter to The of data is unlikely to the the in the rights can be on type of or and in Trusts. the latter the a personal to in a in the the of the may to the that data from like in key is data can be and this to from that that the is different from that to on of there in the or also Trusts. the of the may with those the that data be to to This is by those argue that the GDPR rights to and that is to to rights these of the latter is in the what to the to of data may be to to rights is there as as our proposal is is the to regulatory as the GDPR and what of The latter of data to what of the of data Trusts in to of the in is can be a of a or a in or of a or obligation an legal as as a of and in their the is to and to the of the of of a that the of a within that of For this that is to of the of the as a as a in a where the on is a as is the to the that is on and the to the by the and is a between at and a in the in the can be in the of a Trust is of as a the the to the rights conferred by the GDPR other regulatory in other can be in data rights the to should be in and data rights different from a to the The latter to the one at the the rights to and access as conferred by the GDPR to a make rights our to a data would regulatory This is in the that data to challenges when to a of rights and that into both as an and human rights the vulnerability the GDPR of rights and to personal data in human rights the rights to and access above can be to that is to to what may plausibly be as obstacles to and The and the way to as we move from data that is by the data to data as there is to the way to data that is the of as the data to of personal between the above to argue that the is the most as on will rights in their data the a ownership on the data will be able to exercise their rights but the data the in the to to data as that the of prevail on rights of The rights individuals do in to data’ do of the of they as as to the the challenges the to different of data can be to to different of access and rights the way to a problem one that the of a Trust be able to be as an the above to the that can be to what data to data to one at a in the the to data is on the of data The of the challenges from these the of will in on For now is at this that a data Trust to the data by data collectors. can an of Trusts where one Trust in data to in a Trust data to Trust Trust would on the the underlying data This would trustees to on the use to the data is the mechanisms of access and would be Trust may on the of a the data on the particular data trustees may or may be data the Trust may choose to data with other Trusts that to their Trusts may be to and as of the data to their as other Trusts may in a particular of personal as Trusts to to negotiate with the Trusts as to be able to the that with datasets. the challenges is the of the rights to access and of the GDPR The data the to a or in with the of a in the and is in the of the of data rights and with to the of their personal data to the on or to exercise the rights to in and on or and to exercise the to to in on or behalf where by The above to a of is the by to the or to the to For our what is that the rights in and as This the would aimed at the rights to and access a data be in of answer is would the of the in the rights to and there regulatory on this is also that this would be as a problem the contractual or in the as they also on an to exercise the rights to and the above challenges by they do to that data rights can a legal and with a contractual or is to an of Trusts and their is also to of a governance the challenges at stake. is a to and within a contractual or the of the that and in terms of and is be The to the of our data Trusts proposal with the legal to different of personal This into is data Trusts to or at of these of data may to in is on an basis, with a that be at a of with the of a potentially This may access to the data by the and what the terms by to is different is to data in the of different the intent to their data with that to the The GDPR this by the into the that data within that the of data can be very to a of The of an of data Trusts in current obstacles to at the data to make that their The to choose different Trusts would to their placed in a The to the of different of those within different to data also be and thus to As an of the a to be the of a access to at a the GDPR this by allowing to personal data in of a data as this is to or the of the a may a data to is the of a out of As what as is to that a in or the legal at in the above is unlikely to be by the data trustees may their Trust’s to data the terms data may by that access to the data is to with particular in a of particular Trusts, the data trustees may be in a position to negotiate that (or those by the the the GDPR that and be in to that the personal data the is with the data also that the be with the of data trustees may be to a in the that when to data also to be in a position to with and what is within particular As we the of the and of to what as data’ data’ is can be of both our and our on change our of the us in that we do The we and the of our by that to can be through in the of particular (or on the of by with particular As is to be by that their or the to to also the to to For an to make a particular data from their is when they with these may of terms and they a terms and change they may may to to data terms and of these power would be by data Trusts. As data Trusts, terms and would be by data a to particular terms and would data Trust they data be with accordingly. This power is a of the is a of the power that would to the Trust through the of data data particular challenges our but our can through other individuals their may be as a other can through as and those argue that a to the their would acknowledge that should be to the via their or personal data is data to and the of data’ within the acknowledge the of the rights at the of the in to to their Our data Trust proposal is to the data is can do is a and of those data to the of a of data where there is between and As a may data the of (or other on the terms of this data a may or may access to this data a may also be to other of data where personal is the is data with other is to make that from to the the of an or would by a from their or an of with (or in the an is a a or this would to on of would to the use of the between individuals and a power between and data data is to with the of to a but the to in those can in addressing the challenges raised by this power in the the by the to the GDPR with the and personal and what rights as is the to to in both there is a of by the to rights do the on as the of these do data Trusts to We they Data Trusts the to of their to in the of the This would the data trustees to that of the data personal data is by the of the of Data do the of the Data this is the From a Data Trusts a mechanism to that the data in the of data terms, and in to to at the by or to also thus allowing there is potential from to be in the of data what individuals or in their is by that this approach is with potential in the terms and of the is to be in a data Trust in that data should be to a would be able to access to this potentially data from a of different is at the that our data Trust proposal would be able to different the Trust’s Trust their in the of the of in The of out of the to to as the to their on the the underlying our proposal is in that the to data subjects can be as Trust can and do in and there is a in their and legal of a by in by other the challenges that will to be our proposal to a to a and with the and of the to personal data is to the is of the that most of the personal data by is through As a the of in with a data Trust may be data Trusts to as a of the power of the of the those that a of to be The latter from large data to the of a of data Trusts and their underlying to data on data in the of data subjects would be to publicly funded Trusts, with the of Trusts. From a a in that very to those that to the of a a of the an to make the in a approach from the to make that one would also The latter would those to a Trust to but also the to the terms of the Trust do the and aspirations of beneficiaries. stems from concerns. may that data Trusts may the to the data that is can be to particular the by to the to our data can be to particular as an the of data Trusts that would to be a of may be on to to of the and data in a way that very to data that is to one that one what is to a a particular data This is one that current data with and Trust may different of data the of data to the by fiduciary may make that of a the data is to the by data data and the of the by data trustees the they be to those by to their publicly data Trusts be by a regulatory that would and of data with an with out the problems with particular of data The legal of Trusts the of the the latter to to those with the to their on The problems our data Trust proposal to do in with those of to data governance that is to a data data is by large data in a as they current regulatory endeavours to curb contractual freedom by those power can they to the of our to a that is at by the latter unlikely to be in