Depends what you are talking about when you say "their data". At a base level Facebook can read it, delete it, copy it, move it, etc. and you cannot, so it only

Depends what you are talking about when you say "their data". At a base level Facebook can read it, delete it, copy it, move it, etc. and you cannot, so it only makes sense to say they own it and you do not. It's only when you add a shared construct like some system of ethics or law that your definition of data ownership make sense. It's the difference between ownership defined by abilities and ownership defined by rights. It's a failure of the English language. Computer security, especially, encourages you to think in base, practical (there must be a better word for this) terms. Since you can't guarantee other actors will respect your rights, you fall back to "If I don't want X done then I must make it physically impossible to do X rather than just wrong to do X".