In this together
Combining individual andcollective strategies toconfront data powerwith support fromSummary
This think piece results from discussions between four advocacy
organisations working to improve how data is governed. In our work,
we have found that common ambiguities in how individuals, groups,
rights, protections, control, and personal data are discussed can create
the impression of advocacy groups pulling in different directions andworking on separate agendas. However, by unpacking some of theseconcepts, we have sought to uncover the alignment, overlaps andconnections between our work. We offer this piece primarily with thenon-profit community in mind, in an effort to add clarity andcomplementarity to the advocacy efforts of organisations like ours.
Specifically, in this paper, we argue that individual and collective
approaches for data governance should be seen as complementary:both addressing particular challenges within the status quo.
Section one begins by setting out the challenges that come from
confusion over key terms, and how ambiguity of language can lead toorganisations with common cause being seen as at cross-purposes.
Section two explores some of the terms that can trip us up, looking indetail at five different areas of conceptual and rhetorical ambiguity:
suggesting key distinctions to make and questions to ask when
designing advocacy strategies. Section three reflects on these
distinctions, using them to map the data governance tools andapproaches that are actually available to people and groups, and thelimits of current mechanisms to challenge the status quo. The final
section notes three insights:
1. Individual data protection rights are necessary but not sufficient todeliver better governance of data at scale.
2. Many group-based data governance approaches are strengthenedby building on individual data protections.
3. Gaps remain in the data governance toolbox and requireinterlocking individual and collective governance mechanisms to fillthem.
We close with recommendations for how the advocacy community canbuild on these insights to strengthen shared work towards a more fairdata future.

1

In this together: Combining individual and collective strategies to confront data powerUnderstanding thechallenge
Power in the digital world is not equally distributed. Indeed,
concentrations of capital and data increasingly impinge upon thefreedom and autonomy of individuals and communities across theglobe. Although it is common for debates to focus on totemic examples
like the big social media, search and software companies, data power is
exercised by all sorts of institutions, from local and national
governments to banks, travel firms, and companies operating hidden
away in the supply chain.
Since the 1980s, the articulation and implementation of individual
data protection rights have gathered pace. All four of the modalities of1

regulation outlined by Lessig have been explored to create thepossibility of greater individual control over data: from the articulationof norms for fair information processing, to the creation andpromulgation of data protection laws, the development of softwarearchitecturesthat

supportdecentralised

control

of

data,

and

articulating data ownership narratives to attempt to challenge thedominant market power of data-extractive firms.
2

Discussions of data governance have often been dominated by thelanguage of privacy and personal data protection. However, concerns
have increasingly been raised about the sufficiency of frameworks
focussed solely on individual data rights. Viljoen has pointed out how
3

the relational nature of data creates challenges for ownership-based
approaches to data control, and companies have been accused of coopting a discourse of privacy norms to create privacy-theatre regimes
of notice-and-consent that provide limited meaningful control for
4

individuals. Data protection laws appear to have done little in practice
to re-balance power between data subjects and data holders.
Concerns about the limitations of individual rights frameworks have
led to work on how to secure the data rights of, and control over data
for, groups and communities. Multiple advocacy initiatives andinstitutions have been launched, and numerous new structures for data
control and governance have been proposed, from commons and co5

operatives to trusts and unions. There is a host of theoretical and legal
writing attempting to understand what is needed and what is feasible in1

Lessig, Lawrence. Code: And other laws of cyberspace. 19992

We use the term “data governance” to refer to the ways in which decisions are made about how andwhether data is collected, shared, analysed, and used in decision-making, in both policy andpractice.

3

Viljoen, Salome. (2020). A Relational Theory of Data Governance,
http://dx.doi.org/10.2139/ssrn.3727562

4

Waldman, Ari Ezra. Industry unbound: The inside story of privacy, data, and corporate power.
Cambridge University Press, 2021.

5

For a mapping of organisations working in this space, see the Datasphere Atlas (2022) at
https://www.thedatasphere.org/programs/intelligence-hub/datasphere-governance-atlas/.

2

In this together: Combining individual and collective strategies to confront data power

6

terms of the collective governance of data.

Too often, however, collective and individual arguments are framedin opposition to one another, with individual data rights and ownershipon one side and arguments for collective governance of data on theother.

This

framingrisks

anadversarial

approach,

in

which

communities working to challenge the status quo through individual
rights, and those working on collective governance, appear to bepulling in opposite directions. Instead, in this paper, we argue that
individual and collective approaches for data governance should beseen as complementary: both addressing particular challenges within
the status quo and aiming at responsibly unlock the value and benefitsof data for all.
To show how, we first need to unpack what has become a quite
messy discourse: with confusing overlap and ambiguity of ideas about
various topics, including personal and non-personal data; the nature ofgroups and their formation; and the difference between the governanceof collective data and the collective governance of data. The popularuse of oversimplified analogies has contributed to confusion, inhibiting the advocacy community’s potential to leverage thecomplementary power of individual and collective rights, governancemodels, incentives, and opportunities.
This ambiguity represents an opportunity cost that the authors of
this paper have experienced first-hand in various ways, inhibiting theempowerment and protection of people and groups. As advocacy
organisations playing different roles, in varied geographies, andworking with different configurations of stakeholders in this fastdeveloping space, we come to this essay because we have foundourselves heading in a common direction, yet through different
lenses.

