Is it time for a Bill of Data Rights?

The Bill of Rights could not be more fundamental to our lives as Americans. While it didn’t establish the precise nature of our democracy and how it would function logistically (Articles I – VII took care of that), the constitution would not have come to pass without it. The Bill of Rights codified the most sacred personal freedoms the framers intended to preserve for future generations and gave them the force of near immutable law. They have been subject to endless scrutiny and interpretation, but at their core, they’re the heart of American individualism and personal liberty. Now, there’s no possible way the framers could have imagined a world in which a thing like the computer existed, much less a social network connecting 2+ billion people to one another every day. But, the concept of a Bill of Data Rights should probably be a more talked-about contemporary concept, in my opinion, because our data undergirds some of the most private, important and personal aspects of every one of our lives. And as such, relevant stakeholders, along with the US government, might ought to take a look at codifying how that data is governed.

Why a Bill of Data Rights?

There’s no question that data is the currency of the 21st century digital realm. Google and Facebook got so good at collecting and analyzing it that they’ve swallowed the digital advertising marketplace whole. Our phones are with us 24/7, collecting and analyzing our personal data at every turn, step, nap or scroll. Many leading technologists have bristled at how recklessly even their own technologies capture and store data, and a rallying cry has emerged from an unlikely chorus including Mark Zuckerberg and Tim Cook: ‘You own your data!’

In a recent MIT Technology Review article, the author summarized this assortment of luminaries’ position thusly:

Eric Posner of the University of Chicago, Eric Weyl of Microsoft Research, and virtual-reality guru Jaron Lanier, among others, argue that data should be treated as a possession. Mark Zuckerberg, the founder and head of Facebook, says so as well. Facebook now says that you “own all of the contact and information you post on Facebook” and “can control how it is shared.” The Financial Times argues that “a key part of the answer lies in giving consumers ownership of their own personal data.” In a recent speech, Tim Cook, Apple’s CEO, agreed, saying, “Companies should recognize that data belongs to users.”

It’s possible that this is a great way to think about how we should govern the concept of data and privacy. If you truly own your own data, you can dictate how it’s collected, stored and monetized (and hopefully, if you so choose to share it, you could share in said monetization). But the author of the MIT article actually makes a different, albeit related, contention — it’s not owning your own data that will do the trick, but rather “we need a framework that gives people rights to stipulate how their data is used without requiring them to take ownership of it themselves.”

What’s the difference between data ownership and data rights?

The author of the aforementioned article goes on to make a fascinating analogy via use case of what data rights are different/superior to personal data ownership:

To see why data ownership is a flawed concept, first think about this article you’re reading. The very act of opening it on an electronic device created data—an entry in your browser’s history, cookies the website sent to your browser, an entry in the website’s server log to record a visit from your IP address. It’s virtually impossible to do anything online—reading, shopping, or even just going somewhere with an internet-connected phone in your pocket—without leaving a “digital shadow” behind. These shadows cannot be owned—the way you own, say, a bicycle—any more than can the ephemeral patches of shade that follow you around on sunny days.

Under that context, it makes sense why thinking about your personal data as something you can/could own might not make the most logical/real-world sense. But, that doesn’t mean we should just throw our hands up in surrender — the opposite, really — we should be developing a framework that determines what your, and conversely corporations’, rights are with that data.

To sum up his argument, Martin Tisne stated: “Data rights should protect privacy, and should account for the fact that privacy is not a reactive right to shield oneself from society. It is about freedom to develop the self away from commerce and away from governmental control.” He was quick to caution that data rights aren’t only concerned with privacy, though. “Like other rights—to freedom of speech, for example—data rights are fundamentally about securing a space for individual freedom and agency while participating in modern society. ”

So what would that look like? Tisne goes on to lay out a broad framework of what he thinks could be a starting point for this discussion:

“A Bill of Data Rights should include rights like these:

• The right of the people to be secure against unreasonable surveillance shall not be violated.
• No person shall have his or her behavior surreptitiously manipulated.
• No person shall be unfairly discriminated against on the basis of data.

These are by no means all the provisions a durable and effective bill would need. They are meant to be a beginning, and examples of the sort of clarity and generality such a document needs.”

It’s a complex undertaking, to be sure, but one I think the very nature of commerce, privacy and individual liberty could depend upon in the 21st century. I don’t know the exact right way to start the conversation, but we at ENO8 certainly think it’s a conversation worth having and thinking about deeply.