Indiana Law Review Volume 54 2021 Number 2 ARTICLES WHO OWNS YOUR DATA? STEPHEN T. BLACK* INTRODUCTION “When we have all data online it will be great for humanity. It is a prerequisite to solving many problems that humankind faces.” – Robert Cailliau1 We live in a world where our computer searches, our commute patterns, our shopping habits, and our music choices are watched, compiled, and pored over to look for trends and patterns. Internet users generate about 2.5 quintillion bytes of data each day.2 With all this data, legislatures have been worried about the rights of their citizens. Do we own the information collected about us? Do we have any say in how it is collected, used, or stored? Can we just say “Stop!” and expect others to comply? Legislatures have attempted to regulate the flow of personal data and to give individuals a measure of control over the information that is collected about them. These regulations codify and, in some cases, create a bundle of rights. Do these bundles reflect an intent to treat data as property that can be owned by the people it describes? If so, what does this new type of property look like? I. IS DATA PROPERTY? Consider the following assertions: 1. “The common law secures to each individual the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be * Professor of Law, Texas Tech University School of Law. LL.M. Taxation 2000, University of Washington School of Law; J.D. 1994, Brigham Young University J. Reuben Clark School of Law; B.S. 1988, Brigham Young University. The author is indebted to the invaluable research assistance of Anna E. Boyer from the University of Houston, and gratefully acknowledges the financial support of the Texas Tech University School of Law for this Article. 1. Daniel Silva, Internet Has Only Just Begun, Say Founders, PHYS.ORG (Apr. 22, 2009), https://phys.org/news/2009-04-internet-begun-founders.html [https://perma.cc/NWV3-7NMN]. Cailliau is a Belgian informatics engineer and computer scientist who, together with Tim Berners- Lee, developed the World Wide Web. 2. Data Never Sleeps 5.0, DOMO, https://www.domo.com/learn/data-never-sleeps-5 (last visited Jan. 17, 2021) [https://perma.cc/FB6R-D46M]. This number is calculated based on an average from 2016 and 2017. 306 INDIANA LAW REVIEW [Vol. 54:305 communicated to others.”3 2. “The right to informational privacy is succinctly defined as the right of the individual to maintain control over personal information concerning one’s ‘physical and individual characteristics, knowledge, capabilities, beliefs and opinions.’”4 3. “[P]rivacy is the individual’s ability to control the circulation of information relating to him.”5 4. Privacy is “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.”6 We face a few difficulties in trying to shoehorn data about an individual, group, or organization into a property framework. First, very obviously, data is intangible. While dealing with intangibles has not proven impossible for property regimes, it at least poses some challenging questions. Second, consider the scope of what we mean by data. When we deal with a plot of land, we have a concept of where the boundaries are between that plot of land and the neighbor’s plot. Data, on the other hand, does not fit nicely into a metes and bounds description. The Oxford English Dictionary defines data as “facts and statistics collected together for reference or analysis.”7 That, by itself, does not interest us much. Does one own a fact? But the collection of data, especially the collection of data about a person, does interest us. “[T]he right of the individual to maintain control over personal information concerning one’s ‘physical and individual characteristics, knowledge, capabilities, beliefs and opinions’”8 is exactly what we are concerned about. Do we have control over that personal information and its dissemination? And if so, exactly what type of information are we concerned about? This concept is not unique to data. Many categories of intangible assets may also be difficult to describe. However, when we consider what data is, we need to be somewhat precise in what we mean.9 Frequently, we can limit the scope of 3. Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193, 198 (1890). 4. Eric Grossman, Conceptualizing National Identification: Informational Privacy Rights Protected, 19 J. MARSHALL L. REV. 1007, 1014 (1986) (citation omitted). 5. ARTHUR R. MILLER, THE ASSAULT ON PRIVACY: COMPUTERS, DATA BANKS, AND DOSSIERS 25 (1971). 6. Lisa M. Austin, Re-Reading Westin, 20 THEORETICAL INQUIRIES L. 53, 54 (2019) (quoting ALAN WESTIN, PRIVACY AND FREEDOM 5 (1967)). 7. Data, OXFORD ENGLISH DICTIONARY (3rd ed. 2012). 8. Grossman, supra note 4, at 1014 (citation omitted). 9. “Semantic explanations of the word ‘data’ require working backwards from the end goal. Data is a subset of information, and information is special because humans can transform it into new factual knowledge—a new understanding about something that has occurred. We do this by receiving and interpreting the patterns in the information. Information will not always provoke a new understanding about the state of the world from a human (just as a teacher cannot always lead a student to understanding), but it might, and the potential is key.” Jane Bambauer, Is Data 2021] WHO OWNS YOUR DATA? 307 data to certain representations—Mary’s employer number is 12345 or John’s address is 987 Main St.—but sometimes we cannot. We talk about data as a mixed bag of fact and inferences, or as a collection of facts, not all of which may be important. Third, and perhaps the thorniest of the difficulties, is that data does not look like property. We will return to this concept later in Section I.B. A. What is the Nature of Property? Before tackling the issue of whether data is property, it will be helpful to first understand what we mean by the term “property”: The Romanist jurists of the late middle ages, unlike the Romans themselves, first felt the need to articulate an abstract definition of property. Beginning with Bartolus in the fourteenth century, they defined property (dominium) as “the right of complete control over a physical object, to the extent not prohibited by law” (ius de re corporali perfecte disponendi nisi lege prohibeatur). This definition is repeated with minor modifications from one civilian authority to the next through Domat and Pothier to the French Civil Code of 1804, and from there in the other modern codes of the civilian tradition. It is echoed in the common law in the even more extravagant language of Blackstone. But in addition to this definition applying rather narrowly to ownership of tangible property, Bartolus also offers a second and broader definition of dominium. Property, he says, “may be used to refer in the broadest sense to every incorporeal right, as in ‘I have property in an obligation, for example in a usufruct.’” (potest appellari largissime pro omni iure incorporali, ut habeo dominium obligationis, utputa usufructus). This broader definition would in time find an echo in Locke.10 Treating obligations as property, or even referring to that concept as “having property in X,” is a strange notion: In the English-speaking countries today, the conception of property held by the specialist (the lawyer or economist) is quite different from that held by the ordinary person. Most people, including most specialists in their unprofessional moments, conceive of property as things that are owned by persons. To own property is to have exclusive control of something—to be able to use it as one wishes, to sell it, give it away, leave it idle, or destroy it.11 That makes sense when speaking of tangible property. But when speaking of Speech?, 66 STAN. L. REV. 57, 65 (2014). 10. Bret Boyce, Property as a Natural Right and as a Conventional Right in Constitutional Law, 29 LOY. L.A. INT’L & COMP. L. REV. 201, 215-16 (2007) (citations omitted). 11. Thomas C. Grey, The Disintegration of Property, 22 NOMOS: AM. SOC’Y POL. LEGAL PHIL. 69, 69 (1980). 308 INDIANA LAW REVIEW [Vol. 54:305 rights, what does it mean? “In the broadest sense to every incorporeal right” means that we are extending our property framework around those rights.12 So, is privacy a right? [S]ome modern legal theorists have stressed that a traditional purpose of private property has been to protect security and independence, and that public law entitlements to social minima serve this purpose in the modern economy, and hence should be considered a “new property.” . . . Protections offered to property have been extended to entitlements conferred by, for example, welfare and public education law.13 In 1890, a thirty-four-year-old Boston lawyer named Louis Brandeis and his law partner, Samuel Warren, published an article entitled “The Right to Privacy” in the Harvard Law Review.14 “Recent inventions and business methods call attention to the next step which must be taken for the protection of the person, and for securing to the individual . . . the right ‘to be let alone.’”15 The inventions to which they referred were the portable camera and widespread publication of society gossip columns in newspapers.16 That article is one of the most cited in all legal literature and is credited with the popularization of privacy as a right.17 If privacy is a right (or embodies rights), then we can say it is property. If it is property, can it be owned? If yes, who owns it? B. What Is the Nature of Data? “Thus a property system depends on people not stealing, cheating and so forth, even when they have the chance—that is, all the participants, or at least a substantial number of them, have to cooperate to make a property regime work.”18 We have already looked at data as “facts and statistics collected together for reference or analysis.”19 Other definitions refer to data as “quantities, characters, or symbols on which operations are performed by a computer, being stored and transmitted in the form of electrical signals and recorded on magnetic, optical, or mechanical recording media.”20 Or, perhaps even more esoterically, as “[t]hings known or assumed as facts, making the basis of reasoning or calculation.”21 12. Boyce, supra note 10, at 215-16. 13. Grey, supra note 11, at 72 (citing Goldberg v. Kelly, 397 U.S. 254 (1970)). 14. See Warren & Brandeis, supra note 3. 15. Id. at 195 (citation omitted). 16. Id. 17. See, e.g., Neil M. Richards & Daniel J. Solove, Prosser’s Privacy Law: A Mixed Legacy, 98 CALIF. L. REV. 1887, 1893 (2010). 18. Carol M. Rose, Property as Storytelling: Perspectives from Game Theory, Narrative Theory, Feminist Theory, 2 YALE J.L. & HUMAN. 37, 51 (1990) (citation omitted). 19. Data, supra note 7. 20. Id. 21. Id. 2021] WHO OWNS YOUR DATA? 309 We do not consider basic facts about our known world to be property, but at the same time, we do not consider those facts to be especially valuable or interesting. When we collect those basic facts together, however, something interesting may result. “Nice sunny day today” may be an observation about basic facts that most of us do not care about. However, as we collect that information day after day, does the compilation start to take on interesting qualities, valuable characteristics, or even degrees of property-ness? Is there something about the size of the compilation? The subject matter? The act of collecting? Global climate research needs large scale and long-term datasets. Why are these datasets more important than a singular observation about today’s weather? A collection of phone numbers may seem to share the same distinction. Justice Sandra Day O’Connor, delivering the opinion for the Supreme Court in a copyright case dealing with rural phone books, said: Many compilations consist of nothing but raw data—i.e., wholly factual information not accompanied by any original written expression. On what basis may one claim a copyright in such a work? Common sense tells us that 100 uncopyrightable facts do not magically change their status when gathered together in one place.22 However, she immediately continued with, “Yet copyright law seems to contemplate that compilations that consist exclusively of facts are potentially within its scope.”23 We draw from this that an individual piece of data-information is not within the protection of copyright. Raw data, taken alone, is not the type of property we call copyrightable. But is it some other type of property? For example, the password to Former President Donald Trump’s Twitter account is a single piece of data. Would we call it private and protect it as property of its owner? If so, what rights define that property, including the right “to use it as one wishes, to sell it, give it away, leave it idle, or destroy it”?24 1. Usage and the Right to Exclude Others.