We

believethatmeaningful

deliberation

can

help

to

disambiguate apparent contradictions, thereby strengthening our
independent and shared advocacy efforts. We need more careful
thinking and measured distinctions to advance the different ways inwhich individuals and groups can take control over how their data isused and shared, and how those arrangements should benefit theminstead of harming them.
6

Select examples include: Abraham, R., Schneider, J., & vom Brocke, J. (2019). Data governance: A
conceptual framework, structured review, and research agenda. International Journal of Information
Management, 49, 424–438. https://doi.org/10.1016/J.IJINFOMGT.2019.07.008; Asaf Lubin. (2023).
Collective data rights and their possible abuse. Temple Law Review, 95(4).
https://www.templelawreview.org/essay/collective-data-rights-and-their-possible-abuse/;
Chapter 3-4 in Punia, S., Mohan, S., Kakkar, J. M., & Bhandari, V. (Eds.). (n.d.). Emerging trends in data
governance. National Law University Delhi Press. Retrieved August 13, 2023, fromhttps://ccgdelhi.s3.ap-south-1.amazonaws.com/uploads/nlu-delhi-law-book-2022-ff-web-345.pdf;
Viljoen, S. (2021). A Relational Theory of Data Governance. Yale Law Journal, 131(2), 573–654.
https://www.yalelawjournal.org/feature/a-relational-theory-of-data-governance;
Marcucci, S., Alarcón, N., Verhulst, S., & Wüllhorst, E. (2023). Informing the Global Data Future:
Benchmarking Data Governance Frameworks. Data & Policy, 5, E30.
https://doi.org/10.1017/dap.2023.24. See also Data Governance and the Datasphere Literature
Review, by the The Datasphere Initiative Foundation. December 1, 2022.

7

De La Chapelle, B. and L. Porciuncula (2021). We Need to Talk About Data: Framing the Debate
Around Free Flow of Data and Data Sovereignty. Internet and Jurisdiction Policy Networkhttps://www.internetjurisdiction.net/uploads/pdfs/We-Need-to-Talk-About-Data-Framing-theDebate-Around-the-Free-Flow-of-Data-and-Data-Sovereignty-Report-2021.pdf

3

In this together: Combining individual and collective strategies to confront data power

6This piece aims to contribute to that effort by sharpening several
common concepts, and suggesting how the distinctions drawn can help
us think about the digital society we are fighting for.

Clarifying concepts
This piece aims to contribute to that effort by sharpening several
common concepts, and suggesting how the distinctions drawn can help
us think about the digital society we are fighting for.

Personal and non-personal data
Personal data is sometimes defined as data that originates from or byindividuals or their actions, and at other times defined as any data
which can be associated with individuals (data from me, vs data aboutme).8 In other words, "data from me" is information actively provided
8

Data "From Me" refers to information that an individual voluntarily provides or generates. This data is
actively shared by the data subject. It includes data that individuals intentionally submit or create,
often as a result of their actions, choices, or interactions. Examples include: (a) Personal details
provided when filling out a job application, online form, or social media profile. (b) Content andmessages shared on social media platforms or via email. (c) Preferences and settings chosen on
websites and apps, such as selecting favourite products or customising user profiles. (d) Data
generated by wearables and smart devices, like fitness trackers or smart thermostats, based on user
activity. Data "from me" is typically within the individual's control, and they have the ability to decide
what information to share and with whom. Data "About Me" may include data “from me”, but may also
be collected, observed, or inferred by external entities, such as companies, organisations, orgovernment agencies, without the active involvement of the data subject, often for the purposes ofmarketing, research, or service customization. This can include (a) Purchase history and browsing
behaviour tracked by online retailers or advertisers. (b) Location data collected by mobile devices orapps, showing where the individual has been. (c) Health records maintained by healthcare providers
and insurers. (d) Social media analytics data, including information about a person's online behaviour
and interactions. Many data protection laws, including the GDPR and the California Consumer Privacy
Act (CCPA), define personal data as data “about me”.

