Re: [projectvrm] Data Ownership Question

[Eve Maler < >]

Adriana, those are great analogies!

Trent, I would just add that, of course, "ownership" has deep roots in  
property rights law, and most countries by now have laws that touch  
directly on the question of personal data ownership.  (Australia, for  
example, has an interestingly expansive view of a person's ownership  
of data about them residing, say, in audit logs in some vendor's data  
center.)

If you see property ownership as a bundle of rights (http://en.wikipedia.org/wiki/Bundle_of_rights 
), then it perhaps becomes easier to deal with the fact that  
individual people often have, say, "read" access to data about them  
(such as their credit score or felony record) but not "write" access  
to it -- that is, they have ownership in some parts/usages of the data  
but not all.  Seen this way, it becomes merely (ha!) an exercise in  
figuring out the granularity and types of access control/authorization  
for everyone, including the perceived owner(s).

        Eve

On Aug 26, 2008, at 11:23 AM, Adriana Lukas wrote:

> Trent,
>
> Here is my take on the relationships of users to (their) data on the
> web these days.
>
> Models of data imprisonment
> http://www.mediainfluencer.net/2008/05/models-of-data-imprisonment/
>
> Adriana
>
> 2008/8/26 J. Trent Adams 
> <
>  >:
> > Ian -
> >
> > Many thanks for the pointers.  I'll bring this intel back to the
> > DataPortability Party.
> >
> > We're definitely ramping up to wikify our collected thoughts in the  
> > area.
> > As soon as we've dedicated a place to have the discussion I'll clue  
> > you
> > (and others, if interested) into where it lands for additional input.
> >
> > Thanks again,
> > Trent
> >
> >
> > At 02:07 PM 8/26/2008, Iain Henderson wrote:
> > > Hi Trent,
> > >
> > > I don't believe that there has been a definitive discussion on  
> > > this in
> > > VRM-land, although we spend lots of time on the concept of the  
> > > personal data
> > > store - the generic term for data specifically built on the side  
> > > of the
> > > individual, with ownership an un-said characteristic of the data  
> > > within that
> > > store.
> > >
> > > Beyond that, I wrote a
> > > <http://rightsideup.blogs.com/my_weblog/2007/10/can-i-own-my- 
> > > da.html>post a
> > > while back on the subject of 'can I own my data', which as I  
> > > recall says
> > > there are a lot of grey areas around such a statement, but  
> > > fundamentally
> > > i'll know that I own it when I can/ could sell it and underpin  
> > > that sale
> > > with a legal contract.
> > >
> > > So, if we assume that ownership is meant in the legal sense, then  
> > > who owns
> > > what data depends on who signed what terms and conditions  
> > > document. Beyond
> > > the legal definition, there has long been a recognition (first  
> > > coined by
> > > Andre Durand as I recall) that the data creation process in the  
> > > context of
> > > supplier relationships can be split into:
> > >
> > > - my data (what I bring to the relationship)
> > > - your data (what you bring)
> > > - our data (co-created through doing business)
> > >
> > > I think this categorisation is helpful, although there are plenty of
> > > situations where data is created on an individual without their  
> > > being a
> > > direct relationship in place (e.g. by credit bureau). The problem,  
> > > for the
> > > individual, is that at present the 'our data' typically lives  
> > > within an
> > > operational customer management system (web site/ CRM) owned by the
> > > supplier, so the 'our data' is only available to the individual as  
> > > and when
> > > the supplier enables it (or the individual deploys screen scraping  
> > > tools or
> > > similar).
> > >
> > > At present, a sub-group in VRM-land is developing the concept of
> > > 'volunteered personal information', which is another variant on the
> > > ownership discussion. In this scenario, the organisation is is  
> > > invited to
> > > sign the terms and conditions of use set by the individual - again  
> > > implying
> > > that this particular type of data is owned by the individual.
> > >
> > > Anyway, I hope that helps shed some light on the issue from the VRM
> > > perspective. I agree that it would be good to develop shared  
> > > definitions
> > > that each project could use; do you have anything on a wiki/  
> > > workspace we
> > > can use to do so?
> > >
> > > Cheers
> > >
> > > Iain
> > >
> > >
> > >
> > > On 26 Aug 2008, at 18:17, J. Trent Adams wrote:
> > >
> > > > Team VRM -
> > > >
> > > > Over in DataPortability land, we're struggling with terminology  
> > > > around
> > > > the "ownership" of user data.  Basically, we're trying to codify  
> > > > the
> > > > concepts related to the data the user "owns" versus what he/she  
> > > > "controls"
> > > > and/or has "access to".
> > > >
> > > > I remember some discussion around this at the recent workshop,  
> > > > and rather
> > > > than reinventing the wheel I wonder if anyone could point me  
> > > > toward a cogent
> > > > distillation of the salient points.
> > > >
> > > > Also, it'd be kewl if DP could align our language with VRM (or at  
> > > > least
> > > > be cognizant of the rationale for any differences).
> > > >
> > > > Thanks in advance,
> > > > Trent

Eve Maler                                         +1 425 947 4522
Principal Engineer                            eve.maler @ sun.com
Business Alliances group                    Sun Microsystems, Inc.