—When we discuss personal data, we usually are referring to the right to communicate identifying information to another, and then to expect that person to keep that information confidential. Thus, if I borrow money to buy a car, I expect to be able to communicate to the lender my name, social security number (for the purpose of obtaining a credit report), address, driver’s license number, and financial information (which may include my bank information for payment). Once the third party has my information, what do I, and perhaps more importantly, what does the law expect of the third party? In the information age, information about customers is valuable. Competing lenders may want to know who I am, business partners of the lender may want to advertise their services, 22. Feist Publ’ns, Inc. v. Rural Tel. Serv. Co., 499 U.S. 340, 345 (1991). 23. Id. 24. Grey, supra note 11, at 69. 310 INDIANA LAW REVIEW [Vol. 54:305 and others may want to know why I borrowed the money.25 Some of these ancillary businesses may be helpful to me, and I may welcome the transfer of information to make it easier for me, but do I want the choice to exclude my information26 from being given to them? When we discuss the right to exclude others from tangible property, it includes the right to prevent (within reason) others from entering (real estate) or possessing/touching (personal property).27 What does the corresponding right for intangible property look like? Turning to intellectual property law, the right to exclude from a patent means the right to prevent another from making, using, or selling the covered invention.28 The right to exclude others from a copyright includes the right to prevent others from reproducing, distributing, performing, displaying, or making derivative works.29 For a trademark, the right includes preventing unfair competition,30 but for a trade secret, the right includes preventing information from being disclosed, acquired, or “used by others without their consent in a manner contrary to honest commercial practice[].”31 When we talk about data, what does it mean to use it? “The common law secures to each individual the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be communicated to others.”32 “The right to informational privacy is succinctly defined as the right of the individual to maintain control over personal information concerning one’s ‘physical and individual characteristics, knowledge, capabilities, beliefs and opinions.’”33 The rights to use and to prevent others from using data then become rights in communicating or blocking communication. The HR department of your organization (the controller) has methods to process personal data of candidates and employees that need to be protected and used. Some of those HR data processing data activities (or 25. E.g., a local mechanic or auto parts store may want the information. 26. Note that I used the term “my information.” Is it my property because I call it so? 27. See generally Lucas v. S.C. Coastal Council, 505 U.S. 1003 (1992). “Such public access would deprive petitioner of the right to exclude others, ‘one of the most essential sticks in the bundle of rights that are commonly characterized as property.’” Dolan v. City of Tigard, 512 U.S. 374, 384 (1994) (quoting Kaiser Aetna v. United States, 444 U.S. 164, 176 (1979)). 28. 35 U.S.C. § 271 (2020). 29. 17 U.S.C. § 106 (2020). 30. See Robert G. Bone, Rights and Remedies in Trademark Law: The Curious Distinction Between Trademark Infringement and Unfair Competition, 98 TEX. L. REV. 1187, 1200 (2020). 31. TRIPS: Agreement on Trade-Related Aspects of Intellectual Property Rights art. 39, ¶ 2, Apr. 15, 1994, Marrakesh Agreement Establishing the World Trade Organization, Annex 1C, 1869 U.N.T.S. 299, 33 ILM 1197 (1994). 32. Warren & Brandeis, supra note 3, at 198. 33. Grossman, supra note 4, at 1014 (citation omitted). 2021] WHO OWNS YOUR DATA? 311 all of them or anything in-between) could be outsourced. The company you outsource to then is a processor. Your marketing team processes personal data of potential and existing customer[s]. When it works with an email marketing company or agency, for instance, that uses these data for campaigns, the latter are processors. You might have outsourced the inbound contact center activities of your organization or now and then use a call center when you want to enable people to dial in to a specific number in the scope of a campaign on TV and so on. The contact center then becomes the processor, capturing information from the people who call in – the data subjects.34 This makes sense from a property rights point of view. If data is property, then individuals can agree to grant the right to use data to an employer’s human resources department, the marketing team of a company they like, or to a call center if they decide to buy the product. Where this begins to break down is if the data is not about a natural individual, but rather about a corporation. Does a corporation “own” its “personal” data?35 Does a partnership or trust “own” its data? We allow corporations to own property. If data privacy is a right, then should not a corporation be able to exercise that right as well? Partnerships present a more difficult problem. The Uniform Partnership Act provides that property, real or personal, could be held in the name of the partners as “tenant[s] in partnership” or in the name of the partnership.36 The Revised Uniform Partnership Act changed that to: “Property acquired by a partnership is property of the partnership and not of the partners individually.”37 Partnerships that purport to be an aggregate of partners (who hold property as tenants in partnership) should have the same data ownership rights as individuals, and partnerships that are entities should also be able to exercise the same rights. Or are we suggesting that there is a difference between the individual’s right to be left alone and the business’ right to control the flow of information about itself and its members? Further, what exactly do we mean by the right to exclude others from data? The California Consumer Privacy Act (CCPA) posits this as the right to opt out, while the European Union’s General Data Protection Regulation (GDPR) grants the right to be forgotten.38 34. What Is a Data Processor and What Are the Duties of a Data Processor Under the GDPR?, I-SCOOP, https://www.i-scoop.eu/gdpr/data-processor-gdpr/ (last visited Jan. 17, 2021) [https://perma.cc/UF4K-GUZP]. 35. “[C]orporations can claim no equality with individuals in the enjoyment of a right to privacy.” Cal. Bankers Ass’n v. Shultz, 416 U.S. 21, 65 (1974). 36. UNIF. P’SHIP ACT § 8(3), § 25(1) (UNIF. LAW COMM’N 1914). 37. REV. UNIF. P’SHIP ACT § 203 (amended 2013) (UNIF. LAW COMM’N 1997). 38. CAL. CIV. CODE § 1798.120 (West 2020); Regulation 2016/679, of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 43, 44. 312 INDIANA LAW REVIEW [Vol. 54:305 a. CCPA Right to Opt-Out.—“A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.”39 California gives consumers the right only against data-selling businesses.40 California is just one in a long line of jurisdictions that are rushing to enact data regulation schemes.41 This is interesting for two reasons. One, the regulations treat businesses that deal in data as if they were dealing in property. We do not talk about “selling” something if it is not property. Two, the regulations treat the data as being owned by the data subject for the very reason that the regulations give those subjects rights in the data and its use. b. GDPR Right to Be Forgotten.—“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay . . . .”42 The same questions apply. Is this a global right? Once data has changed hands several times, what good is a right that may never occur?43 Does all this mean that we have property rights only in jurisdictions which explicitly grant those rights to opt out or be forgotten?44 We understand intangible property to sometimes work this way. In the United States, for example, a patent may be property, and it may be protected by property rights in other jurisdictions which have intellectual property treaties with the United States. However, if the information is transmitted to a non-treaty jurisdiction, then it ceases to have those protections, at least on the face of things.45 On the other hand, perhaps data is more like trade secret property in that the 39. CIV. § 1798.120(a). 40. Id. 41. Sarah Rippy, US State Comprehensive Privacy Law Comparison, INT’L ASS’N PRIVACY PROPS., https://iapp.org/resources/article/state-comparison-table/ (last visited Jan. 17, 2021) [https://perma. cc/G28Z-GL3X]. 42. Regulation 2016/679, of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 43. 43. “The aim of [copyright] statutes is to secure to the author, composer, or artist the entire profits arising from publication; but the common-law protection enables him to control absolutely the act of publication, and in the exercise of his own discretion, to decide whether there shall be any publication at all. The statutory right is of no value, unless there is a publication; the common-law right is lost as soon as there is a publication.” Warren & Brandeis, supra note 3, at 200 (emphasis in original) (citation omitted). 44. What about an individual’s right against a non-selling business in California, or against an organization not governed by the CCPA or GDPR? 45. Opportunities in the Patent-Free Zone, TECHCRUNCH (Aug. 1, 2010), https://techcrunch.com/2010/08/01/opportunities-in-the-patent-free-zone/ [https://perma.cc/339U- AJZU]. 2021] WHO OWNS YOUR DATA? 313 value lies in not communicating the information to others. But even then, can we expect that personal data not kept secret is free for the taking? “Guaranty of the right of privacy is not a guaranty of hermitic seclusion. We live in a society geared in the opposite direction; a society that makes public demands and imposes public duties.”46 If that is the case, then what is the nature of the right to use and exclude others from using your data? 2. Transferability.—The concept of transferability is that property can be “assigned, sold, transferred, conveyed, or pledged,”47 and those things which cannot be transferred are not property. Can I transfer my data? With tangible property, transfer frequently means a physical relinquishment. With intangible property, transfer frequently means a relinquishment of the exclusionary aspects of the property. In other words, if intangible property includes the right to exclude others, a transfer includes waiving that right or allowing others to use. Thus, a transfer of data means allowing others to use data that a right to privacy would preclude. Can you transfer less than your full rights in property? Yes. What does that mean for data? When discussing a patent or a copyright, owners can slice their ownership by geographic area (you get to use this in the EU only), by time (for one month), or by intended use (you get the movie rights, but not the live performance rights, or for a patent, you get the right to use this patent for medical devices, but not for consumer uses). We encounter a problem with this line of thinking, however, when we consider the recent data regulation laws. Closely tied to the concept of “transferability” is the concept of non-economic rights. We began this section with a question about whether an individual has “the right of determining, ordinarily, to what extent his thoughts, sentiments, and emotions shall be communicated to others.”48 In the nineteenth century, Europe considered how to protect non-economic rights of artists faced with those who might destroy or exploit “the overall integrity of his or her work.”49 That same concern is present when we consider the rights of the individual in his or her personal data. When an artist creates, be he an author, a painter, a sculptor, an architect or a musician, he does more than bring into the world a unique object having only exploitive possibilities; he projects into the world part of his personality and subjects it to the ravages of public use. There are possibilities of injury to the creator other than merely economic ones; these the copyright statute does not protect.50 46. Bradley v. Cowles Magazines, Inc., 168 N.E.2d 64, 65 (Ill. App. Ct. 1960). 47. In re Marriage of Graham, 574 P.2d 75, 77 (Colo. 1978); but see In re Marriage of Olar, 747 P.2d 676 (Colo. 1987). 48. Warren & Brandeis, supra note 3, at 198. 49. Aurele Danoff, The Moral Rights Act of 2007: Finding the Melody in the Music, 1 J. BUS., ENTREPRENEURSHIP & L. 181, 185 (2007). 