4

In this together: Combining individual and collective strategies to confront data poweror generated by the data subject, whereas "data about me" isinformation collected or inferred by external entities. These point to aconceptual distinction that helps in understanding the origin andcontrol of personal data.
There are subtle and important differences between these twoconceptualizations of personal data, particularly in terms of how
individuals might be able to control each kind of ‘personal data’.
However, both these definitions are problematic because they exclude
many types of data with implications, associations, and consequences
for human persons (data that impacts me).
Data from people might be considered ‘non-personal’ (no longer
strictly about them) when it has been anonymized. Data protection
mechanisms focused on individuals generally do not account for such
dynamics, yet this type of data can nevertheless drive decisionmaking that directly affects people in very personal ways, impacting
their access to healthcare, the types of political discourse they are
exposed to, or policy and regulations with direct impacts on their
daily lives, from the planning of urban transit to the access to social
benefits.
Similarly, data that has not been created by, or even strictly about,individuals, such as satellite imagery, waste-water quality monitoring,or economic reports can have very personal consequences when used
to

make

decisions

on

land

rights,lockdowns,

infrastructuredevelopment, or the local allocation of public resources. In this andother ways, so-called non-personal data can affect individuals andgroups immediately and personally, if in a manner that is often
opaque and difficult to discern.
Distinguishing between ‘data from me,’ ‘data about me’ and ‘datathat impacts me’ is important because it highlights how ‘nonpersonal’’ data is nevertheless personal. Even though these categories
may overlap in practice or regulation, distinguishing between themhighlights the different kinds of data protection strategies and toolsthat are available for each.

Data from me

Data actively provided or
generated by an individual.

Data about me

Data that relates to anindividual, but that wascollected or inferred by athird party.

Data that impacts me

Data with implications,associations, andconsequences for anindividual.

ExamplesSocial media posts; address
information provided whensigning up for a service; anddata from a smart watch.

5

The inferred profile anadvertiser creates; healthrecords made by thedoctor; and ratings of a gig
worker.

Wastewater monitoring
used to decide on
health lockdowns;
aggregate transport
data used to plantransit infrastructure.

In this together: Combining individual and collective strategies to confront data powerCollectives, communities and groups
Recognising that the value of data often exists not at the level ofindividual records, but in the collection of data about, or impactingon, groups of individuals, there has been considerable focus in recent
years on collective and community models of data governance. The
terms ‘collective’ and ‘community’ are sometimes deployed with an
explicit or implicit normative connotation, pointing to ideas ofcollective interest, or drawing on a positive ideal of community. To
separate the normative from the descriptive, we find it useful to focus
on groups in data governance and to look at how groups are definedby agency, purpose, and the grounds on which group rights are
established.
Individual agency and group dynamics
Increasingly, the data-driven decisions that most affect us are notpersonal data associated only with us as individuals, but are based ongroups in which we have been placed without our knowledge:
amalgamations of our collective consumption behaviours, mobility
patterns, communication, and demographics. We can call these“automatic groups”, and we can distinguish them from what we mightcall “express groups”, which are formed deliberately. People explicitly
and deliberately join political parties and labour unions, they enrol inpatient-driven health research, they join online forums and support
groups set up for people just like them, and social media platforms for
all types of people.

Automatic groups

Express groups

A group that individuals are placed into by athird party without their direct action, andon the basis of some collection of data points
or features.

A group that an individual voluntarily
opts in to join through some express
action.

ExamplesMarketing categories; people in healthrecords with a given configuration ofsymptoms; people with particular travel
patterns.

Labour unions, political parties, online
forums, social media groups etc.

However, even when an individual decides to join an “expressgroup”, their data might end up being collected and used to form an“automatic group”. Data on social media groups and communities isfor example often aggregated, compared, used in decision-making,and sometimes sold or shared with third parties.
6

In this together: Combining individual and collective strategies to confront data powerGroup purpose and data focus
The distinction between automatic and opt-in express groups is
intuitive, but more nuanced than it first appears. There are different
degrees of awareness and agency involved in joining a group. Between
the extremes of unknowingly being placed in a dataset, to actively
joining an initiative so that it can use people’s data for their benefit,
there are the grey zones: you may know that you belong to a groupthat you did not actively join, such as your neighbourhood or tax
bracket; you may know that you are joining a data group by signing up
for an online service, but not know what it implies; you may join agroup like a homeowners’ association because you had no pragmatic
option to decline membership.
In this context, the motivations driving group participation andthe objectives of these groups carry significant weight. Lately, various
express groups have been exploring the establishment of legal ororganisationalframeworks,

such

as

data

trusts,cooperatives,

stewardship, and collective governance structures, all with theexplicit aim of safeguarding and empowering their members byinfluencing the management and utilisation of their data. The choice
to join a collective focused on health data sharing for medical
research, even when anonymized, differs substantially from becoming
a member of a car-sharing group or a frequent fliers club. This isbecause despite the similarity in the effort required for joining andthe potential for each to impact how their data is collected, utilised,and shared externally the intent for joining each group is very
different. The goals of these organised groups and the level of active
involvement from their members also align with their ability andpotential to proactively govern their data, particularly in response topotential harm or misuse.

Data as a primary focus

Data as a secondary focus

Groups formed or joined with the explicit
goal of exercising control over data.

Groups formed or joined that can exercise
some control over data, but where this is
more-or-less incidental to the groups main
purpose.

ExamplesHealth data sharing co-operative. Energy
data trust. Data-focussed campaign group.

7

Car sharing group. Frequent fliers club.

