The Ownership Problem That Access Rights Cannot Solve
Most privacy legislation in force as of 2026 grants individuals a right to access their data. The GDPR grants a right to portability. The CCPA grants a right to deletion. These are meaningful procedural rights. They are not ownership.
The distinction matters enormously for engineers and policy architects alike. Access rights operate after the fact. They assume a data record already exists, already lives inside a platform's infrastructure, and is already indexed to serve that platform's interests. When a user requests their data under Article 20 of the GDPR, they are asking permission to see what a third party chose to record about them. The record itself originated with the platform. The platform remains the de facto author and custodian of that asset.
Ownership, in any coherent legal or economic sense, requires control at the moment of origination. You do not own land because the county lets you walk through it. You own land because your name is on the deed from the moment of transfer. Personal data has no equivalent origination instrument. The PDAOS model, developed through the research program behind MyDataKey and formalized in Dr. Patrick Fisher's work on digital sovereignty, is the technical architecture that creates one.
What the PDAOS Model Actually Does
A Personal Data Asset Origination System is not a privacy tool. It is not a consent manager. It is not a portability layer bolted onto an existing data pipeline. It is an upstream infrastructure that establishes the individual as the originating party of every data asset created from their behavior, identity or biological signal.
The core PDAOS mechanism has four components:
- Origination binding: A cryptographic linkage between the data subject and the moment of data creation, using a Decentralized Identifier (DID) conforming to the W3C DID Core specification (w3.org/TR/did-core).
- Asset declaration: A machine-readable data asset record that defines the type, scope, provenance and intended processing purpose of a specific datum, expressed as a Verifiable Credential under the W3C VC Data Model (w3.org/TR/vc-data-model).
- Consent receipt with cryptographic binding: A consent record compliant with the Kantara Initiative Consent Receipt specification, signed by the data subject's private key, not by the platform's key. This inverts the current industry norm where the platform signs its own terms.
- Revocation infrastructure: A DID-linked revocation registry that allows the data subject to invalidate downstream processing authorization without relying on a platform's compliance function.
Together these components produce a data asset that carries its ownership provenance inside its own structure. The asset is self-describing and self-authorizing. Platforms that ingest it become downstream processors, not originators.
Data-as-Property Frameworks and Their Structural Limits
The data-as-property argument has appeared in policy circles in various forms. At its cleanest, it borrows from Locke: you mix your labor with raw material and acquire a property right. Your behavioral data is the product of your activity, your attention, your time. By extension, the argument goes, it should be yours to own and alienate like any other chattel.
The structural problem is that data is non-rivalrous and non-excludable in ways that physical property is not. When a platform copies your data to a second server, you have lost nothing tangible. Traditional property law has no clean instrument for this. Data also aggregates in ways that generate entirely new economic value at the platform level, value that did not exist in any single contributor's dataset. Assigning property rights to the inputs does not resolve who owns the emergent output.
Scholars including Lothar Determann have argued in detail that data-as-property regimes risk creating perverse incentives where platforms simply encrypt data at collection to establish a de facto property claim before any user right can attach. The 2022 European Data Act attempted to sidestep this by assigning data access rights to data generators rather than data subjects in industrial contexts, which illustrates how property framing consistently slides toward the entity with collection infrastructure.
PDAOS does not argue that data is property in the traditional sense. It argues that origination control produces a functional equivalent to title, one that is cryptographically verifiable rather than registry-dependent.
Data-as-Labor, Weyl, Lanier, and the Compensation Trap
Glen Weyl and Jaron Lanier, writing separately and together, advanced what became the most influential alternative framing: data as labor. The argument holds that AI systems are trained on human-generated data, that this data has measurable productive value, and that data subjects should be compensated for it through a mechanism Weyl termed "data as labor" in the Radical Markets framework.
The practical proposal involved Data Labor Unions, collective bargaining structures that would negotiate compensation between data subjects and platforms on behalf of large contributor pools.
From a technical architecture standpoint this framing has a fundamental flaw: it assumes the platform remains the legitimate collector and processor, and merely asks whether compensation is fair. It does not challenge origination. A data labor model in which your behavioral signal is collected by a platform, aggregated into a training corpus, and then a union negotiates your royalty rate is still a model in which the platform holds the origination record. You are a contributor to someone else's asset, not the originator of your own.
The compensation mechanism also creates perverse incentives at the system level. If individual data items have negotiated prices, collectors will optimize data collection to minimize compensable signals while maximizing model utility. Differential privacy research, including the foundational work by Dwork, McSherry, Nissim and Smith (the DMNS mechanism, published at ICALP 2006), demonstrates that meaningful privacy guarantees require reasoning about the entire dataset, not about compensation for individual records.
PDAOS takes the valid insight from data-as-labor, that data subjects should have economic standing, and grounds it in origination rather than compensation. If you originated the asset, you can license it, revoke the license or refuse the transaction entirely. Compensation becomes a downstream commercial term, not the foundational right.
Data Trusts and Fiduciary Models: Closer, But Still Proxy Ownership
Data trusts have attracted serious attention from researchers at the Open Data Institute, legal scholars including Jack Balkin (who developed the data fiduciary concept), and policy bodies including the UK's Centre for Data Ethics and Innovation. The fiduciary model is compelling: just as a financial advisor has a duty of loyalty and care to a client, a data fiduciary would owe legally enforceable duties to the data subjects whose information it holds.