50. Martin A. Roeder, The Doctrine of Moral Right: A Study in the Law of Artists, Authors 314 INDIANA LAW REVIEW [Vol. 54:305 While the United States has largely rejected the concept of moral rights in artistic works, the idea that some rights are never truly separable from the owner is one that is still debated.51 An author can convey away her copyrights in a creation, thus denying her the ability to receive revenues from that work. The author, however, will still retain her moral rights and can at least in theory maintain the integrity of her creation as it is expressed through performance and transmission.52 With respect to data, it appears that the common perception among drafters of data regulation statutes is that personally identifiable information (“PII”) should always “stick” to the owner. For example, Section 1798.120(a) of the CCPA states, “A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.”53 This shows a willingness on the part of the legislature to believe that information about the consumer is always being collected and that the consumer may not waive or transfer this right. This “stickiness” of PII is a fairly unique right and calls into question whether data can be sold by the data subject. At the very least, it may mean that one cannot transfer his “entire” right to his personal data. We see corollaries in forced share laws, which preserve a part of the marital estate for a spouse who has been written out of a will, or with waivers under the Fair Labor Standards Act,54 or attempts to waive compliance with the Securities Exchange Act of 1934.55 In each of these examples, rights are curtailed to a greater or lesser degree. With respect to data’s stickiness, the fact that you may not transfer all of your rights does not imply that data is not property; transferability is not an all or nothing prospect. As an example, if the law proscribes the transferability of African elephant ivory56 (tangible property) or restricted stock (intangible property), it does not mean that they suddenly become or never were property. and Creators, 53 HARV. L. REV. 554, 557 (1940). 51. Sheldon W. Halpern, Of Moral Right and Moral Righteousness, 1 MARQ. INTELL. PROP. L. REV. 65, 67 (1997). 52. Robert C. Bird, Moral Rights: Diagnosis and Rehabilitation, 46 AM. BUS. L.J. 407, 410 (2009) (citation omitted); see also Roberta Rosenthal Kwall, Copyright and the Moral Right: Is an American Marriage Possible?, 38 VAND. L. REV. 1, 12 (1985); Patrick R. Goold, The Lost Tort of Moral Rights Invasion, 51 AKRON L. REV. 1093, 1093 (2017); Robert C. Bird, Of Geese, Ribbons, and Creative Destruction: Moral Rights and Its Consequences, 90 TEX. L. REV. 63 (2011). 53. CAL. CIV. CODE § 1798.120(a) (West 2020). 54. See Lynn’s Food Stores, Inc. v. United States, 679 F.2d 1350, 1352 (11th Cir. 1982) (“FLSA rights cannot be abridged by contract or otherwise waived because this would ‘nullify the purposes’ of the statute and thwart the legislative policies it was designed to effectuate.” (citation omitted)). 55. 15 U.S.C. § 78cc (2020). 56. 81 Fed. Reg. 36,388 (June 6, 2016). 2021] WHO OWNS YOUR DATA? 315 Data remains property even if some jurisdictions attach rights that are personal to the subject. 3. Leave It Idle.—Property ownership includes the right to leave the property idle.57 Yesterday A owned Blackacre; among his rights of ownership was the legal power to leave the land idle, even though developing it would bring a good income. Today A puts Blackacre in trust, conveying it to  (the trustee) for the benefit of C (the beneficiary). Now no one any longer has the legal power to use the land uneconomically or to leave it idle—that part of the rights of ownership is neither in A nor  nor C, but has disappeared.58 Does this right apply to data? This seems to be the intent of the various data regulations but may not actually be the result. For example, although the CCPA gives the consumer the right to prevent businesses from using her data, that right is defensive.59 It assumes that the business already has the PII and gives the consumer the right to reverse the normal course of business—the use of her data.6 0 The law does not state that the status quo is that the consumer has full access to her data or that its normal state is to be left idle. 4. Valuation and Sales of Data.—Assigning value may not be as easy as it seems (or even possible). This idea is further complicated when data has multiple owners. Data valuation is commonly discussed when there has been a breach.61 For example, if a credit card provider experiences a data breach of card and user information, multiple parties experience different types of harm. The credit card provider will have to issue new cards, devote employees to handle questions customers have, and take on other security-related expenses. The cardholder may experience no harm if his data is not used or revealed by the breach. But, if the individual’s data is used, he may experience immense financial and reputational harms. To determine value, should the cost and certainty of a breach play a factor? One way to determine valuation is to assign a standard value that all individuals should be compensated for the use of their data. However, this does 57. But, if you will forgive the pun, may not include the right to idle the property. U.S. EPA, COM PILATION OF ST ATE, COUNTY, AND LOCAL ANTI-IDLING REGULATIONS (2006), https://www.epa.gov/sites/production/files/documents/CompilationofStateIdlingRegulations.pdf [https://perma.cc/X2YF-EESN]. 58. Grey, supra note 11, at 70. 59. CAL. CIV. CODE § 1798.120 (West 2020); see also California Consumer Privacy Act (CCPA), OFF. ATT’Y GEN., https://oag.ca.gov/privacy/ccpa (last visited Jan. 23, 2021) [https://perma.cc/YHH6-7V5T]. 60. CIV. § 1798.120. 61. See Cost of a Data Breach Report, IBM (July 2021), https://www.ibm.com/security/data- breach [https://perma.cc/KF4B-H9B9]; Dan Swinhoe, What Is the Cost of a Data Breach?, CSO (Aug. 13, 2020), https://www.csoonline.com/article/3434601/what-is-the-cost-of-a-data-breach. html [https://perma.cc/NK3E-WL9V]. https://www.ibm.com/security/data-breach https://www.ibm.com/security/data-breach 316 INDIANA LAW REVIEW [Vol. 54:305 not reflect how the data of different parties may be more desirable and sensitive than others. Few (if any) would want to read the text messages sent from a middle school student’s phone.62 This is not true if the phone belongs to a world leader or a business executive. But how would this be determined? Would each individual set a price for his or her own data? C. Personal vs. Non-personal Data The foregoing discussion focused on personal data. Presumably, non-personal data is treated differently. The problem then becomes: how do we distinguish between personal and non-personal data? Is the definition the same across all jurisdictions, and if not, what happens to personal data when it enters another jurisdiction? Non-personal data will not be protected by regulatory schemes like the GDPR or the CCPA. Treatment of those types of data will then default to existing legal schemes like copyright or the law of capture, which will be discussed later.63 For example, a company that begins collecting weather data (which is not personal data) will not be subject to the types of data regulation that we are seeing develop. The company may use, sell, or ignore the data they have collected. Because there is not a data subject to complain, they will not be beholden to anyone if they suffer a data breach. If a competitor steals the data, the company will look solely to existing property, copyright, unfair competition, or other law to redress their claims. D. Can Data Be Owned? Data is a complex concept from a legal point of view. It represents information about a subject but is held by a collector. Both the subject and collector have interests in the information. In the decades following the brief consensus in the 1970s that viewed information privacy law as safeguarding the balance of individual, institutional and social interests in information governance, Congress continued to seek a middle ground. The result was the complex patchwork of sectoral, risk-based information privacy laws in effect today . . . .64 Property is a construct of state law. While there is a natural inclination to think about property in a natural law sense (“this is mine, and there’s nothing the state can do about it”), much of our current ownership framework is dictated by the state.65 62. Unless you sell products targeted at this demographic; then, you may want to pay a premium for this access. 63. See discussion infra Section I.D.3. 64. Jane K. Winn, The Governance Turn in Information Privacy Law 10-11 (July 11, 2019) (unpublished manuscript) (https://ssrn.com/abstract=3418286). 65. See, e.g., Morgan v. Commissioner, 309 U.S. 78, 80 (1940). 2021] WHO OWNS YOUR DATA? 317 This is important because state law can create or alter property rights. We look at the data regulation movement and can rightfully ask, “Does this create or alter property rights in data?” If the answer is yes, then we proceed to the next step of asking what type of rights (and even, what type of property) we have created. 1. Data Mutuality.— As a result of the social turmoil caused by the Civil Rights Movement, widespread popular opposition to the Vietnam War, and the Watergate Scandal that forced President Richard Nixon to resign, popular trust among Americans in their government at the beginning of the 1970s had seriously eroded. As the U.S. Department of Health, Education and Welfare set about launching new Medicare and Medicaid federal health benefit programs, there was concern that some citizens entitled to receive care under these new programs might so mistrust government that they would withhold the personal information required to register for these new programs, even if that deprived them of the health care benefits these programs offered. So HEW Secretary Elliot Richardson commissioned a report to answer the question what the federal government needed to do to insure that American citizens trusted it enough to participate in these new programs. The result was the path breaking 1973 HEW Report on Computers, Records and the Rights of Citizens. Building on the insights in the 1973 HEW Report Congress enacted the Privacy Act of 1974.66 That report struggled with the concept that personal information has worth to both the individual and the data collector, and society.67 The drafters worried about the consequences of allowing exclusive control over data to any party: Each of the above formulations, however, speaks of the data subject as having a unilateral role in deciding the nature and extent of his self- disclosure. None accommodates the observation that records of personal data usually reflect and mediate relationships in which both individuals and institutions have an interest, and are usually made for purposes that are shared by institutions and individuals. In fact, it would be inconsistent with this essential characteristic of mutuality to assign the individual record subject a unilateral role in making decisions about the nature and use of his record. To the extent that people want or need to have dealings with record-keeping organizations, they must expect to share rather than monopolize control over the content and use of the records made about them. Similarly, it is equally out of keeping with the mutuality of record- generating relationships to assign the institution a unilateral role in 66. Winn, supra note 64, at 9-10. 67. See U.S. DEP’T OF HEALTH, EDUCATION & WELFARE, No. (OS)73-94, RECORDS, COMPUTERS, AND THE RIGHTS OF CITIZENS (1973). 318 INDIANA LAW REVIEW [Vol. 54:305 making decisions about the content and use of its records about individuals. Yet it is our observation that organizations maintaining records about people commonly behave as if they had been given such a unilateral role to play. This is not to suggest that decisions are always made to the disadvantage of the record subject; the contrary is often the case. The fact, however, is that the record subject usually has no claim to a role in the decisions organizations make about records that pertain to him. His opportunity to participate in those decisions depends on the willingness of the record-keeping organization to let him participate and, in a few instances, on specific rights provided by law.68 The drafters of the report then concluded that personal information, and by extension, personal privacy, “must be understood in terms of a concept of mutuality.”69 This concept of mutuality may have been influenced by a couple of practicalities. First, data may be collected about a subject without the consent of the subject. Second, allowing the subject a veto right to data collection may not only be unworkable, but it also may destroy what may be a valid interest on the part of the organization and the rights of others to allow their data to be collected. Whether we speak about health programs, insurance programs, or shopping programs (to name just a few), there is value to the organization and to society at large for data to be collected. If we, in our push for individual privacy, tip the scales so far in the direction to allow an individual to become a data hermit, we may destroy the ability of these programs to function. After all, society exists to bring greater value to all by sharing and pooling both rights and responsibilities. 