Edition 012: Data as a Fiction

I think data is the fourth fictitious commodity.[1] The market treats it as a product. The consequences fall on the people who produce it by being alive.

The treatment of data as a product depends on a particular claim about what data is. Some have claimed that data is a kind of capital, a productive asset that companies own. The idea has spread from business school journals into how governments and corporations talk about the “data economy.” Data is wealth, the argument goes, and the corporations that hold it should be understood as its owners.

I disagree. Data is neither capital, nor a commodity. It is not something a corporation makes. It is something you make, by living.

The law currently divides what comes from a person into categories. There is personal data, which is the legal term for information that can identify you. There is anonymized data, which is what personal data is called once your name has been stripped out. There is aggregated data, which is what your information becomes when it is averaged together with the information of many others. And there is intellectual property, which is what the law calls a creative work and protects as the property of whoever holds the rights to it. The categories were drawn by people who benefited from drawing them. A piece of data that has been stripped of your name is still the record of something in your life. A creative work made in part from your contributions is still derived from you. Calling these things by different names does not change what they are.

I watched part of the categorizing of data happen. Earlier in my career, many talented lawyers I knew flocked to the “new” field of data privacy. My law partner, Charles, and I were doing something different. We worked across data, technology contracts, and intellectual property, and we watched the privacy specialty develop with what Charles called the look of “a cow staring at a new gate.” It is a particular kind of look, half wonder and half confusion, that the animal gives a thing it has not seen before and cannot place. The privacy field was not really about privacy. It was about compliance. The framework had named a category (personal data), drawn rules around it, and produced an industry of lawyers who specialized in helping corporations meet the rules. Those rules were a nuisance to corporations, and they didn’t really help people either. Charles and I cared about privacy. We thought of it as the conditions under which a person can live a life without being surveilled or extracted from. “Data privacy” and “privacy” may have sounded the same. They were not. It made no sense to us that the field was treating personal data as a separate problem when the broader category was producing the same harms. We said so many times. We published a blog. We gave speeches and wrote papers. We were part of the conversation. Compliance captured the mindshare anyway.

Privacy is what keeps the individual an individual at all. It is the boundary that lets a person remain distinct from the institutions that would otherwise reach in and read every part of them. The two largest powers in modern life, the government and the corporation, are the institutions with the means and the motive to reach. Privacy is the fence that keeps them from doing so at will. The compliance industry did not protect that fence because the legislature did not. The framework the legislature wrote named a narrow category of personal data, drew narrow rules around it, and left the rest for the taking.

Even the strongest version of the framework, the European General Data Protection Regulation (“GDPR”), accepts the category error at its foundation. The GDPR is built around the rights of what it calls a data subject, not a person. A “data subject” is what a person becomes when the framework gets through with them. The word puts the data first and makes the person the modifier. The framework that is supposed to be the most protective in the world has already conceded, in its vocabulary, that the data is the thing and the person is what the data is about. The compliance industry then did the work the framework made possible. It worked for the corporations who paid the lawyers. It found the places where the fence could be moved or walked through or quietly stepped over using a notice and a consent form. And this is what is legal and what is required. When I do data privacy work, this is what I do. This is what every lawyer does. The framework called this privacy. It was not privacy. It was the orderly negotiation of how much of a person the corporation could take and still call itself compliant.

Consider what that data really means. Some of what makes you was dealt at birth, by biology, circumstance and whatever greater power you believe in. The color of your eyes. Your fingerprints. Your DNA. These are not chosen. They cannot be changed. They are the immutable part of being you. The rest is lived. Your lived life is equally you. All hours of your life, the decisions you made, the people you loved, and the things you searched on the internet that made you look like a “cow staring at a new gate.” Every genetic test result, every time you walk by your neighbor’s doorbell camera, every search, every purchase, and every message is the trace of a moment of you being alive. The record is part of the person it records. All of it accumulates. All of it is data. The immutable part and the lived part together are what a person is.

Yet, the structure adopted is identical to Polanyi’s three fictitious commodities. Land was here before any of us and was converted into property. Labor is human activity and was converted into an input. Money is a social agreement and was converted into a scarce resource. Data is the record of human life and experience and is being converted into a commodity. In each case, the fiction serves the people doing the converting. In each case, the consequences fall on the people being converted from.

***

The fiction is in place. The category has been drawn. The framework has done its work. What it has not done is sever the thing the framework was built to take from the person it was taken from. That is the next argument.

***

[1] See Not Built For You, Edition 011: The Market as a Design Choice