This is genuinely closer to meaningful protection than either property or labor frameworks. Fiduciary duties have teeth in common law jurisdictions. Balkin's formulation, that information fiduciaries should be prohibited from acting against the interests of their end users, would substantially constrain the current behavioral advertising model if enacted.
The limitation is structural: a data trust or fiduciary is still an intermediary. The data subject has delegated their rights to a trustee. The trustee holds the origination record on their behalf. This is proxy ownership, not direct ownership. It replicates the structure of financial trusts, which are valuable instruments but which also historically have been captured by the interests of the institutions administering them rather than the beneficiaries they serve.
Data trusts require regulatory infrastructure to function. They require the trustee to remain solvent, independent and incorruptible across the data's useful lifespan. They do not solve the origination problem because the origination record still lives inside a third-party institution. PDAOS addresses this by making origination a cryptographic fact about the data itself, not a legal arrangement between institutions.
Why Origination Control Is the Foundational Layer
The concept of origination control maps onto a well-understood principle in intellectual property: the work-for-hire doctrine. A work created by an employee in the scope of employment belongs to the employer, not the creator, because the employer controlled the origination conditions. The employer provided the tools, the environment and the purpose. Data collection by platforms is structurally identical. The platform provides the app, the sensor infrastructure, the processing pipeline. The user generates signal inside that infrastructure. By default, the platform controls origination.
Reversing this requires moving the origination instrument upstream of platform collection. It requires the data subject to possess, before any collection event, a cryptographic identity that can claim authorship of what their sensors and behaviors produce. This is what DID-based identity infrastructure provides when properly architected.
The W3C DID Core specification published in 2022 establishes a method-agnostic framework for decentralized identifiers that are controlled by their subject, not by a registrar. Combined with the Verifiable Credentials Data Model, a data subject can produce a signed, verifiable claim about a piece of data that precedes any platform's processing record. That signed claim is the origination instrument.
This is the foundational insight that separates PDAOS from every prior framework: ownership must be established at the moment of signal generation, not retrieved afterward through legal process or technical request.
Cryptographic Architecture of a Sovereign Data Asset
A sovereign data asset in the PDAOS model has the following minimum technical structure:
- Subject DID: A W3C-compliant DID controlled by the data subject, resolvable against a public or consortium DID registry, carrying the subject's public key.
- Data asset descriptor: A JSON-LD document identifying the data type, collection timestamp, collection context and intended processing scope, signed with the subject's private key.
- Consent receipt: A Kantara-compliant consent record, also signed by the subject, specifying the processing purpose, the processor identity and the revocation endpoint. This receipt is not stored by the platform. It is issued by the subject to the platform.
- Revocation entry: A record in a DID-linked status list (conforming to the W3C Verifiable Credential Status List specification) that the subject can flip to invalidate the processing authorization without platform cooperation.
For sensitive data classes, an additional zero-knowledge proof layer can allow a subject to prove properties of their data to a processor without revealing the underlying data. The IETF working group on Privacy Pass (RFC 9576) and the BBS+ signature scheme, under active standardization as of 2026, provide the cryptographic primitives for selective disclosure and predicate proofs in this context.
Federated learning architectures can ingest PDAOS-structured data at the model training layer without centralizing raw records. The combination of PDAOS origination structure with local differential privacy mechanisms, where noise is added at the subject's device before any data leaves, gives processors meaningful model utility while preserving origination integrity.
PDAOS in Practice: From Philosophy to Implementation
The philosophical argument for data sovereignty appears throughout Dr. Patrick Fisher's exploration in The Invisible Data, Volume 6 of The Invisible Series. The technical implementation question is where most frameworks stall. PDAOS does not stall there because it is designed as an infrastructure specification, not a policy recommendation.
For engineers building systems that need to integrate PDAOS-compatible data ingestion, the practical requirements are:
- Accept DID-signed data descriptors as the authorization instrument, replacing or augmenting OAuth-based access grants.
- Record consent receipts issued by subjects in append-only logs that can be audited by the subject at any time.
- Build revocation checking into every downstream processing call, not just at initial data ingestion.
- Separate the origination record from the processing record so that platform infrastructure changes do not corrupt the provenance chain.
For policy practitioners, PDAOS provides a technical grounding for legislation that goes beyond access rights. A regulator that mandates PDAOS-compatible origination instruments at the point of data collection is creating conditions for genuine data ownership, not just downstream procedural rights.
The NIST Privacy Framework, in its Govern and Control function categories, already anticipates infrastructure-level controls over data origination. PDAOS operationalizes those control categories with cryptographic specificity that compliance checklists cannot.
The data sovereignty question is not going to be resolved by litigation or by platform goodwill. It requires an infrastructure layer that makes origination control a technical fact rather than a legal aspiration. That is what PDAOS builds. The architecture is not complete, the standards are still maturing, and the implementation ecosystem is early. But the foundational logic is sound: you cannot own what you did not originate, and origination must be established cryptographically before collection, not retrieved procedurally after the fact.