We at the DataPortability project have kick started a research phase, because we've realised we need to spend more time consulting with the community working out issues which don't quite have one answer.
As Chris Saad and myself are also experimenting with a new type of social organisation as we incubate the DataPortability project, which I call wikiocracy (Chris calls it participant democracy), I thought I might post these issues on my blog to keep in line with the decentralised ethos we are encouraging with DataPortability. This is something the entire world should be questioning,
So below are some thoughts I have had. They've changed a lot since I first thought about what a users data rights are, and no doubt, they will change again. But hopefully my thoughts can act as a catalyst for what people think data rights really are, and a focus on the issue at stake which I conclude as my question. I think the bill of rights for users on the social web is not quite adequate, and we need a more careful analysis of the issues.
It's the data, stupid
Data is essentially an object. Standalone it's useless - take for example the name "Elias". In the absence of anything else, that piece of datum means nothing. However when you associate that name with my identity (ie, appending my surname Bizannes or linking it to my facebook profile), that suddenly becomes "information". Data is an object and information is generated when you create linkages between different types of data - the 'relationships'.
Take this data definition from DMReview which defines data (and information):
Items representing facts, text, graphics, bit-mapped images, sound, analog or digital live-video segments. Data is the raw material of a system supplied by data producers and is used by information consumers to create information.
Data is an object and information is a relationship between data - I've studied database theory at university to be authoritative on that! But since I didn't do philosophy, then what is knowledge?
Knowledge can be considered as the distillation of information that has been collected, classified, organized, integrated, abstracted and value added
(source)
Relationships, facts, assumptions, heuristics and models derived through the formal and informal analysis or interpretation of data
(source)
So in other words, knowledge is the application of information to a scenario. Whilst I apologise if this appears that I am splitting hairs, I think clarifying what these terms are is fundamental to the implementation of DataPortability. Why this is relevant will be seen below, but now we need to move onto what does the second concept mean.
Portability
On first interpretation, portability means the ability to move something - exporting and importing. I think we shouldn't take the ability to move data around as the sole definition of portability but it should also mean being able to port the context that data is used. After all, information and knowledge is based on the manipulation of data, and you don't need to move data per se but merely change the context to do that. A vendor can add value to a consumer by building unique relationships between data and giving unique application to other scenarios - where the original data is stored is irrelevant as long as its accessible.
Portability to me means a person needs to have the ability to determine where their data is used. But to do that, they need control over that data - which means determining how it is used. Yet there is little point being able to determine how your data is used, if you can't determine who can access your data. Therefore, the concept of portability invokes an understanding of what exactly control and accessibility means.
So to discuss portability, requires us to also understand what does data control and data accessibility really mean. You can't "port" something unless you control it; and you can't "control" something, if you can't determine who can "access" it. As I state, as long as the data is accessible, the location of it can be on the moon for all I care: for the concept of portability by context to exist, we must ensure as a condition that the data is open to access.
Ownership
Now here is where it gets complicated: who owns what? Maybe the conversation should come to who owns the information and knowledge generated from that data. Data on its own, potentially doesn't belong to anyone. My name "Elias" is shared by millions of other people in the world. Whilst I may own my identity, which my name is a representation of that, is it fair to say I own the name "Elias"? On the flip side, if a picture I took is considered data - I think it's fair to say I "own" that piece of data.
Information on the other hand, requires a bit of work to create. Therefore, the generator of that information should get ownership. However when we start applying this concept to something like a social relationship, it gets a bit tricky. If I add a friend on Facebook, and they accept me, who "owns" that relationship? Effectively both of us - so we become join partners in ownership of that piece of information. If I was to add someone as a friend on MySpace, they don't necessarily have to reciprocate - therefore it's a one way relationship. Does that mean, I own that information?
This is when the concept of privacy comes in. If I am generating information about someone, am I entitled to it? If someone owns the underlying data I used to generate that information - then it would be fair to say, I am "licensing" usage of that data to generate information which de-facto is owned by them. But privacy as a concept and in the legislation of many countries doesn't work like that. Privacy is even a right along side other basic rights like freedom of expression and religion in the constitution of Iraq (Article 17). So what's privacy in the context of information that relates to someones identity?
Perhaps we should define privacy as the right to control information that represents an entity's identity (being a person or legal body). Such as definition ties with defamation law for example, and the principle of privacy: you have control over what's been said about you, as a fundamental human right. But yet again, I've just opened up a can of worms: what is "identity"? Maybe the Identity commons people can answer that? Would it be fair to say, that in the context of an "identity", an entity like a person 'owns' that? So when it comes to information relating to someones identity, do we override it with this human right to privacy as to who owns that information, regardless of who generated that information?
This posting is a question, rather than an answer. When we say we want "data portability", we need to be clear what exactly this means. Companies I believe are slightly afraid of DataPortability, because they think they will lose something, which is not true. Companies commercial interests are something I am very mindful when we have these discussions, and I will ensure with my involvement that DataPortability pioneers not some unrealistic ideal but a genuine move forward in business thinking. It needs to be clear what constitutes ownership and of what so we can design a blueprint that accounts for users' data rights, without ruining the business models of companies that rely on our data.
Which brings me to my question - "who owns what"?
Recent comments