2. Multiple Owners.—Can data be owned by multiple parties? Data is often not about one individual. It may be about a group of people or an organization.70 It makes sense that if data is about multiple parties, it can be owned by multiple parties. Additionally, are there limits to who can own data, especially if that data is about an individual? Let’s say an individual signs up for an email account. Most would be quick to say the individual owns his email address.71 However, the email provider had to create the account itself, requires the user to abide by its terms of service, can view the contents of the user’s emails, and can restrict access. These also sound like aspects of ownership. For policy purposes, we may want to limit the ownership rights of those who the data is not about. If data can be owned by multiple parties, what exactly can the others own? Additionally, with multiple owners, the problem arises if owners disagree about whether or not to exercise certain rights. To answer this, we can look to how real property solves these problems. Should data ownership reflect tenancy in common, where each party can transfer its ownership to a different party? And 68. Id. 69. Id. 70. See discussion infra Section II.A. 71. See, e.g., CAL. CIV. CODE § 1798.140 (West 2020) (granting rights to an individual for his or her email address). 2021] WHO OWNS YOUR DATA? 319 would this require parties to determine the exact percentage of ownership? Perhaps only owners who have a majority stake should be able to exercise management rights? A contract can also clearly describe the rights each owner has in data. However, it would be impractical to require all multi-party data ownership to be dictated by a contract, and unlike real property, it may be impossible to divide up data ownership, either at creation or at a later date. To answer this, we can look to how property law solves these problems. 3. The Law of Capture.—First-year law students encounter the law of capture near the beginning of their study of property law. The rule comes from the English common law and deals with captured natural resources including groundwater, oil, gas, and game animals.7 2 The general rule is simple—the first person to “capture” such a resource owns that resource.73 Pierson v. Post, one of the most well-known property cases, deals with the rules of property acquisition through the law of capture. In Pierson, the property in question was a fox. Post, a foxhunter, complete with a retinue of hounds, flushed a fox on communal property. Post chased the fox for a considerable time until Pierson intervened by killing and capturing the fox before Post. Both the majority and dissent in Pierson recognized the principal that dominion over an object creates a property interest. The contention lies in how to determine when this dominion and control occurs. Three solutions are proposed: a clear rule of capture, a resolution in accordance with the custom of sportsmen, and some form of recognition of Post’s effort in flushing and pursuing the fox . . . . In the end, the clear rule of capture prevails.74 The rule of capture helps to incentivize productive use of resources by establishing clear ownership rules. It is reasonable to ask if the rule of capture applies to data, since unclear ownership laws are lacking and leading to confusion. In addition to wild animals, the rule of capture also applies to other natural resources and the collection of data necessary to pursue those resources. Kennedy 72. And sometimes baseballs! “There is nothing which so generally strikes the imagination, and engages the affections of mankind, as the right of property; or that sole and despotic dominion which one man claims and exercises over the external things of the world, in total exclusion of the right of any other individual in the universe.” Patrick Stoklas, Comment, Popov v. Hayashi, A Modern Day Pierson v. Post: A Comment on What the Court Should Have Done with the Seventy- Third Home Run Baseball Hit by Barry Bonds, 34 LOY. U. CHI. L.J. 901 (2003) (quoting SIR WILLIAM BLACKSTONE, THE SOVEREIGNTY OF THE LAW 118 (Gareth Jones ed., Univ. Toronto Press 1973) (1765)). 73. See, e.g., Ohio Oil Co. v. Indiana, 177 U.S. 190 (1900). 74. John William Nelson, Fiber Optic Foxes: Virtual Objects and Virtual Worlds Through the Lens of Pierson v. Post and the Law of Capture, 14 J. TECH. L. & POL’Y 5, 7 (2009) (citing Pierson v. Post, 3 Cai. 175, 177-82 (N.Y. Sup. Ct. 1805)). 320 INDIANA LAW REVIEW [Vol. 54:305 v. General Geophysical Co. is a good example in the context of subsurface surveys.75 General Geophysical Company (“General”) was hired to perform seismic operations to obtain sub-surface information.76 Kennedy, a neighboring landowner, did not allow General to perform tests on his land, so General kept its test equipment off of Kennedy’s land.77 However, since General performed operations so close to Kennedy’s land, Kennedy claimed the vibrations were a trespass.78 The court disagreed and found no trespass.79 Professors Bruce Kramer and Owen Anderson analyzed this case’s implication on data ownership, saying: Moreover, the plaintiff’s land was not physically injured in any way by the resulting vibrations or concussion. Nevertheless, dictum in Kennedy suggests that, if valuable and useful information had been intentionally gathered from beneath the plaintiff’s acreage, the plaintiff might have prevailed. The court supported its decision by noting “that on no occasion did [the geophysical operator] . . . set up a receiving set so near appellant’s land that a straight line drawn on the surface of the ground from the one shot-point from which waves were to be received by the receiving set crossed any part of plaintiff’s land.” This suggests the possibility that an intentional, as opposed to incidental, gathering of information from the plaintiff’s land may have been actionable.80 The treatment of data here implies the following rule: data obtained lawfully by the collector may be used by the collector, but data not lawfully obtained may be a trespass. Additionally, the court noted that there was no damage to Kennedy’s land by the seismic vibrations.81 But what does it mean to collect data lawfully? However, analogizing data with oil, gas, or water may not be entirely appropriate. There is a finite amount of each resource. One’s consumption of water directly impacts the availability of that resource to others. Data does not exactly share this property. One having access to information does not make it any less valuable. For example, Nordstrom having a customer’s name and address does not make the name and address any less valuable to Walmart or the customer himself. 75. Kennedy v. Gen. Geophysical Co., 213 S.W.2d 707 (Tex. Civ. App. 1948). 76. Id. at 708. 77. Id. at 708-09. 78. Id. at 708. 79. Id. at 709. 80. Bruce M. Kramer & Owen L. Anderson, The Rule of Capture – An Oil and Gas Perspective, 35 ENVTL. L. 899, 937 (2005) (quoting Kennedy, 213 S.W.2d at 713). The authors of the article also recognized that the rule of capture has economic benefits: “A rule-of-capture approach would greatly reduce transaction costs by reducing the number of seismic permits needed to conduct a survey, and by discouraging ‘hold-out’ bargaining by mineral owners bent on collecting large fees from geophysical operators.” Id. at 940. 81. Kennedy, 213 S.W.2d at 709. 2021] WHO OWNS YOUR DATA? 321 Furthermore, the rule of capture only applies to things “in the wild.” Once it has been captured, the rule of capture no longer applies. So, if the rule of capture applies to data, when does data become captured? Is it when the first person “captures” the data, or does each new data recorder “capture” the data anew? Perhaps a more appropriate comparison to data flow is solar access. Though few jurisdictions recognize an absolute right to sunlight, and the recognized rights are usually weak and not well-established, the general idea is that one should be able to receive sunlight on his property without obstructions by structures or trees from a neighboring property.8 2 Like sunlight, data can be collected by more than one individual. Anyone who collects the data has title to it; several entities may own the same data. One wrongfully or illegally collecting data could be compared to one blocking sunlight, and no rights could be granted to this “interferer.” This analogy is far from perfect but provides a way to acknowledge the same data can be legitimately collected by multiple parties. a. Legitimate Capture.—Another issue with applying the rule of capture to data is the difficulty in determining if it was legitimately acquired. Compared to data collection, it is much easier to tell if oil, gas, or water is captured unlawfully—you just show a trespass. But how do you determine if data was captured legally? What exactly does it mean to capture data illegally? Capturing data illegally may mean that the action violates a privacy law—maybe the actor stole the data. Privacy laws may be anything from the GDPR to wiretapping acts. However, are there ways to capture data that do not violate privacy-specific laws? For example, a company that collects data beyond the scope described in its privacy policy may not violate a privacy law. It may be useful to just establish bright line rules to determine if data was captured properly. There is precedent for doing this with the rule of capture.8 3 When first confronted with the issues in Pierson v. Post,84 a student of the law may be justified in taking a step back to ask some foundational questions: – Whose fox is it? – Can a fox be owned? – Was the fox owned the day before the hunt occurred? These questions mirror the questions that we have been exploring in this Article. Data uncaptured is much like the fox in the wild. Not only do we think that perhaps it is no one’s property, but perhaps it is not property at all—and 82. See Colleen McCann Kettles, A Comprehensive Review of Solar Access Law in the United States: Suggested Standards for a Model Statute and Ordinance, SOLAR AM. BD. FOR CODES & ST AN D AR D S (Oct. 2008), http://www.solarabcs.org/about/publications/reports/solar- access/pdfs/Solaraccess-full.pdf [https://perma.cc/Y8RS-4BUY]. 83. See Coastal Oil & Gas Corp. v. Garza Energy Tr., 268 S.W.3d 1, 42 (Tex. 2008) (Johnson, J., dissenting) (“The rule of capture precludes liability for capturing oil or gas drained from a neighboring property ‘whenever such flow occurs solely through the operation of natural agencies in a normal manner, as distinguished from artificial means applied to stimulate such a flow.’”); see also Laura H. Burney & Norman J. Hyne, Hydraulic Fracturing: Stimulating Your Well or Trespassing?, 44 ROCKY MTN. MIN. L. INST. 19-1, 19-45 (1998). 84. See Pierson v. Post, 3 Cai. 175 (N.Y. Sup. Ct. 1805). 