In this together: Combining individual and collective strategies to confront data powerGrounds for group rights
The purposes and the motivations of groups can also influence thejustifications for groups’ data rights and governance strategies, andwe can distinguish between two main theoretical premises for vestingdata rights in groups:

10(a) The Choice Theory, where group rights primarily serve as anaggregation of individual values, providing a choice to holders in
11

exercising their rights. Key features of choice theory include:
individual autonomy,

aggregation of interests, exercise ofindividual rights, protection of minority interests to ensure thateven minority views and preferences are considered in groupdecision-making.
(b) The Interest Theory, which places greater emphasis on
safeguarding collective interests that may extend beyond themere aggregation of individual interests, thus emphasising theimplicit moral imperative to safeguard collective interests that
may be more than the aggregated interests of its individual
12

members. Key features of interest theory include collective
interests that are unique and independent from individuals, a
moral imperative to protect and promote the interests of thegroup as a whole, the balancing of interests and prioritisation of
the broader group interests and identity above those of theindividual.

Viewing group rights from the lens of the choice theory resonateswith market-driven paradigms, where the aggregation of individual
preferences and actions forms the basis for determining groupoutcomes. In the community data context, this theory underscores
the idea that collective rights emerge as a natural consequence ofindividual contributions, ensuring that each participant's voice isaccounted for in the group's decision-making.
On the other hand, interest theory introduces a moral dimension
to the discussion of group rights. Here, the interests of a group takeon a separate identity that holds a broader moral significance than
combined

individual

concerns

alone.

The

interest

theoryacknowledges the implicit moral responsibility to safeguard thiscollective well-being, accounting for the power dynamics withininterconnected digital networks that may disproportionately impact
certain groups.

10Preda, A. (2015). Rights: Concept and Justification, Ratio Juris, 28: 408-415,
https://doi.org/10.1111/raju.12090

11

De George, R. T. (1987). Review of Collective and Corporate Responsibility., by P. French, Noûs, 21(3),448–450, https://doi.org/10.2307/2215198

12

Ruben, D. H. (2008). Review of The Reality of Social Groups, by P. Sheehy, Mind, 117(467), 731–735,
http://www.jstor.org/stable/30166335

8

In this together: Combining individual and collective strategies to confront data powerImportantly, the two rationales do not stem directly from groups’
purposes or the agency with which they are formed as express or
automatic. They instead provide a third distinction that we believe
can be helpful for thinking about different types of groups in data
advocacy strategies.

What defines a group?

AgencyAre groups express (I decided to join) or automatic (I was added to it)?

PurposeAre groups joined or formed specifically in order to affect how data isgoverned?

Grounds forgroup rights

Are the rights associated with the group reducible to the sum of therights of the individual members or is the group a subject of rights
beyond the sum of the rights of its individual members?

These three dimensions present in the table above are by no means
exhaustive. Many other distinctions could be made, and there is aburgeoning literature on group rights and data rights that suggests
several useful ways to think about different kinds of groups and theirconsequences. We nevertheless believe that these three distinctions
are particularly helpful for tactical thinking and that answering thesequestions in the design of advocacy strategies can strengthen theirlegitimacy and impact.

Control, consent and agency
When we think about how individual and group-based strategies are
deployed to govern data, we can distinguish between ‘taking backdata’ and ‘taking back control’.
Individuals may use data protection or human rights legislation to
demand that third parties collect, process or delete data in fair ways.
Similarly,groupsmight

mobilisetoadvocateforcompanies,

institutions or industries to change their data governance practices or
to make concessions to community demands. If successful, these are
instances in which individuals and groups take back control over how
their data is used.
Other approaches might go further than exercising influence orcontrol, and seek to take back de jure or de facto ownership of data.
Decentralised technologies, personal data stores, and data trusts orcooperatives are all means of taking back data. That is, structurally
relocating data or copies of data from centralised datasets owned andcontrolled by third parties (often corporations or governments) into
databases owned or controlled by the individual, or by an organised
9

In this together: Combining individual and collective strategies to confront data powergroup of individuals who have come together to create their own
data-holding structures.
All of these approaches face significant challenges. Both taking
back control, and taking back data, frequently require some level oftechnical capacity, as well as the time and resources to engage more
directly with questions of how data is, or should be, managed. Efforts
to take back control by securing agreements or concessions fromlarge data-using organisations are only effective if those organisations
actually honour and implement commitments, and it can be difficult
without solutions either in code or through regulatory action, tosecure the oversight needed to make sure this is happening. Manytechnical solutions to take control of data directly involve taking a
copy but do not prevent third parties from maintaining and using
their own copy of that data as they see fit.
It is also worth noting that any efforts made by groups toproactively govern data, or seek redress for data misuse, will likely be
implemented

throughaprincipal-agent

relationship,

in

which

members of the group empower others to act on their behalf. Thismechanism has great potential to strengthen individuals’ limited
capacity and expertise to take control over data governance, and thisis often the entire point of stewardship models like data cooperatives,
collectives, or trusts. Such groups remain prone to some of the otherchallenges

that

relationships,

often

plaguehowever,suchgovernanceasinprincipal-agent

compounded

information

asymmetries, the deviation of interests over time, and adequately
funding fiduciaries. There are also potential legal challenges. The EU
Data Governance Act, for example, notes that the rights from the
GDPR can only be exercised by an individual and cannot be conferredor delegated by them to another party, such as a data cooperative,
thereby limiting any exercise of data protection rights by agents onbehalf of principals.

