Data Governance

Consent was designed to authorise a specific use of specific information by a specific party. It is now the legal foundation for something else entirely: inferences that did not exist when a person agreed, drawn from data they did not know had been collected, about statistical populations they were assigned to by models they cannot see, for as long as the inference remains commercially useful.

Three failures follow, and none of them can be fixed by improving the consent interface. Obligations attach to collection while value is created by derivation, so a system that collects nothing and infers everything is comfortably positioned under most current law. An inference about a category affects every person in it, including those who never interacted with the system — no individual can consent on their behalf and no individual can refuse for them. And consent presupposes a real alternative, which does not exist where a service has become a condition of employment, education or civic participation. Declining is not among the options being offered, and the click that records agreement records only that.

We work on governance that does not rest on the fiction of individual agreement. Purpose limitation with genuine force rather than as a recital. Obligations that attach to inference and derivation rather than only to collection and storage. Recognition of collective and group interests that individual consent structurally cannot represent. Accountability placed on the party deriving value rather than the party holding the record. And categories of inference that are simply not permitted, consent or no consent — because some conclusions about people should not be drawn regardless of who has agreed to what.