"Issue: What would it mean for a person to have individually controlled terms and conditions for their personal data?
## BackgroundPart of providing individually controlled terms and conditions for personal data is to help each person consider what their preferences are regarding their data versus dictating how they need to share it. While questions along these lines are framed in light of a person’s privacy, their preferences also reveal larger values for individuals. The ethical issue is whether A/IS act in accordance with these values.This process of investigating one’s values to identify these preferences is a powerful step towards regaining data agency. The point is not only that a person’s data are protected, but also that by curating these answers they become educated about how important their information is in the context of how it is shared. Most individuals also believe controlling their personal data only happens on the sites or social networks to which they belong and have no idea of the consequences of how that data may be used by others in the future. Agreeing to most standard terms and conditions on these sites largely means users consent to give up control of their personal data rather than play a meaningful role in defining and curating its downstream use.The scope of how long one should or could control the downstream use of their data can be difficult to calculate as consent-based models of personal data have trained users to release rights on any claims for use of their data which are entirely provided to the service, manufacturer, and their partners. However, models like YouTube’s Content ID provide a form of precedent for thinking about how an individual’s data could be technically protected where it is considered as an asset they could control and copyright. Here is language from YouTube’s site about the service: “Copyright owners can use a system called Content ID to easily identify and manage their content on YouTube. Videos uploaded to YouTube are scanned against a database of files that have been submitted to us by content owners.” In this sense, the question of how long or how far downstream one’s personal data should be protected takes on the same logic of how long a corporation’s intellectual property or copyrights could be protected based on initial legal terms set.One challenge is how to define use of data that can affect the individual directly, versus use of aggregated data. For example, an individual subway user’s travel card, tracking their individual movements, should be protected from uses that identify or profile that individual to make inferences about his/her likes or location generally. But data provided by a user could be included in an overall travel system’s management database, aggregated into patterns for scheduling and maintenance as long as the individual-level data are deleted. Where users have predetermined via their terms and conditions that they are willing to share their data for these travel systems, they can meaningfully articulate how to share their information.Under current business models, it is common for people to consent to the sharing of discrete data like credit card transaction data, answers to test questions, or how many steps they walk. However, once aggregated these data and the associated insights may lead to complex and sensitive conclusions being drawn about individuals. This end use of the individual’s data may not have been part of the initial sharing agreement. This is why models for terms and conditions created for user control typically alert people via onscreen or other warning methods when their predetermined preferences arenot being honored."p.108-110