13

A distinction can also be made between the capacity of individuals
and the capacity of groups to exercise control over their data before
that data has been accessed by a secondary or third party. This typeof control is most usually exercised by mechanisms of consent, which
for individuals is often limited by skewed incentives and insufficient
information, knowledge, or expertise if consent is even legallyrequired or requested in the first place. Group consent, on the other
hand, is generally not recognized as a requirement for dataprocessing or use, though data collectives and stewards may be able
to demand consent if they have exclusive control over valuable data.
In such cases, it can be argued that the use of group data be based ona legitimate interest defined in dialogue with groups.
The capacity of groups and individuals to exercise control overtheir data is most obvious in regard to the legal basis for individuals’
data protection and privacy rights for individuals. Codification of
those rights does not guarantee them, however, and there are
multiple factors influencing the capacities of both individuals and
13

10

See https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0767, Recital 24.

In this together: Combining individual and collective strategies to confront data powergroups to take control over their data, at the point of its creation, use,
or in redress.

Questions about meaningful control

Control vsstorage

Do people need to host and have exclusive control over their data inorder to control how it is used? What are the limitations to control
through storage?

Prior consent

What options can be exercised to assert control over data before it isused or processed? What factors limit the ability of individuals andgroups to demand consent or other legal justifications for data use?

Principal vsagent

Do the limitations on individuals’ capacity for control or consent
suggest the need for representation by an agent? What are thepractical and legal obstacles and opportunities?

Rights and their legal foundations
Advocacy commonly references the idea of data rights, referring bothto individual and collective rights to control and agency over data.
However, the legal foundations for these different kinds of rights aredeveloped to different degrees, and where the former may frequently
involve reference to established legislation, the latter often involves aset of normative claims rather than invocation of codified law.
The privacy and data protection rights of individuals are clearly
established in landmark legislation such as the EU’s GDPR, theBrazilian data protection law (LGPD), and other national regulatory
frameworks around the world. While the GDPR and comparable
regulations articulate multiple rights for individuals, it is unclear
whether there are sufficient legal and practical mechanisms forindividuals to easily and meaningfully exercise their formal rights toaccess, port, delete or otherwise seek redress for their data. This isparticularly the case in many contexts where these rights are not wellknown. Nor is it clear that these rights are applicable for data basedon automatic groups or de-anonymized data defined as non-personal
data in specific regulations.
14

Increased awareness about the implications of co-generated andaggregated data on groups has prompted a discourse on groups’
privacy and data rights, but there is little positive law establishingsuch rights as present. Though the EU Data Governance Act

14

For a detailed discussion in the UK regulatory context, see the forthcoming Connected By Data
policy brief https://docs.google.com/document/d/1kenOrkFWO4A7nfBd_2WB_rf8TA_QAtZwPl12Kvq5PaI/ed
it#heading=h.jgmduqp1336.

11

In this together: Combining individual and collective strategies to confront data power

recognizes the importance of collective groups in its treatment ofdata altruism, that act explicitly restricts the rights it articulates to15

individuals. There have been some efforts to build collective digitalrights on the basis of more traditional collective rights that areawarded to minority groups in some jurisdictions. A significant
amount of work has been done across the world to bring legal

16

collective actions on the basis of groups’ data rights for example.

International human rights law may also provide a basis for thisthroughthecollective

rightstoself-determination,

language,17

collective identity, and other cultural rights. Early explorations of thispotential have emphasised the mutually reinforcing nature of18

individual and group rights to privacy. The Indian Judiciary, forexample, in examining the boundaries of a fundamental right toprivacy, has explored the intersection of the general right to privacy
with an individual’s group-based identities, supporting the exercise ofsuch identity characteristics through recognition of group privacy
rights.19
While codified rights exist almost exclusively for individuals, there
are a few examples of rights for groups. The UN Declaration on the
RightsofIndigenous

Peoples

cultural,linguistic,

maintaining

recognises
and

the

religious

importanceidentitiesofwithinindigenous communities. Within the digital ecosystem, there is a20

growing discourse around indigenous data sovereignty (“IDS”) whichrefers to the right of indigenous peoples to control data from andabout their lands and communities, both on an individual andcollective level. IDS concerns itself with both electronically stored
data as well as knowledge, meaning the scope is far broader than fortraditional data governance frameworks. The Anti-Racism Data Act in
British Columbia is one example, recognizing specific rights for21“indigenous peoples” in the use and governance of data about them.

