You don't care enough about your data. This is why

It’s known as the “privacy paradox”: people say they want to protect their data privacy online, but often do little to keep it safe.

Why?

We propose that it’s because people find data difficult to own – and things we don’t own, we tend not to protect. This is a question of psychological, not legal, ownership, which is more powerful in explaining why we care for things we call “mine”.

Owning data is not like owning a car. If someone used your car, rented your car to others or stole it – you’d notice. And you’d care. But our data can be used, on-sold or stolen without our permission, without us ever really being aware, or worrying too much about it.

Data points are hard for us to claim and value. We find them difficult to own because we have less control, intimate knowledge and investment in them due to data being intangible, invisible and complex.

Hard to claim

Data’s intangiblility means it’s difficult for us to claim ownership.

Unlike objects, data can be used by more than one person at a time. It is hard to know if you are the only person currently claiming the data and it is hard to exclude others from doing so. And unlike objects, repeated use doesn’t degrade or imprint data. Because data can be easily copied, nothing is physically taken away from us. We cannot even feel if data are being harvested. This undermines our ability to claim it, and prevent it from being taken.

Hard to value

Generally we own and protect only things that are valuable or meaningful. However, consumers don’t know how valuable their personal data points actually are. This is partly because what comes in high volumes tends to be deemed low in value. And with the exceptions of things like your name or birth date, data points hold little value by themselves. It is only once they are combined with other data – of the same or other people – that they accrue value. This could happen through profiling.

This masking of value is accentuated by app permissions that often request bundles of data, such as “all contacts”, rather than specific meaningful contacts, such as “your mother’s phone number”. Because consumers often assign a similar value to specific data points as to bundles of data, they don’t see the value in giving away hundreds of contacts’ details.

Hard to attribute ownership

Attribution is key in the processes of ownership. The more we see someone as the person that brought the data into being through labour, the more we attribute ownership to them.

Even for well specified information, consumers are uncertain about the extent to which data points are actually theirs. But most data are not well specified. Like any raw material, crude data points – such as your age – are inherently malleable. Without our knowing, they can be converted, combined and contrived to create valued things through another person’s labour. This makes it hard to determine whose data it actually is.

And some personal data are jointly owned. For example, online purchase data are owned by you and the retailer.

The characteristics of data also undermine the processes we need to go through in order to feel that we own things, namely: control, intimate knowledge, and self investment.

Lack of control

We find it difficult to control our data points because they are invisible, intangible, and increasingly diverse. For example, body parameters, location information, photos and contacts are all data points that come into being as a by-product of our lives. We cannot control these data points without altering the way we live.

Personal data is so complex and comes in such a massive scope, that it defies our ability to comprehend it. This is another fundamental barrier to the experience of control.

Lack of intimate knowledge

Since personal data are about us, it seems obvious that we should be knowledgeable about them. Not so. Personal data comes from many unobtrusive sources, such as connected devices, which are collected passively. Data are largely invisible and do not noisily remind us of their existence. This precludes us from having intimate knowledge of them. Worse still, over 90% of us fail to fully understand permissions designed to explain the data collection and enhance our knowledge.

Lack of self investment

Another consequence of data being a by-product of our existence is we need to invest little effort into bringing them about. For example, we produce location data regardless of whether we want to or not. Only photos may require some investment from us, but they are a small proportion of our data.

The privacy paradox exists because personal data are possessions that are hard to own and protect.

Making data easier to claim through physical downloads, as Facebook have recently moved to do, or giving data value and attributing ownership through payment for data, can give us more control, knowledge and investment.