Many of us have a protective instinct when it comes to our data. After all, it's ours. Why should someone else profit from it? There's just one problem: you may have privacy laws protecting you from being spied on and copyright laws protecting ownership of content you create, but data doesn't belong to you just because it's about you.
The Legal Concept of Ownership
(Your browser doesn't support iframe)
Spoilers if you're woefully behind on Game of Thrones, but there's a moment in season two of the show where Lord Varys is speaking to Tyrion Lannister on the nature of power. He asks Tyrion who a sellsword would obey—a king, a priest, or a rich man—if each bid him kill the other two. The riddle has no answer, however. The point isn't the answer, the point is the problem. There is no way to resolve the question of who truly has the power when all parties involved disagree on who has the power.
"Power resides where men believe it resides," Lord Varys concludes.
Property ownership stems from a similar concept. Aside from our own bodies, there's nearly nothing we truly "own" outside of a more-or-less universally acknowledged social contract. So far, science hasn't created a way for one person to take control over another person's body, but everything else—your clothes, your car, your home, your various toys—can be removed from your possession if someone can find a way to engineer, through the shared social contract, that it belongs to them instead of you. You can be taxed, fined, penalized, charged, or sued for your property. The contract is elaborate and full of loopholes.
Yet, it's better than the alternative. If not for this social construct, anyone who walks inside your home and takes your TV becomes its owner, purely by virtue of having it. We don't like it when some rule or law says we owe someone something of ours, but we much prefer it to an anarchic law of pure possession.
There's just one little niggle with this contract of ours: it was never designed to account for information. Historically speaking, the idea of even owning information is relatively new. The earliest copyright laws—which granted the creator of a work exclusive rights to duplication and distribution of said work—first appeared in the early 18th century. It would still be hundreds of years, however, before the concept of "data" as we understand it even began to develop.
Owning Information Is Still New
The internet revolution happened incredibly quickly, as historical events go. In a single generation, the average person has gone from having no computer of any kind in their home to owning a device capable of observing and recording video, audio, location, and motion in their pockets. Devices that can communicate with nearly any of the other devices that are also recording information. Oh, and collectively, we have the ability to store, access, and process more data than humanity has created in its entire history.
The concept of "data" as it relates to everyday people is still evolving. Between copyright and privacy laws, we've gotten ourselves tricked into believing that there's such a thing as data ownership. If the government starts pulling your GPS records without a warrant, they get in trouble because that's a form of privacy invasion. If you post a photo online and someone takes it, crops out your watermark, and posts it on their website, they've violated copyright.
As an example, however, if an unseen observer follows you around and writes down every place you visit, does nothing with this information, and you never discover their activities, they have broken no laws. There is no legal concept that states you are the sole proprietor and owner of the information regarding your life and that the mere collection of this information is a violation of your rights. The closest legal offense for this behavior would be stalking, however not only does this tend to involve an element of harassment (something our hypothetical unseen observer would be incapable of doing), but it's also irrelevant because your phone can't be convicted of stalking you.
As a matter of fact, there are even specific legal protections for the collection of data in public places. The general rule for photographers is "If you can see it, you can shoot it." In addition to protecting artists who are out taking photographs, this legal precedent allows private investigators (as well as public ones) to collect data about you when you're outside your home. Without breaking a single law, virtually anyone can take and store a photo of you that contains information on where you are, what you were doing, what you were wearing, and what you look like.
To put all this another way, if Google sent someone to sit on a street corner and record facts about everyone that passes by, this would be a very slow, and very legal form of data collection. Even if you find it creepy. And, as a side note, this is exactly how certain types of psychological research is done.
Furthermore, analyzing data is incredibly lucrative. Not for you, of course. Unless you're working for a large corporation, you probably don't have the means to analyze your data in any meaningful way. However, Google, Facebook, Apple, Microsoft, Amazon, and any of the other hundreds of companies that can and do collect data about you can use "your" data for all kinds of amazing things.
This isn't limited to internet or technology companies, either. Target famously made the news when it used data to figure out that a teenage girl was pregnant before her own father found out. While the company backed away from being so obvious about its sales and advertising analysis regarding sensitive topics like this, the underlying truth remained: Target, just like every other big company, uses whatever data it has to fine tune its business. This isn't surprising.
It will be uncomfortable to hear, but it's necessary in the modern world to accept a simple truth: you are incapable of preventing all possible data tracking. Cameras, satellites, and software virtually everywhere ensure that, no matter how much technology you eschew, someone can get some data off of you. Your local store tracks your purchases. Your cell carrier tracks your calls. Your area's law enforcement tracks the roads and intersections you drive down every day. Unless you plan to move to the mountains and hide from humanity, some piece of data that describes you will probably be tracked (and even then, there's no guarantee).
The Laws Are Still Being Written
It's tempting, knowing this, to try to regain some kind of control. Someone's going to track this data, but at least it's mine, right? This GPS data describes where I have been, so it must be mine.
Do you know who owns the Moon? Well, that depends on who you ask. A number of people and organizations have claimed to own the Moon in part or in full for hundreds of years. Yes, hundreds. Even before a single human being had ever set foot on it, there were those who claimed to own it. Thus far, none of these claims are recognized by any government or authority. While there is an international Outer Space Treaty, ratified by all the major space-faring nations, that says no country can claim territorial sovereignty of celestial bodies, the much less popular Moon Treaty (yes these are real things) states that no private individual or organization can own extraterrestrial real estate. No major space-faring nation has ratified the agreement. Officially, there is no authority or government that either recognizes or forbids ownership of the moon.
At the moment, ownership of data is only slightly less enigmatic. As stated earlier, your rights can be infringed if your privacy is invaded or if your intellectual property is illegally duplicated. However, legally, you have no more of a claim to "ownership" over your data than Google does. Legally speaking, you'll have exactly the same difficulty proving you own the rights to your heart rate data as you will in proving that you own land on the moon.
This might not always be the case. Individual nations and international organizations are attempting to establishing rules governing who can collect what data and what they're allowed to do with it. Germany, in fact, has a legal concept known as "informationelle Selbstbestimmung" or informational self-determination. To oversimplify, it says that an individual has the right to decide for themselves what information can be used by whom and for what.
However, merely adopting this format internationally may not be the best solution. In fact, if it were suddenly the case that all individuals, corporations, and governments are only allowed to collect data about you if you specifically authorize it, life will get a lot more complicated. We already experience difficulties that arise from giving content creators a monopoly on distribution of their media (does having the TV on in the background of a home video count as violating copyright? This is a real question that federal courts have had to answer). Imagine extending that same complication to anything that anyone is able to measure regarding your life. Suddenly, you'd have to sign a legal release every time you swipe your credit card or walk through a store equipped with security cameras.
The question of who owns your data is not an easy one to solve. It becomes particularly problematic because you create data (whether or not it gets recorded) every time you leave your (private) house. The number of steps you take, whether you look ahead or at the ground, what types of clothes you wear, and any number of decisions you make in view of other people are all potential data points. Arguably, we haven't even discovered every type of data that can be recorded.
However, as of right now, we have not decided where we believe the power over our data lies. The effects of a data tracking culture on privacy is a legal issue that will evolve over the next few decades and if you want to have an effect on how that conversation unfolds, there's no better time. There are legitimate claims to be made that corporations and governments abuse your data. There may even be legitimate reasons to be upset because a company is profiting from "your" data. Until the legal infrastructure changes, though, none of that will change this one simple fact: you don't "own" data just because it's about you.