Bottom-up data Trusts: disturbing the ‘one size fits all’ approach to data governance

Abstract

From the friends we make to the foods we like, via our shopping and sleeping habits, most aspects of our quotidian lives can now be turned into machine-readable data points. For those able to turn these data points into models predicting what we will do next, this data can be a source of wealth. For those keen to replace biased, fickle human decisions, this data—sometimes misleadingly—offers the promise of automated, increased accuracy. For those intent on modifying our behaviour, this data can help build a puppeteer’s strings. As we move from one way of framing data governance challenges to another, salient answers change accordingly. Just like the wealth redistribution way of framing those challenges tends to be met with a property-based, ‘it’s our data’ answer, when one frames the problem in terms of manipulation potential, dignity-based, human rights answers rightly prevail (via fairness and transparency-based answers to contestability concerns). Positive data-sharing aspirations tend to be raised within altogether different conversations from those aimed at addressing the above concerns. Our data Trusts proposal challenges these boundaries. The current lack of legal mechanisms that may plausibly empower us, data subjects to ‘take the reins’ of our personal data leaves us vulnerable. Recent regulatory endeavours to curb contractual freedom acknowledge this vulnerability but cannot, by themselves, remedy it—nor can data ownership. The latter is both unlikely and inadequate as an answer to the problems at stake. We argue that the power that stems from aggregated data should be returned to individuals through the legal mechanism of Trusts. Bound by a fiduciary obligation of undivided loyalty, the data trustees would exercise the data rights conferred by the GDPR (or other top-down regulation) on behalf of the Trust’s beneficiaries. The data trustees would hence be placed in a position where they can negotiate data use in conformity with the Trust’s terms, thus introducing an independent intermediary between data subjects and data collectors. Unlike the current ‘one size fits all’ approach to data governance, there should be a plurality of Trusts, allowing data subjects to choose a Trust that reflects their aspirations, and to switch Trusts when needed. Data Trusts may arise out of publicly or privately funded initiatives. By potentially facilitating access to ‘pre-authorized’, aggregated data (consent would be negotiated on a collective basis), our data Trust proposal may remove key obstacles to the realization of the potential underlying large datasets. This article proceeds from an analysis of the very particular type of vulnerability concomitant with our ‘leaking’ data on a daily basis, to show that data ownership is both unlikely and inadequate as an answer to the problems at stake. We also argue that the current of top-down regulatory on contractual freedom is both and the particular type of vulnerability at needed. The latter to a to data subjects when to data governance to the rights by like the GDPR can be as in a to as use of their exercise is both and unlikely to be as when As a governance that is of into the in the we the potential in data Trusts. This potential the between on one and collective aspirations on the The the Trust data subjects to choose to the rights they their personal data within the legal of a data is that there be a of data Trusts, out of a of publicly and privately funded initiatives. Trust will a particular of aspirations, in the terms of the Bound by a fiduciary obligation of undivided loyalty, data trustees will exercise the data rights the Trust to particular to a we data can be in a and the to of data may be to to rights is there as as our proposal is is the to regulatory as the GDPR and what of The of those rights will the of data Trusts in Our to the of our data Trusts proposal with the legal to different of personal from and data to The a of from Trust aspects to and to data of We by the way in an of data Trusts and that to those within the of regulatory as the The promise of the is that our will be able to us, our like of a of that can from to the of of on the way at like of the The to we with is and a personal but our at we can turn the to on or the out of way of the on the of from a an personal data is and a source of that is to us, and to in our The of this is to the data as a that may be with data governance, the the as as the a very of in this data a of on in the and of the that data to the a different of is by the data we daily by to we may be The of data our lives to be to an us may be a of we and what us is a to be us on the of our personal of these can be by legal the of and to challenges they to be to of the may be as as when to the exercise of data rights a of and of these to a where a of can a different our The way in we our as as the of the particular challenges to our the we to be to an by our in as by the to be but in a is the of this that is by our le