Online Personal Data Licensing: Regulating Abuse of Personal Data in Cyberspace

Abstract

We propose a new technical and legal approach, called online personal data licensing (OPDL), for responding to concerns about the privacy of personal data. Unlike traditional privacy-enhancing technologies that typically aim to hide personal data, OPDL enables individuals to concretize their consent to allow others to use their personal data as licenses. Service providers must obtain licenses before legally collecting, processing, or using a person’s data. By allowing individuals to issue their own licenses and to determine the content of the licenses, OPDL brings the control of personal data back to their owner, and ensures that the use of the data is strictly under the owner’s consent. In contrast, most Web-based service providers today use passive consent, which usually results in situations in which users have inadvertently given the providers the authorization to use their personal data. Besides, users generally do not have information on who still owns a copy of their data, and how their data have been, or will be, used.