322 INDIANA LAW REVIEW [Vol. 54:305 perhaps it does not matter, for data (and foxes) in the wild is not something that we fight over. It just has not entered into our system of reckoning. This is not to say that it cannot be owned. At the point the fox became something desired by both parties, the law of property became relevant. We could expand this point by saying that if only one person cares about data, then whether or not it is property is moot. But when two (or more) parties care, then the law of property is important. In our society, data has reached the point that the law of property is relevant. Once, like the fox, it has come out of the woods and is something that hunters, collectors, and yes, even thieves desire, then the law of property has something to say about who “owns” it, who “possesses” it, and who may capture it. One tough corollary to treating data as property is that the data collector might then be faced with the need to pay royalties for the use of someone else’s data (yes, we’re looking at you, Google).85 This is always troublesome in property schemes where the property leaves the common and becomes shareable only upon an economic exchange. Take for example, a hypothetical posed about the escape of genetically modified fish: The [modified salmon] has been mass produced at a number of New England aquaculture sites with great success. One night, however, the combination of a power outage and a huge storm compromises a low containment system at an aquaculture site. A number of [salmon] escape and populate the surrounding area. Resulting generations, which may be . . . hybrids or simply second generation [modified salmon], express the same genes for increased growth and cold resistance that AquaBounty patented in AAS. After a couple of years, the AAS fish farm discovers that its revenues have been decreasing by a small margin and traces this decrease to greater competition at a local fish market. After sending an experienced AAS representative to the market, the fish farm realizes—based on anecdotal evidence from the fishermen and increased growth characteristics of the fish—that these fish are likely wild-AAS hybrids. The representative buys some of the fish and discovers that they contain the patented genes of AAS. AquaBounty, which has a license with the fish farm to maintain its intellectual property rights in AAS, sues the fishermen for infringement. At trial, the fishermen discover that there is no such thing as an “innocent infringer” and find themselves 85. See Press Release, Mark R. Warner, Warner & Hawley Introduce Bill to Force Social Media Companies to Disclose How They Are Monetizing User Data (June 24, 2019), https://www.warner.senate.gov/public/index.cfm/2019/6/warner-hawley-introduce-bill-to-force- social-media-companies-to-disclose-how-they-are-monetizing-user-data [https://perma.cc/AK6G- XHHG] (“U.S. Sens. Mark R. Warner (D-VA) and Josh Hawley (R-MO) will introduce the Designing Accounting Safeguards to Help Broaden Oversight And Regulations on Data (DASHBOARD) Act, bipartisan legislation that will require data harvesting companies such as social media platforms to tell consumers and financial regulators exactly what data they are collecting from consumers, and how it is being leveraged by the platform for profit.”). 2021] WHO OWNS YOUR DATA? 323 responsible for damages to AquaBounty for lost profits.86 Applied to the current state of data collection, would or should a data market be helpful? Many people are blissfully unaware of how or why their personal data is being used, and even fewer would have a sense of how much their data would be worth. Would treating their data as property simply make a mess of things best left alone, or would it provide a semblance of equity where parties now are simply taking and using data as they find it? 4. The Law of Find.—First year law students are also familiar with finder’s law: “A finder of property acquires no rights in mislaid property, is entitled to possession of lost property against everyone except the true owner, and is entitled to keep abandoned property.”87 With the law of find, the finder can assert superior claims over everyone except the owner. Ownership also depends on if the property is lost, mislaid, or abandoned.88 a. Lost Data.—A data recorder could be dealing with lost data. Remember that although data regulations deal with personal data, the world is filled with data of all kinds. The article, “Big Data: Finders Keepers, Losers Weepers?,” discusses the ethical implications of applying the law of find to data collection.89 In particular, the author tries to wrangle the law to condone the taking of data from those who are not using it in the way the data processor would like to, arguing instead that the taking is an act of (data) creation. The author discusses the issue with whether the finder is the creator, saying: [T]he discoverer of an unheld resource, brings the resource into existence and must therefore be seen as the creator of the resource. This is a significant reconceptualization since creation is a substantially different act than acquisition from nature. The latter occurs “against the background of a given unheld resources (even if no one is aware of their very existence),” meaning that acquisition constitutes a transfer, namely from nature to the discoverer who becomes the first holder. The justness of the transfer could then be subject to ethical scrutiny. In the case of creation, no notion of transfer is involved in the establishment of ownership over the created good: “the finder-creator has spontaneously generated hitherto non-existent resources, and is seen, therefore, as their natural owner.” If the finder has created the goods by finding them, they cannot transfer from nature to the finder for the simple fact that the goods 86. Matthew Morgan, The Aquadvantage Salmon: Who Owns Escaped Genetically Modified Animals?, 17 OCEAN & COASTAL L.J. 127, 129 (2011). 87. Michael v. First Chi. Corp., 487 N.E.2d 403, 409 (Ill. App. Ct. 1985). 88. Abandoned Property, LEGAL INFO. INST., https://www.law.cornell.edu/wex/abandoned_ property (last visited Jan. 23, 2021) [https://perma.cc/TNQ5-LU6W]. 89. Marijn Sax, Big Data: Finders Keepers, Losers Weepers?, 18 ETHICS & INFO. TECH. 25 (2016). 324 INDIANA LAW REVIEW [Vol. 54:305 did not exist, in the relevant sense, in nature before they were found.90 The author also adds: The ethical judgment is the acceptance of a ‘finders, keepers’ ethic. This means precisely what it appears to mean: those who find something that is not held by anybody, are, as they found it, the legitimate owners of that which they have discovered. Kirzner, however, proposes to reconceptualize what discovering something that was previously unheld means. “In order to introduce plausibility to the notion of finders- keepers, it appears necessary to adopt the view that, until a resource has been discovered, it has not, in the sense relevant to the rights of access and common use, existed at all.”91 Notice that one does not need to assume that the entrepreneur is the first to discover that there is juice in an orange. One only needs to acknowledge that the entrepreneur discovered the market opportunity of squeezing the juice out of the orange and selling it for a profit. What about truly “found” data? What if, by watching a group of people, I discover something about them they did not know? Is this data found, or data discovered? Am I the owner, or are they? b. Mislaid Data.—Mislaid property does not belong to a “finder,” on the theory that the rightful owner will come looking for it. What about mislaid data? Will the owner of the data come looking for it? We have seen an explosion of data protection regulation following the proliferation of data theft in recent years. Note that the very term “data theft” presupposes that we are treating data as property that can be stolen. One of the difficulties we face in this area however is that data has been casually and carelessly strewn about. “An article is ‘lost’ when the owner has lost the possession or custody of it, involuntarily and by any means, but more particularly by accident or his own negligence or forgetfulness, and when he is ignorant of its whereabouts or cannot recover it by an ordinarily diligent search.”92 “Lost” property is different from property that is left intentionally behind or abandoned. “Mislaid personal property is property which the owner voluntarily and intentionally lays down in a place where he can again resort to it—then he forgets where he left it.”93 The difference between lost and mislaid property is the owner’s intent.94 What about data? In the case of personal data still relevant and still valuable, we can easily say that it has not been abandoned. In fact, in most cases, it is still 90. Id. at 27-28 (emphasis in original) (quoting Israel M. Kirzner, Entrepreneurship, Entitlement, and Economic Justice, 4 EASTERN ECON. J. 9, 18 (1978)). 91. Id. at 27 (emphasis in original) (quoting Kirzner, supra note 90, at 17). 92. Lost, BLACK’S LAW DICTIONARY (5th ed. 1979). 93. JOSEPH L. HOFFMANN & WILLIAM J. STUNTZ, DEFINING CRIMES 373 (3d ed. 2017). 94. 1 AM. JUR. 2D Abandoned, Lost, and Unclaimed Property § 19 (1962). 2021] WHO OWNS YOUR DATA? 325 in the possession95 of the owner or the owner’s agent. So, what about data—is it more likely that I carelessly used an easy password (lost)? Or more likely that I have intentionally placed the data somewhere on the web, but forgotten it was there (mislaid)? Should the treatment of data—whether lost or mislaid—depend on property analogies? Property that I carelessly “lost” can be claimed by a finder, while “mislaid” property cannot. Does any of this make sense when we talk about data? E. Can Data Be Possessed? What does it mean to possess an intangible? Judge Alex Kozinski, writing for the Ninth Circuit, had this to say: Property is a broad concept that includes “every intangible benefit and prerogative susceptible of possession or disposition.” We apply a three- part test to determine whether a property right exists: “First, there must be an interest capable of precise definition; second, it must be capable of exclusive possession or control; and third, the putative owner must have established a legitimate claim to exclusivity.”96 Kremen v. Cohen dealt with the wrongful transfer of a domain name, which the court had no problem treating as property.97 But what does it mean to possess an intangible? The Kremen court looked at conversion98 (denying another the right of possession) of: – Websites,99 – Corporate shares,100 – Laundry routes,101 – Customer lists,102 – Bootlegged musical recordings,103 – Audio broadcasts,104 – Regulatory filings,105 and 95. See infra Section I.E on possession of data. 96. Kremen v. Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003) (citations omitted). 97. Id. 98. See Val D. Ricks, The Conversion of Intangible Property: Bursting the Ancient Trover Bottle with New Wine, 1991 BYU L. REV. 1681 (1991). 99. See Astroworks, Inc. v. Astroexhibit, Inc., 257 F. Supp. 2d 609, 618 (S.D.N.Y. 2003). 100. See Payne v. Elliot, 54 Cal. 339, 341 (1880). 101. See Olschewski v. Hudson, 262 P. 43, 46 (Cal. Dist. Ct. App. 1927). 102. See Palm Springs-La Quinta Dev. Co. v. Kieberk Corp., 115 P.2d 548, 552 (Cal. Dist. Ct. App. 1941). 103. See A & M Records, Inc. v. Heilman, 142 Cal. Rptr. 390, 400 (Ct. App. 1977). 104. See Lone Ranger Television, Inc. v. Program Radio Corp., 740 F.2d 718, 725 (9th Cir. 1984). 105. See G.S. Rasmussen & Assocs. v. Kalitta Flying Serv., Inc., 958 F.2d 896, 906 (9th Cir. 326 INDIANA LAW REVIEW [Vol. 54:305 – Confidential business information.106 Courts looked at each of these as types of property and considered whether the loss of use by the owner was a type of conversion.1 0 7 Frequently, the data theft happens when the data is exfiltrated from a bailee, and the thief is not part of the lawsuit.108 Rather, the suit is between the data owner and the bailee who let the data out.109 Who had exclusive possession?110 In Blue Cross & Blue Shield of Connecticut v. DiMartino, the court considered the theft and misuse of confidential and proprietary information.1 1 1 Note that the tort of trade secret conversion deals with information that had been kept secret, or in other words, had been kept for the exclusive use of the owner.112 Trade secrets, like data, can be licensed to others.113 The fact that the information has been shared with one (or many) individuals does not invalidate the fact that the information is the property of the owner, despite the lack of “exclusivity.”114 These cases lead us to believe that data, although intangible, is very much property that can be possessed (and stolen). In fact, the essence of possession of an intangible may be the ability to restrict or prevent third parties from accessing the data, even to the point that we may be comfortable in holding third parties liable when they allow others to wrongfully access “our” data. 1992). 106. Strangely enough, contained in copies of documents where the originals are now missing from the owner’s possession. See FMC Corp. v. Capital Cities/ABC, Inc., 915 F.2d 300, 303-05 (7th Cir. 1990). 107. Courts also considered the way the information was stored to be immaterial. See, e.g., Thrifty-Tel, Inc. v. Bezenek, 54 Cal. Rptr. 2d 468 (Ct. App. 1996) (recognizing conversion of information recorded on floppy disk); A & M Records, Inc., 142 Cal. Rptr. at 390 (same for audio record); Lone Ranger Television, Inc., 740 F.2d at 718 (same for magnetic tape); Kremen v. Cohen, 337 F.3d 1024, 1034 (9th Cir. 2003). 108. See, e.g., Kremen, 337 F.3d at 1036. 