IoT and Data Ownership: Your Device your Data?
Greater openness across IoT data ecosystems will result in a broader range of services being offered to end users.IoT and Data Ownership
Who owns IoT data? It’s a question at the heart of the modern data economy. At its most fundamental, and from a legal standpoint, data can only be owned once they are gathered into a data-base or platform. “As a thumb rule, whoever owns the title to the data processing platform owns the data,” says Somjit Amrit, country head at AM Technologies. But just as important as outright ownership are data privacy, security, and subject data rights and access. Data ownership can play out very differently in individual applications, while there are also broad distinctions across consumer and commercial use cases. Meanwhile, in instances where equipment is leased, data ownership will typically be deter-mined by a contractual clause.
Types of data matter too: personal data is a special case, especially since the introduction of the European Union’s General Data Protection Regulation (GDPR) in 2018, which granted individuals robust data rights, including portability and the right to deletion. The situation is made more complex by techniques such as data anonymization, de-identification, or aggregation, whereby an organization may want to store and use data in a form untraceable to individuals. However such approaches are controversial, given that it has been demonstrated that in some cases “anonymized” data can be traced to an individual using just a handful of data points.
Given that an IoT ecosystem will often have multiple stakeholders, including manufacturers, end users, third party solutions providers, and even the public sector, often the situation can best be characterized as “give and take” says Amrit. “Data could be owned by the owner of the data processing platform, but it could be shared with the ecosystem in exchange of discounts, incentives, or the price to be paid for curating he raw data into processed and us-able data to generate insights,” he says. As data become more valuable, organizations are having to invest more in the asset, as well as facing increased scrutiny from the public and regulators. But it wasn’t always this way. When computing power was emerging among corporations, many companies saw data as a poor relation to hardware and software, which were considered to be the tangible assets, observes Fedelma Good, a director in PwC UK’s Data Protection Strategy, Law, and Compliance Services team. But that is changing, she believes, as elements of the GDPR, especially transparency and accountability, force companies to be more circumspect about how they gather and store data, while incurring greater costs to ensure compliance. “The [next stage] will be when we get to a way that you can assign a real value to data in the con-text of an organization. And we have it to a certain extent already in good-will. I still think that what is missing is an element about the quality of the assets and the lifespan of the asset, which becomes even more important with GDPR,” she says.
Just as fundamental as questions about ownership are questions about access. The classic example is of an IoT device – say a construction machine or a car – that generates large volumes of data, but within a closed ecosystem which only the manufacturer can access to deliver services such as telematics. That means any third-party solutions providers may have to install additional hardware if they want to provide services. This situation is especially acute in commercial operations where a company runs a large vehicle or machinery fleet with multiple brands. In some cases they will be forced to rely on multiple telematics systems or use additional hardware in order to view their fleet data via a single ERP.
