At a housing cooperative meeting, a contractor proposed placing energy sensors in every flat. The pitch was familiar: lower heating costs, fewer emissions, and a smarter building. A dashboard projected annual savings in neat green bars. Then a resident asked what the readings might reveal when a household was away for a long medical appointment, or when someone began working nights. Would a future landlord see a pattern? Could the contractor label a flat inefficient? The presenter had no answer. The contract called the readings operational data, but it never defined who would decide what operations included.
The oil metaphor obscures that missing answer. It invites us to imagine data as a substance waiting to be drilled, refined, and sold. A meter reading or a door-access log is not like that. It comes from people inhabiting rooms, arranging care, earning a living, recovering from illness, or trying to remain private. Its commercial or administrative value exists because an institution was allowed to observe part of a relationship. Once we see that origin, ownership is no longer the only question. We also have to ask what obligations the observer has accepted.
Every record arrives with a purpose#
Someone who gives an email address for a receipt reasonably expects a receipt. A person who discloses an access requirement for an event expects a usable entrance. Those ordinary expectations are not erased because software can discover a profitable secondary use. It may be technically easy to combine attendance records, energy readings, and location signals; technical possibility is not a reason the new use deserves trust.
Someone who gives an email address for a receipt reasonably expects a receipt. A person who discloses an access requirement for an event expects a usable entrance.
An institution should be able to state its promise plainly. Why is this information requested? Which decision will it support? Who can inspect it? When will it lose relevance? The cooperative could use a short interval of energy data to find a leak in shared pipes. That purpose did not authorize it to build a household score or to offer profiles to an insurer. Calling both activities optimization hides the difference. A relationship, unlike an extractive claim, requires loyalty to the reason a person made themselves visible.
Useful systems still create unequal power#
Data can genuinely improve common services. A transit agency can notice inaccessible stops, a library can change opening hours, and a health clinic can find reminders that fail to reach patients. The point is not to reject those benefits. The point is that benefit does not cancel the imbalance between a person supplying traces and an organization holding servers, legal teams, analytic tools, and the ability to revise terms overnight.
Fairness therefore has to be assessed from the position of the person carrying the exposure. If the heating system saves money, how is that saving shared? If an unusual reading triggers an inspection, how can a resident challenge it? If the contractor is acquired, who prevents the old history from becoming part of the sale? These are economic questions as much as privacy questions. They determine whether people are partners in a service improvement or unpaid inputs into somebody else's business plan.
Reciprocity must be practical#
“We give value back” is an incomplete promise unless people can identify and test the return. In the cooperative, reciprocity might mean a shared display that identifies faults in communal equipment, clear explanations for maintenance decisions, and a verified reduction in fees when savings occur. It does not mean handing every resident an attractive app that asks them to monitor themselves while the supplier holds the most consequential information.
It also means offering routes that do not punish people for declining granular participation. A tenant sharing a home, a household with a faulty meter, or a person whose routine could reveal a safety risk should not lose heating support because they ask for a different arrangement. The service might use floor-level measurements, broader time bands, or a limited manual review. Building those choices before deployment takes work, but it prevents consent from becoming a choice between exposure and exclusion.
Observation is not inference, and inference is not judgment#
The word data often flattens important distinctions. Some information is deliberately supplied. Some is generated as a by-product of a device. Some is inferred by a model from many small signals. There are records essential to deliver a service and records merely convenient for an administrator. When these layers are treated as one thing, a contested prediction can travel through an organization as though it were a neutral fact.
For the cooperative, boiler pressure is a technical observation. A flat's heating timetable may be a sensitive domestic signal. A conclusion that a family wastes energy is a judgment shaped by assumptions about disability, occupancy, weather, and equipment. Different layers justify different rules. There may be a sound reason to retain an alert long enough to repair a pump. There is not automatically a sound reason to preserve a moral label about a household. Mapping where a signal came from and how it was transformed makes the boundary visible.
Governance must happen before harm#
A complaint mailbox is not governance. It appears after a decision has been made and usually asks the affected person to demonstrate a harm the institution may not have documented. Responsible governance gives people influence earlier. It can restrict purposes, reject unnecessary variables, and pause a new feature until its consequences are understood.
The cooperative formed a small data stewardship group with rotating residents, a maintenance representative, and independent advice. It published the questions the system was allowed to answer, reviewed supplier changes, and kept an understandable incident log. Its importance was not ceremonial. The group could suspend a proposed function, require testing with synthetic data, and insist that a technical change be explained in ordinary language. It also had duties to the residents: short public notes and ways to participate for people whose work or care schedules made meetings impossible.
Time changes what a signal can do#
A record collected to resolve a current fault can become attractive later to an insurer, a new owner, or a platform offering conditional discounts. The original relationship does not automatically authorize those futures. Retention is therefore not a housekeeping decision. It determines how much of a person's past remains available for someone else to reinterpret.
Expiry dates make that limit concrete. The cooperative agreed that detailed readings would disappear after ninety days unless a technical incident remained open. For long-term energy planning, it would retain only monthly summaries for shared areas. Anyone requesting more time had to name the decision that required it and explain why a less detailed record would not work. That reverses an unhealthy presumption. Residents should not have to prove that their lives deserve not to be archived; the institution should have to prove why continued retention is necessary.
Repair has to reach the decision#
Opting out for the future may be valuable, but it does not repair a label that has already circulated. If an algorithm wrongly marks a household as high risk, the remedy includes finding every place that label travelled, correcting decisions influenced by it, and explaining the result without forcing the household to chase separate teams. Otherwise a right to correction is simply a polite invitation to begin administrative labour.
Before activating the sensors, the cooperative rehearsed a response path. A named person would identify the source of an error; an independent reviewer would assess the impact; disputed history would be frozen; and the resident would receive a dated answer. When an error affected a maintenance priority or a fee, the adjustment would happen automatically. The exercise exposed a basic fact: repair depends on knowing which relationships relied on the information. Without a record of uses, correction has no reliable route.
The economy begins with the bargain#
Treating data as relational does not ban exchange or deny that organizations need sustainable revenue. It asks them to acknowledge the conditions of exchange. A provider may earn money, improve operations, or study patterns, but it should not quietly acquire unlimited power to decide which parts of other people's lives become legible and tradable. Efficiency can be a worthwhile outcome; dignity sets the terms under which it is pursued.
Before collecting a new signal, four questions can change a design conversation: What specific promise does the contributor receive? What new power does the organization gain? What alternative preserves access to the service? How will an error be repaired? If the answers exist only in a dense legal notice, the relationship has been poorly built. The cooperative did not eliminate disagreement, but it produced a revisable agreement. That is the practical lesson. Data is not oil because people do not live inside a well. We live inside relationships, and those relationships deserve limits, care, and an answer when something goes wrong.
