Skip to content

2.5 Data Agency and Digital Rights

Jump to bottom
javieraatenas-pixel edited this page Jun 15, 2026 · 2 revisions

Note: Content in this section is adapted from: Atenas, J. (2021). Data agency and sovereignty. In Understanding data: Praxis and politics. HDI - Data, Praxis and Politics.
https://doi.org/10.5281/zenodo.5137402 ``

Introduction

Data agency refers to the capacity of individuals to influence and shape their life trajectories within their cultural and social contexts, particularly in relation to the generation, use and governance of data. In digital environments, agency entails the ability to make informed decisions where personal terms and conditions can be recognised and enacted at an algorithmic level.

The expansion of data-driven systems has introduced complex dynamics of power, often referred to as dataveillance, whereby individuals’ actions are tracked, analysed and monetised. These developments necessitate critical reflection on how individuals—especially those from vulnerable or marginalised groups—can exercise meaningful agency within data ecosystems.

The IEEE highlights that individuals cannot realistically monitor or respond to the many algorithms shaping their behaviour without supportive technologies and policies. People often give consent without fully understanding how their data is used, and they lack the capacity to grasp how personalised algorithms influence their decisions, potentially limiting their autonomy.

However, agency is unevenly distributed. Vulnerable and less powerful groups often lack the tools and knowledge to challenge unfair data practices, reinforcing existing inequalities. As a result, students need to understand how data systems concentrate power in some hands while marginalising others, and how this imbalance shapes participation and opportunity in society.

Conceptual Foundations of Data Agency

Data agency is intrinsically linked to questions of power and inequality. Contemporary data practices frequently concentrate power in institutions and corporations that are able to aggregate and interpret data at scale. This asymmetry can limit individuals’ capacity to understand or challenge how their data is used. Key challenges include:

  • Limited understanding of terms and conditions
  • Inability to interpret algorithmic decision-making processes
  • Unequal distribution of technological capabilities
  • Risks arising from aggregated and inferred data insights

Personal data agency is central to understanding how power operates in datafied societies. Kennedy, Poell and van Dijck (2015) argue that agency is fundamental when examining the distribution of power in data ecosystems. However, discussions of agency are often overshadowed by dominant techno-commercial practices such as data mining and, more critically, what Zuboff (2019) describes as “behavioural futures markets”—systems where predictive data about individuals is commodified and traded.

In this context, individuals frequently lack visibility and control over how their data is used. Data-driven systems construct detailed “portraits” of users, which can be leveraged in automated decision-making processes. This dynamic can lead to what is known as the principal–agent problem, where entities (agents) make decisions on behalf of individuals in ways that may not align with their interests, further limiting autonomy.

To address this imbalance, the IEEE emphasises the need for policies and infrastructures that actively strengthen individual data agency. This involves enabling people not only to understand how their data is used, but also to actively shape those processes.

Dimensions of Personal Data Agency

The IEEE framework identifies three core dimensions for strengthening individual data agency:

  • Create: Individuals should be able to define and establish their own terms and conditions regarding personal data. These terms should be machine-readable, allowing them to be recognised and enforced across digital systems

  • Curate: Individuals should have access to personal data or algorithmic agents. These tools can represent their preferences and conditions across digital, physical, and virtual environments

  • Control: Individuals should be able to manage the exchange of their data. This includes creating trusted digital identities and ensuring that data sharing is safe, limited, and purposefulthe principal–agent problem, in which decisions are made on behalf of individuals without their informed consent.

Data Agency in Practice

flowchart TD
    A[Individual Generates Data] --> B[Data Collection by Organisations]
    B --> C[Processing and Aggregation]
    C --> D[Algorithmic Decision-Making]
    D --> E[Impact on Individual Choices]
    E --> F{Agency Enabled?}
    F -->|Yes| G[Informed Decision-Making]
    F -->|No| H[Reduced Autonomy and Potential Bias]

    style A fill:#FADADD,color:#000
    style B fill:#E3F2FD,color:#000
    style C fill:#E8F5E9,color:#000
    style D fill:#FFF3E0,color:#000
    style E fill:#F3E5F5,color:#000
    style F fill:#FFECB3,color:#000
    style G fill:#C8E6C9,color:#000
    style H fill:#FFCDD2,color:#000
Loading

Contestability and Oversight

A key principle in ethical AI systems is contestability, which ensures that individuals can challenge decisions when systems significantly affect them. Effective contestability requires:

  • Transparency in data use and algorithmic processes
  • Accessible mechanisms for appeal
  • Human oversight in high-stakes decisions

This aligns with European guidelines on trustworthy AI, which emphasise human autonomy, fairness and democratic accountability.

flowchart TD
    A[AI System Generates Output] --> B[User Receives Decision]
    B --> C{Significant Impact?}
    C -->|Yes| D[Access to Explanation]
    D --> E[Challenge or Appeal]
    E --> F[Human Oversight Review]
    F --> G[Decision Confirmed or Revised]
    C -->|No| H[No Formal Challenge Process]

    style A fill:#E1F5FE,color:#000
    style B fill:#FCE4EC,color:#000
    style C fill:#FFF9C4,color:#000
    style D fill:#E8F5E9,color:#000
    style E fill:#F3E5F5,color:#000
    style F fill:#E0F7FA,color:#000
    style G fill:#DCEDC8,color:#000
    style H fill:#FFEBEE,color:#000
Loading

Data Agency and GDPR Rights

Understanding legal rights is essential for exercising data agency. The General Data Protection Regulation (GDPR), as interpreted by the Information Commissioner's Office (ICO), establishes key rights: Core Rights

  • Right to be informed: Individuals must receive clear, accessible information about data use.
  • Right of access: Individuals can obtain and review their personal data.
  • Right to rectification: Incorrect or incomplete data can be corrected.
  • Right to object: Individuals can oppose certain forms of data processing.
  • Right to data portability: Personal data can be transferred between providers.
  • Right to erasure: Data can be deleted under specific conditions.

These rights underpin the legal and ethical framework necessary to support individual agency in digital contexts.

flowchart TD
    A[Individual Identifies Concern] --> B[Determine Applicable Right]
    B --> C[Submit Request to Data Controller]
    C --> D[Controller Processes Request]
    D --> E{Request Accepted?}
    E -->|Yes| F[Action Implemented]
    E -->|No| G[Challenge or Escalate]
    G --> H[Regulatory Authority Review]

    style A fill:#F1F8E9,color:#000
    style B fill:#E3F2FD,color:#000
    style C fill:#FCE4EC,color:#000
    style D fill:#FFF3E0,color:#000
    style E fill:#EDE7F6,color:#000
    style F fill:#C8E6C9,color:#000
    style G fill:#FFCDD2,color:#000
    style H fill:#BBDEFB,color:#000
Loading

Key Readings

Matthews, P. (2016). Data literacy conceptions, community capabilities. The Journal of Community Informatics, 12(3).
https://openjournals.uwaterloo.ca/index.php/JoCI/article/view/3277/4300

Kennedy, H., Poell, T., & van Dijck, J. (2015). Data and agency.
https://journals.sagepub.com/doi/pdf/10.1177/2053951715621569

Clone this wiki locally