Despite these early developments and foundations, group data
rights have not been widely recognized in law or practice. This
contrasts starkly with the proliferation of data protection regulations
around the globe. Additionally, it would be a mistake to assert that15

See https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020PC0767, Article 9
and preamble, respectively.

16

See for example this collection of lessons from the Digital Freedom Fund,
https://digitalfreedomfund.org/collective-redress-lessons-from-around-the-globe/.

17

ICCPR references self determination loosely, ICESCR the others. Both are hard law, UN Decl’ on
Indigenous ppls rights, has some customary and soft law force.

18

Linnet Taylor, Luciano Floridi, and Bart Van Der Sloot (eds.) Group Privacy: New Challenges of Data
Technologies. Heidelberg: Springer International Publishing. See
https://www.researchgate.net/publication/321537799_Group_Privacy_New_Challenges_of_Data_Technologies

19

Alevoor, S. (2022). Decisional Autonomy and Group Privacy – on the Karnataka High Court’s Hijab
Judgment, Indian Constitutional Law and Philosophy,
https://indconlawphil.wordpress.com/2022/03/22/guest-post-decisional-autonomy-and-groupprivacy-on-the-karnataka-high-courts-hijab-judgment/

20 Carroll Rainie, S., Kukutai, T., Walter, M., Figueroa-Rodriguez, O. L., Walker, J., & Axelsson, P. (2019).

Issues in Open Data - Indigenous Data Sovereignty, The State of Open Data: Histories and Horizons,
https://www.stateofopendata.od4d.net/chapters/issues/indigenous-data.html
2112

See https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/22018

In this together: Combining individual and collective strategies to confront data powerthis proliferation sufficiently protects individual data and privacy
rights, as there is considerable reason to doubt whether formal rights
are sufficiently actionable even for individuals in all the circumstanceswhere it matters.

Considering the legal foundations of group and individual data rights

SourceConsiderations

Individual rights todata protection

Well established through dataprotection laws

Even the most advanced andprogressive data protection laws
remain dependent on theawareness and capacity of
individuals to exercise theirrights, and are not clearly
actionable.

Group data rights

International human rights law,select national jurisprudence
and subnational law.

Though not yet firmly
established as legal rights, there
are strong conceptualarguments for the legal
foundations of group rights.

Proactive and reactive data governanceWe can distinguish between proactive and reactive strategies andinterventions for data protection and empowerment. Reactive
approaches are those that attempt to address a harm that has beencaused or a problem that has emerged. The discourse of dataprotection is often focused on these types of strategies, for redress orpunitive action. Reactive strategies in this vein can involve complaints
21
to authorities or data-using companies, requests for information
about data held or data used, or even litigation or administrative
procedures to stop data use or actions taken on the basis of data use.
Proactive approaches, on the other hand, are often associated withenabling individuals or groups to exercise better control over theirdata before it is used or before harms occur. This is sometimes
articulated in the context of digital rights literacy and awarenessraising. More often, proactive approaches are described in the holistic
and ambitious rhetoric of data empowerment or digital self22

determination, associated with the ways in which data can beleveraged, unblocked, and shared to benefit society, generate
economic value, and improve people’s lives.
There are obvious conceptual linkages between these two
approaches. When people are empowered to better understand how
their data is and can be governed, they gain the knowledge that isrequired to meaningfully claim and enforce their data protection
rights. The protection of data from uncontrolled sale and exploitation
increases its value and can empower groups to organise and22

13

Verhulst, Stefaan G. "Operationalizing digital self-determination." Data & Policy 5 (2023)

In this together: Combining individual and collective strategies to confront data power

collectively benefit from the deliberate and informed sharing of that
data.
There is nevertheless a tendency for data protection and dataempowerment to be viewed as unrelated, or even mutually exclusive
phenomena. This is perhaps linked to the very different types ofexpertise and action required for reactive and proactive strategies forbetter data governance. While reactive approaches to data protection
will often require legal action or expertise for complaints, proceduresor litigation, proactive approaches to data empowerment will often
involve awareness raising, organisation and mobilisation.

Reactive

Proactive

Addressing harms caused or problems thathave emerged.

Enabling individuals or groups to decide inadvance how data should be used.

ExamplesComplaints; arbitration; legal action.

14

Campaigns; institution building; literacy
building.

In this together: Combining individual and collective strategies to confront data power

Assessing available actions
Reflecting on some of the distinctions explored above, this section
considers what tools and approaches are practically accessible andactionable for individuals and groups that wish to control thecollection and use of their data and data that affects them.

A

preliminary mapping is presented in the below table, distinguishing
the tools and approaches that are available to individuals and groups,
and between those that are proactive and reactive, as described in theprevious section.

Tools and approaches for data governance by individuals and groups

15

IndividualsGroupsProactive

Individuals can proactively assert
control over how their data is collectedor used byeducating themselves about how
their data is used by different
platforms and services and adapt
their online behaviour to avoid
specific platforms and services;using privacy-protecting tools liketor browsers, encryption tools, orother technologies;
Using data intermediation services
to help manage and control theirpersonal data; ordeclining to share data and use
services that would use their data
without consent.
Notably, these approaches all requireawareness and capacity and is much
more difficult to apply to data that may
impact individuals, but is created orcollected by third parties without theirknowledge.