109. Id. 110. “One major difficulty all these cases demonstrate is that the data thief is not in court. The plaintiff has suffered an injury at the hacker’s hand, but the data is being held by a third party. While the state of cyberlaw is changing, plaintiffs and lawmakers struggle with the question of whether to hold data processors liable, for how much, and to whom? Besides the public shock at having trust eroded, and the violation of identity theft, is it appropriate, under Article III, to hold a business accountable to all the public? Whose records were taken? Whose records were misused (and is that even a concern)?” Stephen T. Black, Cyberdamages, 36 SANTA CLARA HIGH TECH. L.J. 133, 148 (2020) (emphasis in original). 111. Blue Cross & Blue Shield of Connecticut v. DiMartino, No. 30 06 42, 1991 WL 127094, at *3-5 (Conn. Super. Ct. July 2, 1991). 112. See id. 113. E.g., Nova Chemicals, Inc. v. Sekisui Plastics Co., 579 F.3d 319, 326-27 (3d Cir. 2009). 114. Id. 2021] WHO OWNS YOUR DATA? 327 F. What if Data Is Not Property? The preceding discussion may be summed up with the words of poet James Whitcomb Riley: “When I see a bird that walks like a duck and swims like a duck and quacks like a duck, I call that bird a duck.”115 When we debate whether data is property or not, we may be looking at one of two questions. The first is, “Do we use the schema of property law to look at data and use property law to solve questions involving data?”116 The answer to that question is yes.117 The second question is perhaps more troubling, at least to some who propose to use data, and that is, “If data is property, does that mean I have to compensate the ‘owner’ for its use?” As mentioned previously, this may have troubling repercussions for those who have made businesses out of data use,118 for it would mean that, at least prospectively, there should be payment made to those whose data is used.119 Deciding that data is property will also beg the question, “Who owns data?” This question will be addressed in Part II of this Article. Before proceeding to tackle that question, however, it will be necessary to discuss briefly what it would mean if a bird walks, swims, and quacks, but is, nonetheless, not a duck. In other words, what do we do if data is not property? There are some things that are not property . . . mostly. For example, a liquor license is not property under New Jersey state law.120 From time to time, someone will get themselves in trouble and try to argue that what they possess is not property: As the defendants correctly point out, several circuits have held that state-issued licenses of various sorts are not property for purposes of the mail fraud statute. See United States v. Schwartz, 924 F.2d 410, 417-18 115. MICHAEL HEIM, EXPLORING AM ERICA’S HIGHWAYS 68 (2004) (quoting an unsourced work attributed to James Whitcomb Riley). 116. See Cerajeski v. Zoeller, 735 F.3d 577, 580 (7th Cir. 2013) (“If you own an apple tree, you own the apples; and if you own a deposit account that pays interest, you own the interest, whether or not state law calls interest property.”); see also MONT. CODE ANN. § 70-1-104 (West 2019) (“There may be ownership of: (1) all inanimate things which are capable of appropriation or of manual delivery; (2) all domestic animals; (3) all obligations; (4) such products of labor or skill as the composition of an author, the goodwill of a business, trademarks, and signs; and (5) rights created or granted by statute.”). 117. See supra Sections I.A-E. 118. See supra Section I.B. 119. What to do with the question of reimbursement for data use in the past is beyond the scope of this Article. 120. In re Chris-Don, Inc., 367 F. Supp. 2d 696, 700-02 (D.N.J. 2005); but cf. Sea Girt Rest. & Tavern Owners Assoc. v. Borough of Sea Girt, 625 F. Supp. 1482, 1486 (D.N.J. 1986) (stating that the same license is property for federal due process concerns); cf. Boss Co. v. Bd. of Comm’rs, 192 A.2d 584, 588 (N.J. 1963) (stating that the same license is property for the purposes of federal tax liens). 328 INDIANA LAW REVIEW [Vol. 54:305 (2nd Cir. 1991) (export license); United States v. Granberry, 908 F.2d 278, 280 (8th Cir. 1990) (school bus operator permit); United States v. Kato, 878 F.2d 267, 268-69 (9th Cir. 1989) (pilot license); Toulabi v. United States, 875 F.2d 122, 125 (7th Cir. 1989) (cab driver license); United States v. Murphy, 836 F.2d 248, 254 (6th Cir.), cert. denied, 488 U.S. 924 (1988) (bingo license)[;] United States v. Dadanian, 856 F.2d 1391, 1392 (9th Cir. 1988) (gambling license). The Third Circuit and the First Circuit, on the other hand, have held to the contrary.121 The court in United States v. Carollo continued, “Under traditional property law, it is a ‘well-accepted proposition’ that licensees have a protected property interest,”122 and noted that the Fifth Circuit observed that “we construe ‘property’ in a broad sense for purposes of the federal fraud statutes,”123 and the Supreme Court “construed the term ‘property’ in the federal fraud statutes to signify ‘something of value.’”124 We may also look to the confusing statements regarding human bodies to see that courts have difficulty and go to great lengths to avoid saying something is not property. For example, Texas calls a dead body “a sort of quasi property” in which the living have only certain rights, such as the right to determine a place of burial.125 In Burnett v. Surratt, the court explained that “[t]here is no property in a dead man’s body, in the usually recognized sense of the word.”126 Courts dealing with embryos,127 anatomical gifts,128 or even theft from a tissue bank129 have struggled with the concept. Finally, we turn to the 2019 decision hiQ Labs v. LinkedIn. The Ninth Circuit was faced with the issue of whether LinkedIn, the professional networking website, could prevent a competitor, hiQ, from scraping user information that LinkedIn users have shared on their public profiles.130 In response to LinkedIn’s contention that its members had a privacy interest in their data that LinkedIn had to protect, the court replied, “LinkedIn has no protected property interest in the data contributed by its users, as the users retain ownership over their profiles.”131 121. United States v. Carollo, Crim. A. No. 94-158, 1995 WL 505461, at *1 (E.D. La. Aug. 22, 1995). 122. Id. at *2. 123. Id. (quoting United States v. Loney, 959 F.2d 1332, 1336 (5th Cir. 1992)). 124. Id. (citing McNally v. United States, 483 U.S. 350, 358 (1987); Carpenter v. United States, 484 U.S. 19, 27 (1987)). 125. Burnett v. Surratt, 67 S.W.2d 1041, 1042 (Tex. Civ. App. 1934). 126. Id.; see also Evanston Ins. Co. v. Legacy of Life, Inc., 645 F.3d 739, 747 (5th Cir. 2011), certified question answered, 370 S.W.3d 377 (Tex. 2012). 127. See Evanston, 645 F.3d at 748. 128. Arnaud v. Odom, 870 F.2d 304, 308 (5th Cir. 1989); see also Moore v. Regents of Univ. of Cal., 793 P.2d 479 (Cal. 1990). 129. See Wint v. Ala. Eye & Tissue Bank, 675 So. 2d 383 (Ala. 1996). 130. See hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985 (9th Cir. 2019). 131. Id. at 995. 2021] WHO OWNS YOUR DATA? 329 The court continued, “LinkedIn has only a non-exclusive license to the data shared on its platform, not an ownership interest. Its core business model—providing a platform to share professional information—does not require prohibiting hiQ’s use of that information . . . .”132 And again, just in case any of us missed the point, the court reiterated: We agree with the district court that giving companies like LinkedIn free rein to decide, on any basis, who can collect and use data—data that the companies do not own, that they otherwise make publicly available to viewers, and that the companies themselves collect and use—risks the possible creation of information monopolies that would disserve the public interest.133 We see that the trend is to treat data as property, even though at times it makes us feel uncomfortable. Data, as an intangible, seems to fit within the scope of property law, and we like the ability to say that “I own my data,” and that those I let use it do so under some theory of license. II. WHO OWNS DATA RELATING TO YOU? John Locke’s theory of labor appropriation may seem to apply to data that is currently not being used: To which let me add, that he who appropriates land to himself by his labour, does not lessen, but increase the common stock of mankind: for the provisions serving to the support of human life, produced by one acre of inclosed and cultivated land, are (to speak much within compass) ten times more than those which are yielded by an acre of land of an equal richness lying waste in common. And therefore he that incloses land, and has a greater plenty of the conveniencies of life from ten acres, than he could have from an hundred left to nature, may truly be said to give ninety acres to mankind: for his labour now supplies him with provisions out of ten acres, which were but the product of an hundred lying in common. I have here rated the improved land very low, in making its product but as ten to one, when it is much nearer an hundred to one: for I ask, whether in the wild woods and uncultivated waste of America, left to nature, without any improvement, tillage or husbandry, a thousand acres yield the needy and wretched inhabitants as many conveniencies of life, as ten acres of equally fertile land do in Devonshire, where they are well cultivated?134 Do we then reason that data left uncultivated is like land “left to nature”? Or do we think that once we have private property, “my personal use, plans and 132. Id. at 998. 133. Id. at 1005 (emphasis added). 134. JOHN LOCKE, SECOND TREATISE OF GOVERNMENT ch. V, § 37 (1690), http://www.gutenberg.org/files/7370/7370-h/7370-h.htm [https://perma.cc/9VAT-A8QP]. 330 INDIANA LAW REVIEW [Vol. 54:305 rights of disposal are primary and checked only by my not (legally) infringing on the like plans of others.”135 Thus, the following four questions: – If I collect it, is it mine? – If I observe it, is it mine? – If I derive it, is it mine? – If I create it, is it mine? may all have the same answer of, “It depends.” Let’s assume that I create a theme song for you136—or a logo, or a color,137 or a dance move.138 Is it yours? In 1971, Carolyn Davidson was a graphic design student at Portland State University. In 1969, she met Phil Knight, then-assistant professor at PSU who would go on to found Blue Ribbon Sports, and, in turn, Nike. Knight knew Davidson was in search of extra funds to take oil painting classes, so he asked Davidson to help him out on some projects at a rate of $2 an hour.139 Davidson charged Knight for 17.5 hours of work and was paid $35.140 Knight was up against a deadline; shoe boxes that were to include the new logo were waiting to be printed, so he had to make a decision. He chose what is recognized today around the world as the “Swoosh,” telling Davidson, “I don’t love it, but it will grow on me.”141 In 1983, Davidson was invited to a surprise meeting at Nike.142 She was treated to a catered lunch at which she was presented with a gold swoosh ring and an envelope containing approximately $1 million of Nike stock.143 She later said, “[T]his was something rather special for Phil to do, because I originally billed 135. Sibyl Schwarzenbach, Locke’s Two Conceptions of Property, 14 SOC. THEORY & PRAC. 141, 160 (1988). 136. Bruce Haring, ‘The Andy Griffith Show’ Theme Song Is Subject of Legal Dispute, DEADLINE (May 24, 2019), https://deadline.com/2019/05/andy-griffith-show-theme-song-cbs- lawsuit-1202622146/ [https://perma.cc/KV3L-G574]. 137. Adelaide Saucier, Color Blocking: How to Protect a Color, CTR. FOR ART L. (Apr. 10, 2019), https://itsartlaw.org/2019/04/10/color-blocking/ [https://perma.cc/ZD3R-2SCV]. 138. See 17 U.S.C. §102(a)(4) (2020); Copyright Registration of Choreography and Pantomime, U.S. COPYRIGHT OFF., https://www.copyright.gov/circs/circ52.pdf (last updated Sept. 2017) [https://perma.cc/6EMH-59RK]. 139. The $35 Nike Logo and the Woman Who Designed It, CREATIVE MKT. (Feb. 10, 2020), h ttps://creativem arket.com /blog/th e-3 5 -n ik e -lo g o -a n d -t h e -w o m a n -w h o -d esign ed-it [https://perma.cc/3Z48-UXQY]. 140. Id. 141. The Origin of the Nike Swoosh, STEVEN SAMBLIS, https://www.stevenmsamblis.com/the- origin-of-the-nike-swoosh/ (last visited Jan. 23, 2021) [https://perma.cc/2UCK-F85Y]. 142. Id. 143. Id.; The $35 Nike Logo and the Woman Who Designed It, supra note 139. 2021] WHO OWNS YOUR DATA? 331 him and he paid that invoice.”144 What if I create a number for you (think credit card number, social security number, address, etc.)