Data Rights Associations

It is not a new idea

DRAs follow the same template. They create new rights corresponding to vital social interests, and aggregate the bargaining authority of their members. They relieve individual members—data subjects and content providers—of the impossible task of digesting, comprehending, and negotiating terms across the many digital services that now mediate modern life, but instead allow them to choose a suitable and accountable representative to do so.

The framework is explicit that this is a familiar move in American law rather than an invention, which is much of its argument for feasibility.

DRAs would not amount to a new one-to-many regulatory scheme, but rather a restoration of the digital economy to something more closely resembling a genuine market, in which the people who co-produce the data that powers digital products have a meaningful say in what they give away and what they receive in return.

Who may join one

Membership is deliberately bounded. DRAs exist to correct an asymmetry, so they are open to the small side of it — collectively, the paper calls these members data principals.

A person may belong to several. Once DRAs have been formed, data principals simply join or associate with one or several (non-conflicting) DRAs by opting in. DRAs would then act as associational data rights fiduciaries, by negotiating concessions for members as a block, and holding data counterparties accountable for abiding by the established terms. They would allow communities to influence how data counterparties interface with community members; and secure for them a fair share of the value (whether revenue, profit, or equity) they help generate downstream.

How it gets chartered

Formation and governance. Like community banks or credit unions, data principals or other entities wishing to form DRAs would require a certification or charter from a regulator to operate. Federal ADRACA legislation could delegate authority to the Federal Communications Commission (FCC) or Federal Trade Commission (FTC) to certify and oversee DRAs, while state ADRACAs might delegate that responsibility to a state consumer protection authority or create a standalone DRA commission. To be certified, a DRA would need to demonstrate to the regulator that it will:

To be certified, a DRA has to show a regulator that it will:

1. 01Serve the public interest as determined by factors similar to those currently applied by the FCC in allocating broadcast licenses.
2. 02Serve the privacy, control, and fair value interests of one or more specific classes of data principals with respect to one or more data counterparties.
3. 03Possess the technical competence and capacity–whether directly, in coordination with other DRAs, or via contracted third parties–to propose and secure favorable terms from data counterparties and hold them accountable through independent verification and legal mechanisms.
4. 04Ensure a members-only ownership and governance structure that aligns DRA activities with the interests of the public and its members (data principals) and protects against any conflicts of interest and foreign or non-member control.
5. 05Abide by common standards for verifying the eligibility of individuals and groups to act as data principals; formulating and proposing data terms; adjudicating conflicts with other DRAs; bargaining with data counterparties; joining permission-granting coalitions with other DRAs; invoking neutral arbitration if necessary to secure fair terms; and utilizing appropriate legal mechanisms to enforce data policies.
6. 06Remain financially solvent, whether from membership fees, donations, or other revenue sources.

In addition to the natural competition of DRAs vying for members by offering fair data terms and benefits, regulators would also retain authority to revoke a DRA’s license to operate should it breach its fiduciary duty to members, engage in unfair or deceptive practices, or otherwise violate the terms of its certification or charter. For example, DRAs could be required to undergo regular audits and demonstrate member satisfaction, sustain growing and engaged membership, and register a low number of complaints submitted to regulators by membership. To ease compliance burdens and ensure flexibility, once a regulator certifies a DRA, ongoing audits and oversight could be undertaken by third parties authorized by the regulator.

What it may bargain for

A certified DRA holds nine specific rights against the companies it negotiates with — the paper calls them data counterparties.

1. 01The right to restrict data counterparties from monetizing, transferring, selling, or making member data or content available to the public or to third parties, or from using member data or content in its products, including AI models, without DRA-negotiated permissions in place.
2. 02The right to be informed of all services and products that implicate data principals through a standardized, easily accessible registry or disclosure mechanism, and to obtain detailed information about data and content collection, use, transfer, sale, or monetization from current or prospective data counterparties.
3. 03The right to bargain with data counterparties for terms that advance the privacy, control, and fair value interests of members.
4. 04The right to impartial adjudication to secure fair terms from a data counterparty if the entity acts in bad faith or rejects reasonable terms that would advance a significant privacy, control, or fair value interest of data principals and the American public.
5. 05The right to form temporary or permanent joint partnerships with other DRAs or entities so long as such combinations do not constitute monopolistic or anticompetitive conduct, and overall, advance the privacy, control, and economic interests of data principals.
6. 06The right for DRAs to obtain injunctive relief and damages from other DRAs whose grants of permission or other actions enable unreasonable impairments of their members’ associational data rights, as resolved by a court or arbitrator—incentivizing DRAs to act through coalitions and to negotiate terms likely to be acceptable to all interested persons and DRAs, not only their own members.
7. 07The right to require data counterparties to submit to independent verification mechanisms and to disclose information necessary to ensure adherence to binding terms.
8. 08The right to good faith in bargaining from data counterparties, including non-circumvention of bargaining processes and non-discrimination against DRAs or their members.
9. 09The right to effective and timely legal remedies if a data counterparty is in breach of binding terms.

How it pays for itself

A DRA that depends on the companies it bargains against is not worth joining, so independence is the one constraint the statute imposes here.

While DRAs would require some source of funding to commence and sustain their activities, ADRACA would largely remain agnostic on how DRAs resource themselves so long as funding does not compromise their independence from data counterparties. There are several possibilities for DRAs to acquire sustainable funding. DRAs might, for example, charge nominal service fees to members, much like a financial advisor, or exact fees from data counterparties in exchange for facilitating data terms on behalf of members. Such fees could be fixed by law to prevent data counterparties from paying kickbacks to secure sweetheart deals from DRAs.