Data Ownership: Who Owns What?

Part 1: The Complex Web of Data Ownership

A natural first assumption is that the researcher who conceives of a study and collects the data is the owner of that data. However, in most formal research and commercial settings, this is incorrect. Ownership is rarely held by a single individual and is instead dictated by a web of agreements, policies, and legal obligations.

To begin, let's explore the primary stakeholders who can lay claim to data ownership.

As the ORI page makes clear, at least four parties have potential claims on the data you collect:

1. The Funder: The entity providing the financial resources for the research (e.g., a government agency, a private corporation, a philanthropic foundation). Their interest—be it public good, profit, or a specific cause—shapes their ownership claims.
2. The Research Institution: The university or organization that employs the researcher and formally receives the funds. They have legal and financial responsibilities that necessitate control over the data.
3. The Data Source (Participant): The individuals or communities from whom the data originates. There is a growing recognition of their rights and stake in how data derived from their bodies, lives, and experiences is used.
4. The Researcher: The individual investigator who designs and conducts the study. Their rights are typically delegated to them by their institution and are rarely absolute.

The most critical takeaway, emphasized at the end of the ORI reading, is that ownership must be clarified in writing before any data is collected. This is a cornerstone of ethical data management.

Part 2: Models of Data Ownership

Given these competing interests, it is helpful to think about ownership not as a single point, but as a spectrum of possibilities. We can categorize the different approaches into a few key models.

Let's examine each model in the context of your areas of interest.

1. Individual Ownership

This model posits that the individual from whom data is generated is its rightful owner. They should have ultimate control over its use, access, and distribution. This perspective is gaining significant traction, especially concerning personal and sensitive data.

In the context of technology-assisted bra design, the question of ownership is particularly acute.

As the paper highlights, even though the user generates the data with their body, the company that owns the device often claims the data. An "Individual Ownership" model, or what the paper calls "user-centric ownership," would counter this, giving the person the right to control their own body scan data.

2. Corporate / Institutional Ownership

This is the traditional and still dominant model in many contexts.

• Corporate: A company that funds or conducts research for commercial purposes (e.g., a lingerie brand) claims ownership of the data to develop profitable products.
• Institutional: A university or research institute that receives a grant claims ownership to meet its obligations to the funder and manage its intellectual property. As noted in the ORI resource, this is the default for most publicly funded academic research. The institution, not the individual professor or researcher, owns the data.

3. Shared Ownership

This model acknowledges the legitimate claims of multiple stakeholders and seeks to balance them through formal agreements. It is often the most ethical and practical approach. In a shared model, an agreement (often part of the informed consent process) would explicitly define:

• What the data can be used for.
• Who can access it and under what conditions.
• How long it will be stored.
• Whether the participant has the right to withdraw their data.

This model moves away from a confrontational "who wins?" approach to a collaborative "how do we all benefit responsibly?" framework.

Part 3: Applying the Models to Scenarios

Let's apply this framework to determine ownership in two specific scenarios.

Scenario 1: The Independent Bra Designer

You are an independent lingerie designer creating a new line of bras. To perfect the fit, you recruit 50 volunteers. You pay for a 3D body scanning service to capture their detailed torso measurements. You will use this data to create new patterns.

• Who holds ownership of the data?

  • The Designer (You): You might assume you own it. You conceived of the project, paid for the scanning, and need the data for your commercial product. This aligns with a Corporate Ownership model.
  • The Scanning Service: Their terms of service might state that they retain rights to the anonymized data they collect. You must check their contracts carefully.
  • The Participants: Each participant provided data from their own body. Following the "user-centric" model from the fashion tech paper, they have a strong claim to Individual Ownership. They might want assurances the data won't be sold or used for other purposes without their consent.

• Resolution with a Shared Model: The most robust ethical approach is a Shared Ownership model, established during informed consent. The consent form would state that:

  • The participant agrees to let the designer use their anonymized measurement data for the specific purpose of designing the new bra line.
  • The designer agrees not to sell or share the identifiable data with any third party.
  • The agreement clarifies what happens to the data after the project (e.g., it will be securely destroyed after 5 years).
    This balances the designer's commercial need with the participant's right to control their personal information.

Scenario 2: The Academic Polyamory Study

As a social researcher at a university, you receive a government grant to study the emotional dynamics of single-female-multiple-male polyamorous relationships. You will conduct and record in-depth interviews with 20 such relationship groups (pods) over two years.

• Who holds ownership of the data?

  • The Researcher (You): You might feel a strong sense of personal ownership over the narratives you've collected. However, as per the ORI guidelines, this is incorrect.
  • The Funder (Government): The funder has an interest in the data being used for public good. As the ORI resource notes, if this is a grant, the funder typically gives rights to the institution. If it were a contract, the government would likely own the data outright. Let's assume it's a grant.
  • The University: As the recipient of the grant, the university is the primary legal owner of the data. They are responsible for compliance, data security, and long-term storage. You, the researcher, are a steward of the data on behalf of the university. If you were to leave the university, you could not automatically take the data with you; you would need a formal data transfer agreement.
  • The Participants: The participants have shared incredibly personal stories. They are the "data sources" and have a profound ethical stake. While they may not have legal ownership, they have rights that must be respected.

• Resolution with a Shared Model: Again, a Shared Ownership model is essential. The consent form, approved by the university's ethics board (IRB), must be transparent about ownership. It would specify that:

  • The data is owned by the university.
  • It will be used by the research team for academic publications and presentations.
  • The data will be anonymized to the highest possible standard (as we discussed in the Privacy lesson) to protect participants.
  • Participants have the right to review their transcripts and withdraw from the study, and the agreement will specify what happens to their data in that event.
    This approach respects the university's legal ownership while honoring the participants' moral rights and the researcher's role as steward.

Conclusion

This lesson has untangled the complex question of data ownership. We have moved beyond simplistic assumptions to a more nuanced understanding of the rights and responsibilities of all stakeholders involved in the data lifecycle.

Key Takeaways:

• Data ownership is not automatically assigned to the data collector. It is a complex issue involving funders, institutions, researchers, and participants.
• The primary models of ownership are Individual, Corporate/Institutional, and Shared.
• In academic research, the institution is typically the default owner of data collected under its purview, especially with external funding.
• In any context involving personal data, there is a strong ethical argument for user-centric or shared ownership models that respect the participant's rights.
• Crucially, ownership and usage rights must be explicitly defined in written agreements, such as consent forms and data use agreements, before any data collection begins.

Preview of the Next Lesson:

We have now covered C, T, O, P, and O. The final piece of our CTO POC ethics framework is C for Current. In the next lesson, we will discuss why data ethics is not a one-time checklist but an ongoing process. We will explore how to ensure your data practices remain compliant with evolving ethical standards, regulations, and societal expectations.