What do we mean by “data control”?
Under privacy laws in most countries, the “controller” of data has the legal authority to determine how that fan data is used — both by the controller and by third parties.
Legal control of data is really about two things:
- Your ability to use the data
- Your control over how others use the data
If you can use fan data for your own benefit and control who else can use it for theirs, you control its value.
No! Data isn’t really IP or property, at least in the ways that matter most. Talking about data in terms of “ownership” can be okay, but it often leads to bad outcomes such as relying on IP-like contract terms that treat data as property, missing essential issues like privacy law.
We use the term “data control” to help avoid confusion and avoid implying that data is IP or property that just needs to be licensed.
If IP and property laws aren’t the most important thing in data control what is?
Fan data isn’t really IP or property but it is about people, and there is a whole category of laws that directly apply to data about people: privacy laws.
In privacy law, the company or person responsible for how personal data is used is called the “data controller.” The data controller has the most flexibility in using personal data and the most control over how others use personal data on the controller’s behalf.
How do you become a data controller? The data controller is, in almost every case, the entity or person whose privacy policy is displayed to the fan when data is collected. Today most artists don’t have their own privacy policy, so when data is collected the privacy policy is for the label, platform, or other third party.
The result? Artists don’t actually control their fan data — even when using marketing platforms or tools whose entire marketing pitch is some version of “own your data.”
Put simply,
if it’s not your privacy policy, it’s not your data.
Good question.
In the context of a specific deal at a single point in time it may not matter all that much. But artist careers are not that simple.
Data control becomes critical when things change. Change labels? Merch companies? Did your CRM startup get acquired or go out of business?
If artists don’t legally control their fan data they have limited, if any, rights to their fan data in those situations. Even if their contracts require data transfers, privacy laws and other restrictions will result in data loss. The partner may also be able to keep using the data and capturing its value for their own benefit.
The only way to ensure fan data perseveres through every career change is to have your own privacy policy and be the data controller for every possible fan interaction.
Same.
It is true that being a data controller means you control the value but are also accountable for how the data is used. That can sound scary.
In most countries legal risk related to fan data is manageable. Regulators typically focus on large-scale violators and don’t tend to fine artists, especially non-superstars.
Certain laws like the US TCPA allow individuals to sue, and are often used in ways that look a lot like extortion, so there is certainly some risk, but using industry standard data collection practices reduces these kinds of risks.
Taking a step back, artists are businesses just like any corner store, online seller, or app. Businesses of all sizes manage these risks every day. If a corner pizzeria can manage legal risk why would it be too much for an artist?
Sometimes you’ll see a platform or partner use a “joint controller” approach, supposedly as a way to frame the artist as a controller along with the platform/partner. It’s a partnership afterall, right?
Unfortunately it doesn’t work like that.
Joint controllership can be a good faith attempt to “thread the needle” between artist and partner data control or to share the value of data, but we’ve never seen it work as intended.
Joint controllership is a valid legal structure that works for some purposes, but think of it like a separate joint venture legal entity. Both parties have a share in the joint entity but neither party has free and full use of the data for their own purposes outside the joint venture. In other words, joint control does not allow artists to freely use data for their own purposes outside the joint controllership.
A joint controller approach may work for shared use during the term of a partnership but it breaks down when data is collected outside the joint controllership and if/when the partnership ends.
So unless a joint control partnership covers all data collected across an artist’s career and lasts forever it doesn’t work for fan data.
In short, joint controllership does not allow artists free and full control of their fan data across their ecosystem and throughout their career, so with very few exceptions it is not appropriate for managing fan data.