? Is it yours, or mine? Does your email address belong to you? The explosion of data protection regimes throughout the world purport to give individuals “rights in their data.”145 As has been discussed, rights in data is tantamount to treating data as property, so it would be appropriate to say that you “own” your social security number, your email address, or your name. But what does that really mean? A. Is There Just One Owner of Data? We like to think about tangible property—a car, for example—when we think about ownership. We can touch it, see it, and watch it move. When we talk about ownership of the car, we can wrap our minds around what title means, what possession means, and what a transfer from one owner to the next looks like. When we discuss using a car for collateral on a loan, we understand that the creditor may be able to come and repossess the car upon default. All of that understanding goes out the window when we talk about intangible property. We try to draw analogies and to visualize what possession really means, but in many ways, we fall short. This is nowhere more apparent than when we try to talk about ownership and possession of data. A share of this difficulty is the subject of this Part, which discusses what happens when data describes more than one individual, or when data is “owned” by more than one person. 1. Household Data.—A wrinkle surrounding data ownership relates to the regulation of household data. What is household data? Interestingly, although the term “household data” is present in various statutes regulating data privacy and ownership, it is never actually defined.146 For example, the definition section of the CCPA defines personal information as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”147 Likewise, the GDPR grants an exception 144. The Origin of the Nike Swoosh, supra note 141. 145. Elizabeth R. Pike, Defending Data: Toward Ethical Protections and Comprehensive Data Governance, 69 EMORY L.J. 687, 711 (2020); see also Pamela Samuelson, Privacy as Intellectual Property?, 52 STAN. L. REV. 1125, 1134 (2000). 146. See e.g., Cal. Civ. Code §§ 1798.140(a), 1798.140(c)(1)(B), 1798.140(k), 1798.140(o)(1) (West 2020); Regulation 2016/679, of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 3, 4; S. 1670, 122d Leg., Reg. Sess. (Fla. 2020) (proposing legislation similar to the CCPA for the State of Florida). 147. Civ. § 1798.140(o)(1). 332 INDIANA LAW REVIEW [Vol. 54:305 for data collected for “purely personal or household activit[ies].”148 The GDPR lists examples of “personal or household activities” but does not distinguish between what is personal and what is household.149 Household data may refer to the type of data collected by the U.S. Census, since each survey is completed by a household.150 However, it likely includes far more than basic biographical data collected by the census. Utility bills and subscription services all reveal information about the household as a whole.151 The dictionary defines household as “those who dwell under the same roof and compose a family” or “a social unit composed of those living together in the same dwelling,”152 which does little to clarify what is household data. Likewise, is personal information separate from household data, or can a piece of data be both personal and household data? It seems that the latter is the answer. For example, an address describes the physical location of the household, but for this to not be personal data seems ridiculous. What, then, is household data that is not personal data? Does each member of the household have ownership in data collected about the household? Is the household a new entity separate from its members? This may seem like a minor distinction, as household members are typically thought of as having aligned interests and values relating to data. For example, a family living together likely will have little conflict over ownership issues.153 With a family, there is an idea that the unit acts as one, with similar goals, interests, and values. A mother and father living together most likely agree when one can disclose shared information, such as electricity use, to third parties. However, the term “household” encapsulates more than families. Roommates may also make up a household and are more likely to have misaligned interests and values in regard to data sharing and collection. In an extreme example, dozens or sometimes upwards of sixty unrelated members of a Greek-letter organization may live together in a sorority or fraternity house. If one roommate consents to household data being shared but others do not, may the non-consenting roommates seek to prohibit the disclosure? Does the original roommate have the right to share any and all household data? 148. Regulation 2016/679, of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 3, 4. 149. Id. 150. Questions Asked on the Form, U.S. CENSUS 2020, https://2020census.gov/en/about- questions.html (last visited Jan. 21, 2021) [https://perma.cc/3UUE-GBXS] (Data collected includes the name, number, and race and ethnicity of each person living at the address). 151. See 15 U.S.C. § 1681a(d)(1) (2020) (consumer report pursuant to the Fair Credit Reporting Act relates to credit for “personal, family, or household purposes”). 152. H o u seh o ld , M E R R I A M -W E B S T E R , h t t p s :/ / w w w . m erriam -w ebster.com / dictionary/household (last visited Jan. 21, 2021) [https://perma.cc/TJ4G-7FC8]. 153. But see discussion infra Section II.B (talking about children’s ownership of data and how parents do not always have children’s best interests in mind). 2021] WHO OWNS YOUR DATA? 333 If members including minor children own household data, does this inadvertently trigger liability under the Children’s Online Privacy Protection Rule (COPPA)?154 COPPA, which heavily regulates the use of children’s data, places additional consent and use requirements on the use of data for individuals under the age of thirteen.155 Does COPPA apply if minors are the owners of the data, or if the data is about the minor? If ownership creates the protection, and each member of the household can own household data, then household data will drastically and unintentionally increase the scope of COPPA. B. Who Owns Children’s Data? The confusion surrounding data ownership is exemplified in the context of children’s data ownership. In today’s world, “[i]t is suggested that nearly 81 per cent of children in Western countries and 92 per cent of US children born in the post social media world have some kind of online presence before they turn two years old.”156 Minors cannot own their own data, but minor data is among the most heavily regulated categories of data.157 Up until recently, parents have been regarded as the unquestioned owners of their children’s data. “Courts and philosophers writing about parental rights often trace the legitimacy of these rights to the role parental authority plays in the exercise of parental responsibility.”158 Many privacy laws provide an exception that allows information to be disclosed to or controlled by a parent.159 Both statutes and research tend to focus on “third party threats” to a child’s privacy and not the relationship with a parent.160 154. 15 U.S.C. §§ 6501-6505; Children’s Online Privacy Protection Rule, 16 C.F.R. § 312 (2021). 155. See 15 U.S.C. §§ 6501-6505; 16 C.F.R. § 312. 156. Teresa Davis, Data Ownership Legislation Probably Won’t Protect Children, MI3 (Jan. 14, 2020), https://www.mi-3.com.au/14-01-2020/why-data-ownership-basis-legislation-may-not- always-make-sense-when-its-childrens [https://perma.cc/XC3C-LYYE]. 157. See Simone van der Hof, I Agree… or Do I? — A Rights-Based Analysis of the Law on Children’s Consent in the Digital World, 34 WIS. INT’L L.J. 409 (2017); Carolina Alonso, This Little Piggy Went to Wall Street: Privacy Law When a Toy Becomes Your Child’s Banker, 1 GEO. L. TECH. REV. 458 (2017); Virginia A. M. Talley, Note, Major Flaws in Minor Laws: Improving Data Privacy Rights and Protections for Children Under the GDPR, 30 IND. INT’L & COM P. L. REV. 127, 148 (2019). 158. Barbara Bennett Woodhouse, Hatching the Egg: A Child-Centered Perspective on Parents’ Rights, 14 CARDOZO L. REV. 1747, 1818 (1993). 159. See, e.g., 16 C.F.R. § 312 (2021); 34 C.F.R. §§ 99.3, 99.31(a)(11), 99.37 (2021); Office for Civil Rights, Does the HIPAA Privacy Rule Allow Parents the Right to See Their Children’s Med ical Record s?, U.S. DE P ’ T HE AL T H & HU M . SE R V S . (Dec. 19, 2002), https://www.hhs.gov/hipaa/for-professionals/faq/227/can-i-access-medical-record-if-i-have-power- of-attorney/index.html [https://perma.cc/CV2S-S4JS]. 160. Benjamin Shmueli & Ayelet Blecher-Prigat, Privacy for Children, 42 COLUM. HUM. RTS. 334 INDIANA LAW REVIEW [Vol. 54:305 It is generally thought that a parent will act in the child’s best interest in all scenarios and will carefully outweigh the risks from revealing private information with the social benefit.161 However, these assumptions may not necessarily be true.162 Professor Phoebe Maltz Bovy stated, “[t]he reader assumes that the parent will do what’s best for her child. While the parent may set out to do this, using their own children in the service of a larger argument clouds their ability to self- censor. And with confession can come vanity.”163 These assumptions have permeated into the law: Current laws protecting children’s privacy reflect the strong tradition of parental rights to control and shape the lives of their children. Many laws aimed at protecting children’s privacy are written from the paternalistic viewpoint that the parent has exclusive control over the disclosure of a child’s personal information. Privacy laws provide little guidance, prohibitions, or remedial measures for children needing privacy protection from their parents’ online disclosures. This reality is partly based on the idea that society generally accepts the notion that parents will always do what is best for their children. In addition, these laws are designed to protect information about children generated outside the home, primarily in school and healthcare settings. In the context of these settings, parents are presumed to be the best guardians to insure protection of their children’s private information. These frameworks do not include social media sharing, nor do they consider a parent as a potential source of harmful disclosure.164 Upon recognizing a child’s privacy may not be fully protected by a parent, there has been a growing movement to give children some type of control over their data.165 The United Nations Convention on the Rights of the Child (UNCRC) contains two provisions relating to privacy of children: L. REV. 759, 759 (2011). 161. Stacey B. Steinberg, Sharenting: Children’s Privacy in the Age of Social Media, 66 EMORY L.J. 839, 843-44 (2017). “The University of Michigan conducted a study exploring the ways parents share online about their children. . . . The study noted that 56% of parents shared (potentially) embarrassing information about their children online, 51% provided information that could lead to an identification of their child’s location at a given time, and 27% of participants shared (potentially) inappropriate photos.” Id. at 848 (citations omitted). 162. Id. at 847. 163. Id. at 850-51 (quoting Phoebe Maltz Bovy, The Ethical Implications of Parents Writing About Their Kids, AT LANTIC (Jan. 15, 2013), https://www.theatlantic.com/sexes/archive/2013/ 01/the-ethical-implications-of-parents-writing-about-their-kids/267170/ [https://perma.cc/TZW9- RFFQ]). 164. Id. at 861-62. 165. See Woodhouse, supra note 158, at 1819 (“When we base parents’ superior rights on a presumption that they will act in their child’s interest, we essentially use ‘rights talk’ as a proxy for examining children’s interests. Instead, we should acknowledge children’s interests directly as the central focus.”). 2021] WHO OWNS YOUR DATA? 335 1. No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation. 2. The child has the right to the protection of the law against such interference or attacks.166 However, Professors Benjamin Shmueli and Ayelet Blecher-Prigat criticize this approach, saying, “[T]he right to privacy, as articulated by the UNCRC, does not fit neatly within either the category of autonomy or that of need.”167 If a child has a right to privacy distinctly separate from a parent (and, in some cases, an interest opposite of what the parent desires), does this mean the child has a right to their data? Does this mean a child owns their data? C. Third-Party Data Another interesting scenario is when a third party collects or creates data about another. An example of this is the notorious “Plane Bae”168 saga that occurred in the summer of 2018.1 6 9 A woman named Rosey Blair boarded a flight from New York to Dallas and switched seats with another woman so Blair could sit next to her boyfriend.170 The other woman began talking to her new seatmate and ended up chatting the entire flight.171 The interaction was captured and shared by Blair, who posted a Twitter thread narrating the budding romance between the two without the consent or knowledge of either passenger.172 The thread was composed of over fifty tweets, which detailed the conversation (they were both fitness instructors, and small talk quickly progressed into more serious discussions about marriage and children) and noted that the couple shared an armrest and that the unnamed woman briefly rested her head on the man’s shoulder.173 Blair’s thread, dubbed as “#PlaneBae,” instantly went viral, receiving over three hundred thousand retweets and nearly one million likes, with readers around the world heavily invested and hoping the “Plane Baes” would turn into a real-life romance movie.174 While heartwarming to some, others felt this was a gross invasion of privacy, 166. Convention on the Rights of the Child art. 16, Nov. 20, 1989, 1577 U.N.T.S. 3. 