Personal information management systems: a user-centric privacy utopia?

Abstract

Personal information management systems (PIMS) aka personal data stores (PDSs) represent an emerging class of technology that seeks to empower individuals regarding their data. Presented as an alternative to current ' centralised' data processing approaches, whereby user data is (rather opaquely) collected and processed by organisations, PDSs provide users with technical mechanisms for aggregating and managing their own data, determining when and with whom their data is shared, and the computation that may occur over that data. Though arguments for decentralisation may be appealing, there are questions regarding the extent to which PDSs actually address data processing concerns. This paper explores these questions from the perspective of PDS users. Specifically, we focus on data protection, including how PDSs relate to rights and the legal bases for processing, as well as how PDSs affect the information asymmetries and surveillance practices inherent online. We show that, despite the purported benefits of PDSs, many of the systemic issues of online/data ecosystems remain.

Embedding European values in data governance: a case for public data commons

“…This mediator (data intermediary) introduces mechanisms of trust in data governance. Instead of relying on personal discipline and consent, which in fact might be considered a "victimisation discourse" that individualises systemic problems (Janssen et al, 2020), institutional control bases on trust in the institution to represent data subjects' rights and aims. It is not our assertion that rights are unnecessary, but that for governance they are inadequate alone.…”

“…However, data ownership means little if the owned property is sold on uneven terms, in a world of growing inequalities. Indeed, "decentralising processing does not necessarily imply decentralising power" (Janssen et al, 2020). To mitigate this potential problem, proposals of countermeasures have been developed, such as Jaron Lanier's data labour unions (Arrieta-Ibarra et al, 2018), multi-client privacy administrators (Betkier, 2019), and consent champions (Ruhaak, 2020).…”

Saving the web by decentralizing data networks? A socio-technical reflection on the promise of decentralization and personal data stores

“…For small organizations, decentralization may provide new opportunities to have access to users' personal data that is gathered by other large players such as Facebook and Google. However, several authors have already argued that decentralization does not necessarily imply decentralizing power, see e.g., [40], [41]. In particular, as [40] explain, decentralized systems might comprise a distributed network of nodes, while producing highly centralised effects in terms of wealth or other resources, system information and power asymmetries.…”

Between incrementalism and revolution: How the GDPR right to data portability is revamped by the EU and the UK post Brexit

“…156 Janssen, Cobbe and Singh contend that the PIMS will not effectively deal with the 'systemic factors with structural causes that disempower users in favour of organisations'. 157 As such, this industry would eventually reach a point, as Zingales envisions, where it loses agency and the potential for economic empowerment as the incumbents start to emphasise individual control as well. 158 After the GDPR becomes effective, the regulatory aspect, in particular the GDPR acting as a potential barrier to the PDSes, has been quickly mainstreamed.…”