The rhetoric of Web3 is full of claims that it’s all about, in part, the ownership of your own data. And self-sovereign identities (SSI) are about “owning” your identity.
But what does that mean?
A typical formulation is this one by digital strategist Emanuela Ferraro, who says that Web3 means “individuals, not intermediaries, can ultimately own and manage their own data free from centralised control.”
It’s about “disrupting centralisation” and “putting users back in control” of their data.
“In Web3 users can finally choose the information they want to share and with whom,” she writes.
“Users’ identities comprise big data set[s] defining individual taste, consumption habits, and behavioural patterns. Essentially, we are the data we ‘own’.”
But again, what does that “own” actually mean?
Professor Lyria Bennett Moses of the University of New South Wales Law School tackled this question from a legal angle and discovered “conceptual confusion”.
Ownership, she said, is “too contested a term in this space to be helpful” — at least in the context of her case study, the sharing of information for law enforcement purposes.
The “owner” of a piece of data might be who created it, or who first recorded it, or who collected it, or whose algorithm generated it, or who paid for the data, or who has a copy of it on their computer, or who has responsibility for its security, or simply whoever knows it.
Another view is that the owner of data is the subject of the data, the person or other entity that the data is about.
But personal data is just a set of facts, and nobody owns facts. Not in the sense of property rights. Not like owning a car or a toaster.
No one owns the fact that you were born on a particular date any more than anyone owns the fact that the diameter of Jupiter is 139,820 kilometres. It just is. And no one can stop me from telling someone else. Not even you.
Except, perhaps, the law.
It’s worth noting that the “ownership” of personal information isn’t a feature of the NSW Privacy and Personal Information Protection Act 1998 (PPIPA), nor other Australian privacy law, nor the EU’s General Data Protection Regulation (GDPR).
These regimes are about protecting personal data by putting limits on its collection, use, re-use, and disclosure without reference to owns it.
Given all this, it’s therefore best to use “ownership” metaphorically.
“Own your identity” or “Own your data” are best seen as calls to action, encouraging people to take more responsibility and more interest in the data that affects them.
Digital identity is a means to an end. Let’s foster better engagement with data, data usage, and the power of data to get things done.
Let’s try to focus on the relevant facts about people as they move from context to context, rather than some all-encompassing “Who They Are” — since that’s actually a hard question to answer out of context.