167. Shmueli & Blecher-Prigat, supra note 160, at 771. 168. Bae is slang for one’s significant other. 169. Taylor Lorenz, Unidentified Plane-Bae Woman’s Statement Confirms the Worst, ATLANTIC (July 13, 2018), https://www.theatlantic.com/technology/archive/2018/07/unidentified- plane-bae-womans-statement-confirms-the-worst/565139/ [https://perma.cc/5K8K-ZP7S]. 170. Id. 171. Id. 172. Id. 173. Megan Garber, Two Strangers Met on a Plane—and the Internet Ruined It, AT LANTIC (July 6, 2018), https://www.theatlantic.com/entertainment/archive/2018/07/planebae-and-the-slow- death-of-whimsy/564473/ [https://perma.cc/Q8QL-4H9E]. 174. Id. 336 INDIANA LAW REVIEW [Vol. 54:305 especially since the woman took all possible measures to shield her identity and remain private.175 The woman issued a statement saying: I am a young professional woman. . . . Without my knowledge or consent, other passengers photographed me and recorded my conversation with a seatmate. They posted images and recordings to social media, and speculated unfairly about my private conduct. Since then, my personal information has been widely distributed online. Strangers publicly discussed my private life based on patently false information. I have been doxxed, shamed, insulted and harassed. Voyeurs have come looking for me online and in the real world. I did not ask for and do not seek attention. #PlaneBae is not a romance – it is a digital-age cautionary tale about privacy, identity, ethics and consent. Please continue to respect my privacy, and my desire to remain anonymous.176 This raises an interesting point. If Blair had posted other observations about her flight, such as the wait time on the tarmac or the color of the plane seats, there would be no question that she could share this information. Even if she had posted information about individuals, such as the number of passengers on the flight, there would still be no debate over if she could share this or not. So, does the Twitter thread only feel wrong because it “went viral” and attracted an unforeseeable amount of attention to the subject? Or perhaps, it is due to the amount of information revealed and level of invasiveness. While this principle seems right, it is nearly impossible to describe; a third party can own data about another until it becomes too personal. Still, many feel that this was in a quasi- public place, so there was nothing wrong with Blair’s actions. Additionally, what does data ownership (and control) mean for the right to free speech granted by the First Amendment? If one is not free to record observations about others, the rights granted by the First Amendment are severely limited. Likewise, there is massive societal benefit from being able to share information, including negative information, about other individuals. Courts have recognized both the benefit and the right for individuals to reveal information about third parties. In Haynes v. Alfred A. Knopf, Inc., a man sued the publishing company and author of a journalistic history book that portrayed Haynes in an unflattering manner, describing his failed marriage, alcoholism, and irresponsible actions.177 The court disagreed with Haynes’s claim that this was an invasion of privacy because the public had an interest in this historical and factual account, since the book was about the migration of southern sharecroppers to northern 175. Despite this, her name and address were posted online. Lorenz, supra note 169. 176. Kaylee Fagan, The Woman in the #PlaneBae Saga Breaks Her Silence – She Says She’s Been ‘Shamed, Insulted, and Harassed’ Since the Story Went Viral and Asks for Her Privacy, BUS. INSIDER (July 13, 2018), https://www.businessinsider.com/planebae-saga-woman-privacy- anonymity-2018-7 [https://perma.cc/82B3-78DC]. 177. Haynes v. Alfred A. Knopf, Inc., 8 F.3d 1222, 1224-26 (7th Cir. 1993). 2021] WHO OWNS YOUR DATA? 337 cities and how it impacted families and morals.178 The personal details of Haynes’ life were necessary to inform readers about this important subject matter. People who do not desire the limelight and do not deliberately choose a way of life or course of conduct calculated to thrust them into it nevertheless have no legal right to extinguish it if the experiences that have befallen them are newsworthy, even if they would prefer that those experiences be kept private.179 If the court had decided for Haynes, then it would be nearly impossible to write biographies or news articles about others without their consent.180 This is not to say that someone can publish any and all information about an individual without repercussions.181 Rather, when one reveals information about a third party, courts have adopted a balancing approach to determine if an individual’s privacy rights are violated. D. Data From AI? Finally, what happens when data is created by artificial intelligence (AI) mechanisms? There are many subfields in AI, but we can examine just a few to help understand the data ownership issues. Deep learning takes advantage of advances in computing power to reveal complex patterns in large amounts of data. Common applications include image and speech recognition but can also include pattern recognition from large numbers of traffic or security cameras. Cognitive computing deals with human- machine interaction, striving to make the machine appear more human-like. Computer vision tries to replicate human pattern recognition and process images or videos in real time. A couple of examples may help illustrate the issues. Example 1. A computer system watches shoppers in a mall and identifies a trend among single male shoppers over a certain age. That information leads to a profile that identifies a certain subset of the population who are discovered to spend five times more than “normal” shoppers. Example 2. Combining data from internet searches, a computer system discovers an interaction between two unrelated drugs that are both FDA- approved.182 Adding in a third dataset of medical records, an algorithm finds a 178. Id. at 1232-35. 179. Id. at 1232. 180. See, e.g., id. at 1234 (“If [the author] cannot tell the story of Ruby Daniels without waivers from every person who she thinks did her wrong, he cannot write this book.”). 181. In Haynes, the court recognized there were limits to how much one could share about another; in the book, the author excluded “intimate details,” such as descriptions of sexual acts. Id. at 1230. 182. Based on true facts. See Big Data Proves Effective in Identifying Harmful Drug Interactions, DIAG N O S T IC & INT E R V E N T IO N AL CAR D IO L O G Y (Dec. 13, 2016), https://www.dicardiology.com/content/big-data-analysis-proves-effective-identifying-harmful-drug- 338 INDIANA LAW REVIEW [Vol. 54:305 subset of the population who are not affected by the drug interaction. Possessing that immunity suddenly becomes a very valuable trait. In each of these examples, is the data which identifies an individual as part of a subset of the population personal data? Does it belong to the individuals or to the data creator/discoverer? Under different circumstances, we might agree that shopping data or surveillance data about the public might fall within the type of property that belongs to the creator. But, in this case, the creator/discoverer of the data is a computer system. Noting that computers are tools, we might then agree that we assign ownership of the rocking chair to the person who built it, not to her tools. We often think of property as some version of entitlement to things: I have a right to this thing or that. In a more sophisticated version of property, of course, we see property as a way of defining our relationships with other people. On such versions, my right to this thing or that isn’t about controlling the “thing” so much as it is about my relationship with you, and with everybody else in the world[.]183 After all, we might see the conduit as the programmer writing the tool to “see” the relationships in very large datasets; with enough time, the programmer could have seen those relationships without the tool. But what happens when the AI systems we create become more sophisticated? We are, after all, trying to recreate human perception, thought, and speech. We could imagine AI systems that spin off AI systems, and will we then see the data that the spinoffs discover as belonging to the original programmer? Or what happens in Example 1, when I begin to assign my shopping to my own AI construct, which is then watched by an AI construct owned by the mall who passes the resulting data to a third AI construct owned by the shopkeeper? Is it personal data when one robot watches another? These and other questions loom in our future as we collect more and more data in more and more sophisticated ways. CONCLUSION Data is property. Although the nature of data as bits of information that describe our world or the people in it may seem ephemeral, we are confronted with the reality that data is important, it drives business and personal decision- making, and that it is big business. We also see an explosion in data regulation schemes to respond to the marked rise in data theft and manipulation, and this interactions [https://perma.cc/JGE9-NKPH]; Scott Hensley, How a MacBook Pro Found Unexpected Drug Side Effects, NPR (May 25, 2011), https://www.npr.org/sections/health- sh ots/2 0 1 1 /0 5 /2 5 /1 3 6 6 51568/how-a-macbook-pro-found-unexpected-drug-side-effects [https://perma.cc/2ASE-4ZAT]. 183. CAROL M. ROSE, PROPERTY AND PERSUASION: ESSAYS ON THE HISTORY, THEORY, AND RHETORIC OF OWNERSHIP 27-28 (1994) (emphasis in original). 2021] WHO OWNS YOUR DATA? 339 fact, perhaps more than any other, compels us to ask the question, “Who owns data?” Examining the nature of property and data lets us see that, on some levels, data is not so different from other types of intangibles that we already accept as property. Data subjects are able to allow some to use and exclude others from using the information about them. Data subjects are able to transfer their rights of data to others, with some interesting exceptions, including the “stickiness” factor that the original data subject may always be able to exercise some rights of exclusion. Warren and Brandeis’ article, “The Right to Privacy,” reminds us that there should be a right to leave personal data idle. Last, but not least, data has tremendous value, particularly in today’s world where marketing and online selling rely upon mountains of data about consumers and their behavior. We then see that data can be treated as property, but also that it presents us with a unique set of characteristics. Dealing with the concept of data ownership presents challenges that are not novel but that certainly stretch our current understanding of what ownership entails. For example, some data is created by governments, companies, or organizations to describe individuals. The concept of ownership must encompass rights possessed by both the entity creator and the described individual in what we term data mutuality. In addition, ownership must deal with the fact that some data describes multiple parties in a household, organization, or group, and that each member of that group could potentially exercise the rights of ownership, including the right to allow others to use or to exclude others from using the group-owned data. These types of issues may be further compounded when one of the group members is a minor. Ownership rules must then take into account the various laws that protect the data of minors. Describing data as property is then a most normal choice and at the same time a very confusing one. We find that data is property of a most unusual type and yet the issues surrounding its use and ownership are familiar. As we see more and more jurisdictions willing to regulate the use of personal data, we will see this new type of property change as well.