Groups such as data collectives andcollaboratives can be organised to manage
the capacity demands on individuals, andmake decisions about services, platforms
and sharing on behalf of the group. As withindividuals, this is only applicable to data
provided ‘from’ the group. By aggregating
individuals’ preferences, groups can also
strengthen the political power ofindividuals, which can strengthen theirposition to negotiate terms of data use,
particularly if the group has sole control
and access to valuable data.

Reactive

Data protection laws like the GDPR
provide individuals with complaint andredress mechanisms with which to takecontrol over how their data is being
held and used. Traditional privacy
rights might also be asserted injurisdictions without data protection
laws. These legal approaches apply only
to personal data as legally defined, andrequire an individual's awareness, time,and ability to navigate often complex
legal processes and corporate
policies. When individuals arenegatively impacted by data (which
may or may not be about them orprovided by them) they can also resort
to traditional procedures andcomplaint mechanisms such as those
provided by administrative authorities.

Data protection laws often provide no, or
limited, rights to bring an action on behalfof a group, limiting the legal route togroup redress under data protection
legislation.There is, however, a strong
precedent for using group rights as a basis
for administrative and legal complaints not
related to data protection.

In this together: Combining individual and collective strategies to confront data powerReflecting on the above table highlights that there are relatively few
tools and approaches available for either individuals or groups, andthe few that do exist are often unevenly accessible in different partsof the world and require significant technical and situational
capacities that not everyone has. The tools and approaches available
to individuals are much more mature than those available to groups
but are far from sufficient. Furthermore, proactive strategies relevant
to data ‘from’ or ‘about’ individuals face significant barriers toreaching transformative scale. They may also face significant equity
challenges, and by empowering well-resourced groups can risk
leaving others behind. At the same time, proactive and reactive group
strategies that ignore the existing legal rights of their members may
be missing important tools that could bring strength to voluntarycooperation or group actions. Individual data rights, such as the rightof an individual to see the data a company holds about them, can be
instrumental in revealing systemic problems, but responding to those
problems may require group action whether through courts of law, or
public mobilisation and the court of public opinion.
The table also reveals a significant gap in actionable tools andstrategies to address ‘data that impacts’ both individuals and groups.
Data protection law can often be difficult to leverage in these cases,
due to strict applicability considerations and challenges in defining
the relationship between decision-making and the data on which
23

decisions are based. In such cases, an appeal to substantive rights
related to the harm experienced (whether at an individual or grouplevel) might be more effective than asserting data protection rights tochallenge problematic, illegitimate or harmful data practices.
It is also worth noting that much of what is referenced above is
still evolving or emergent, and there appears to be a complementary9development of approaches that can be used for individuals andgroups to assert control over their data and the data that affects
them. But the toolbox is far from complete, and there are very few
truly accessible mechanisms through which people can have a sayover their data.

23 For a discussion, see https://connectedbydata.org/events/2023-09-27-connected-conversation-collective-data-rights

16

In this together: Combining individual and collective strategies to confront data powerAligning and expanding
advocacy
Rapid advances in the capacity and implications of aggregated datarequire that we rethink how data and society interact, and what a fairdata future looks like. It has prompted new concerns and focus among
the advocacy community, and this is important.
We have also witnessed how discourses around individual andgroup-based data governance have at times been painted as opposing
responses, pulling in opposite directions from the status quo. Theremay be some for whom concepts of individual data control orcollectivisation of data are first-order values, to be prioritised above
and to the exclusion of all else. We believe that in the majority of cases,
however, individual and group-based approaches are complementary:offering an overlapping set of tools to target and transform the statusquo. It is only by having a clearer picture of the particular affordancesand limitations of individual and group-based data governance tools,
and of the gaps that remain in the data governance toolkit, that we candevelop more powerful, inclusive and integrated approaches.
This complementarity can be hard to see, in part because of theambiguity explored in chapter two. We see this complementarity mostclearly when we think about data governance from the perspective of
actual people. As considered in chapter three, doing so provides three
key insights:
Individual data protection rights are necessary, but not sufficient,to deliver better governance of data at scale.
Many group-based data governance approaches are strengthenedby building on individual data protections.
Gaps remain in the data governance toolbox and requireinterlocking individual and collective governance mechanisms to fillthem.
The remainder of this chapter is based on the understanding that there
is no fundamental opposition between the premises for individual dataprotection and group data rights, between proactive strategies andreactive strategies, or between the legal bases of protecting personaland non-personal data.

Instead, it takes the complementarity

identified above as a starting point for thinking about how to better
advocate for better data governance. This is an opportunity for the
advocacy community to coordinate and amplify our common efforts
towards fixing the status quo, rather than pull in opposite directions
and dilute our efforts.

