3 ms·

I have certifications in data privacy. The idea that data is "property" or that it is "owned" by anyone is not codified in law. And as an analogy for how GDPR

by lmkg 5y ago

I have certifications in data privacy. The idea that data is "property" or that it is "owned" by anyone is not codified in law. And as an analogy for how GDPR works, I think it's more harmful than helpful. I see GDPR as rejecting the idea that data has an owner, more than anything. GDPR says that the data subject has rights to data about them. If you want to put a label on it, I would say that legally they are a stakeholder in their own data. One stakeholder of several. Not necessarily the most prominent one. GDPR gives you a seat at the table, but it doesn't actually put you in charge, the way that "ownership" implies. The company that collects & processes the data is still the one making decisions like: What data is being collected? What is it used for? What is the Legal Basis for data collection? What Processors will the data be sent to? What countries will the data be processed in? They have a lot of leeway in how they answer these questions and still be compliant with GDPR. So for that reason, my view is that GDPR says there are multiple stakeholders will different rights to how the data is handled. Which if anything is a rejection of the idea that the data has an owner. Certainly you have rights to the data, but some of those rights have limits, and the Controller still has right as well.

jacquesm 5y ago
Fair enough, but from a practical point of view treating the data as owned by the supplier of the data (when it is about them) gets you 95% of the way, the remainder can be explained by the concept of 'control of the data'.
breakfastduck 5y ago
Yes but that's a necessity to support lawful contracts between a person and an organization e.g. a loan provider. The data subject, as I think, is the owner. They have rights over how and when their data is used & e.g. have a right to be forgotten. They do not, however, always have the power to exercise their 'full' rights in cases where they've entered a binding contract. Such as trying to exercise the 'right to be forgotten' with a company who provided a loan they've defaulted on. They do however have the right through law to instruct the controller to use the data in the bare minimum ways they need to reasonably execute the contract. A reasonable data protection legislation needs to side with the controller in some situations else it would be otherwise incompatible with modern society / law. It certainly does help more than harm imo, especially when it comes to marketing / advertising.

by lmkg 5y ago

jacquesm 5y ago

Fair enough, but from a practical point of view treating the data as owned by the supplier of the data (when it is about them) gets you 95% of the way, the remainder can be explained by the concept of 'control of the data'.

breakfastduck 5y ago

Yes but that's a necessity to support lawful contracts between a person and an organization e.g. a loan provider. The data subject, as I think, is the owner. They have rights over how and when their data is used & e.g. have a right to be forgotten. They do not, however, always have the power to exercise their 'full' rights in cases where they've entered a binding contract. Such as trying to exercise the 'right to be forgotten' with a company who provided a loan they've defaulted on. They do however have the right through law to instruct the controller to use the data in the bare minimum ways they need to reasonably execute the contract. A reasonable data protection legislation needs to side with the controller in some situations else it would be otherwise incompatible with modern society / law. It certainly does help more than harm imo, especially when it comes to marketing / advertising.