17

In this together: Combining individual and collective strategies to confront data power

Recommendations for more impactfuladvocacy
Based on our analysis and organisational dialogue, we draw five highlevel recommendations for advocates in the data space:#1 Use the language of “personal data” with caution.
Debates about whether data is personal data or non-personal data canbe misleading, inadvertently excluding data “about me” and data “thatimpacts me” from the scope of political discussion. Advocates should
beware of categorical distinctions between personal and nonpersonal data in legislation and corporate policy, and take care not toreinforce arbitrary distinctions that disempower people and theircontrol over the data that affects them.

#2 Be wary of simple solutions.
The ambiguities explored in section two can encourage simplified
thinking about data governance. While simple messaging andcommunication

are

often

powerful,

carefully

consideringthedistinctions proposed in that section can help refine the strategies
and communication that underpin effective advocacy. We should be
mindful of how the right mix of complementary strategies focused ongroups and individuals can help us achieve our near-term goals. We
also need to remain attuned to the very limited scope of tools andapproaches available for people to control their data, and recognizethat the fair data future we aim to facilitate will inevitably require a
coherent combination of individual and group rights and protections.
We need to start laying a nuanced foundation for this now.

#3 Balance legal advocacy with other approaches.
The proliferation of data protection laws is an important milestone,
and further work needs to be done to establish and expand the legally
actionable rights of individuals and groups to control how their data isused. Even when strong legal rights and protections are established,however, they can often be difficult to invoke or implement, and theprinciples they represent will rarely be immediately implemented inpractice by companies and government agencies. Action-focused
advocacy can support legal advances in many ways. Collective action
campaigns can help to activate legal protections or remedies. Legalawarenessraisingandcapacity

development

can

raise

the

expectations and capacities of the general public, and incentivize
decision-makers towards reform. In this sense, the law is both animportant and multi-functional tool in the advocacy toolbox. It is
likely to be most effectively leveraged in context and combination
with other advocacy strategies. Multi-functional teams with lawyers
and other types of experts can be especially well suited to this kind of
advocacy.
18

In this together: Combining individual and collective strategies to confront data power

#4 Coordinate meaningfully and visibly.
We are more than the sum of our parts, and we need to embrace thecomplementarity of our various focus areas and expertise to pursue
the complex systems change we aspire to. For advocacy initiatives
aligned with a particular pole on the continuum between “personaldata” and “collective governance” this is an imperative and an
opportunity to coordinate our efforts. We should align our strategies
15

and our messaging to be mutually supportive of the futures we areworking towards. We should do so in ways that maintain our distinct
contributions to the advocacy ecosystem in which we operate, butthat recognize and broadcast how the puzzle pieces fit together.
Collaborative communications, projects, and fundraising can help
signal to the wider community of stakeholders the importance of
thinking holistically about individuals, groups, and data governance.

#5 Remember that narratives matter.
At the end of the day, successful advocacy often depends on having agood story, about why the issue matters, about how the outcome willaffect us and others, about why people should care in the first place.
These stories are inevitably informed by subtle but widely recognised
narratives about data and society, and most of those narratives havebeen established by powerful stakeholders like governments andcompanies. They often rely on some of the ambiguities explored in
section two to limit the scope of people to take control of theirdata
16
and the way it is used to impact their lives. In the wake of increasing
public awareness about data privacy and AI, the advocacy community
has an opportunity to craft new narratives that move beyond implicit
dichotomies about personal or non-personal data, about individuals
or groups. We have an opportunity to build new narratives about
people, control, and a fair data future. This is the story we should tellwhen we communicate, litigate, train and explore. We’re all in this
together.

19

In this together: Combining individual and collective strategies to confront data powerAbout the organisations
MyData Global’s mission is to empower individuals by improving theirright to self-determination regarding their personal data.
Aapti Institute works for an equitable and just digital world where
people are empowered to negotiate with technology.
The Datasphere Initiative is dedicated to global collaboration ontechnical and policy solutions for the urgent, multidimensional, andcross-border challenges of data governance.
Connected by Data campaigns to put community at the centre of datanarratives, practices and policies by advocating for collective andopen data governance.

About this publication
Authors: Christopher Wilson (MyData Global), Tim Davies (Connectedby Data), Vinay Narayan and Avani Airan (Aapti Institute), Viivi
Lähteenoja (MyData Global), Carolina Rossini and Sophie Tomlinson(The Datasphere Initiative)
Design: Sille Sepp
Citation information: Wilson, C., Davies, T., Narayan, V., Airan, A.,
Lähteenoja V., Rossini, C., and Tomlinson, S. (2023) In this together:
Combining individual and collective strategies to confront data power.
Published December 1, 2023.
This paper may be shared or adapted with attribution under
Creative Commons Attribution 4.0 International (CC BY 4.0).
Download this publication at https://mydata.org/publications

Join MyData Global at mydata.org/membership
Email us at hello@mydata.org
Follow us on X @mydataorg
Visit us at mydata.org

9

In this together: Combining individual and collective strategies to confront data power