What feeds the twin? Whose data is it?

In this series, I keep working with the same loop: notice, decide, respond. The digital twin is trying to perfect the “notice” step of that loop.

So what feeds “notice”?

Suppose we feed our twin with OpenStreetMap, the world’s largest volunteer map. People contribute under a pseudonym, yet in 2018 the foundation that runs the map wrote, itself, that the fields attached to those contributions — username, user ID, changeset ID — can identify a person like a fingerprint.²

On the server where OpenStreetMap data is most widely shared, these personal fields are stripped from the contributors’ data;¹ but copies that still contain them can be downloaded from other mirrors, with every field intact, without anyone being asked.¹ So what protects the mapmaker is not the data itself but which door you took it from. The same contribution is erased in one mirror and left untouched in another — and nobody asks the mapmaker about it.

When we build a twin, we ask, “Where will we get this data?”; “Whose data is this?” is, most of the time, never asked.

The twin’s data comes by three routes

Spatial data forms the twin’s skeleton (building scans, cadastre, street photographs, and so on); but the data that brings it to life comes from people. Rob Kitchin divides these sources into three: data that institutions deliberately collect (cameras, passport control, and so on); data that devices produce on their own (phone signals, sensors, card taps, payment records, and so on); and data that people give as a gift (social media, OpenStreetMap, and so on).³

All three differ in who owns them and in what they cost a person: one is taken with permission, one is a by-product of living, one is given as a gift. Even the gift is troublesome: some of those who supply the map’s base data do not want their personal data shared (yet in some copies of the map it is shared without control); others want their name to appear, but some copies remove it.¹

“We anonymized it” is not a button

After preparing this essay, I can no longer say “don’t worry, we’ve made it anonymous” with much ease.

One study⁴ used the name-stripped phone records of 1.5 million people and showed that, from data on which base station they connected to at just four different times, a person can be singled out with 95% probability — and from two different times, with more than 50% probability. The same team showed that fifteen ordinary details — age, sex, postcode — are enough to pick out US citizens one by one.⁵ The law says the same thing: data whose name has been removed and replaced with a code is still personal data.⁶

I am not saying anonymization does not work; I am only saying it is not a magic button.

The UK’s public statisticians reason the same way: hiding identities before data is published does not bring the risk to zero; it brings it below an acceptable limit. So this is risk management, not a firm promise.⁷

In fact, the claim “we anonymized it” also works like a legal key: if the data is anonymous, the protection principles do not apply,⁶ and no one needs to be asked. What we take for a shield is, much of the time, the right not to ask the data’s owner.

Where it works and where it does not

Let me be fair here: anonymous data really does work sometimes, and its strongest evidence comes from disaster. But the same field has another side.

After the 2010 earthquake in Haiti, the number of people who had left the capital was estimated from 1.9 million anonymized SIM records; the estimate matched a large United Nations survey carried out later; a cholera-outbreak report was produced twelve hours after the data arrived; the data was anonymized before it reached the analysts, and the study had passed an ethics board.⁸ In Nepal in 2015, the system running the same approach was stood up within nine days of the quake;⁹ these are measured results. In a disaster, being able to make such estimates from anonymous data matters greatly for planning and for protecting human life.

But we have to see the other side of the coin too: in a disaster, the biometric data of people who need help is collected and shared without their consent.

Can people, in such hard straits, say no to an aid organization’s demand for their personal data to reach help — assuming they are even asked? In 2018, Bangladesh shared the registration data of Rohingya refugees (which includes biometric data) with the government of Myanmar they had fled, in order to send them back; the registration had been done by the United Nations’ refugee agency, and Human Rights Watch writes that people were not told what would happen to their data.¹⁰

Aid organizations have several reasons for taking biometric data (fingerprint, face, or iris scan); by their own account, donors want them to guard against abuse (one person collecting two tents, and the like). Yet it is not clear what will be done with this data, and people have to live a whole lifetime with the biometric identifiers they gave.

There is more: aid workers in the field speak of their discomfort at the amount of data they are obliged to collect and share; they say they were told, in plain terms, that refusing to collect and share it would cost them their funding.¹⁰

Anonymous data saved lives; but biometric data was taken from people in dire straits, without their consent, as the price of reaching help.

It is as if, for every piece of data, rather than stamping an intention onto it after it is collected, we need to keep its true owner constantly in mind; to make what is meant to be done with the data — the intention — clear to everyone; and to take every possible measure against its use outside that intention. Isn’t that so?

Is the answer a kind of order?

The answer to “Whose data is this?” is, as far as I can see, an order of authority; I find it in the four examples below.

Barcelona treated data as a shared infrastructure, set up its own data office, and tried to write data ownership and processing rights into its public-procurement contracts.¹¹

In Toronto, on the Sidewalk project, the regulator found the proposal inadequate because there was no independent oversight of the data trusteeship.¹²

In Turkey, the Personal Data Protection Board in 2022 required a password or two-factor check for the property-query service that municipalities offered using only the national ID number;¹³ and in 2026 it brought public institutions’ publishing of documents that contain personal data within the scope of personal-data processing, saying that without a valid ground such data may not be published.¹⁴

In 2015, Dubai split data into “open” and “shared,” drawing the line between sharing and privacy.¹⁵ Under the UAE’s 2021 decree, consent can always be withdrawn; a person can object to the processing of their data and stop it — except where “the public interest requires,” even against its use in statistical work.¹⁶

The power to say no

What I have learned so far is this: the owner of data is not always the one who holds it; it is the one who can say no to its being held and processed.

There is a fine line here, of course — one I gave an example of above: by this measure, I end up not counting as owners of their own data those too helpless to say no to whoever holds it: people in the aid queue, people who cannot put their phone down.

The way out, I suspect, as in much of engineering, is for this awareness to become a natural, accepted requirement of the solutions. Just as we do not rely on a pilot remembering to check the instruments, it should be part of a checklist — what do you say?

Speaking as someone who builds these systems, I should add one thing: the systems we design also play a part in making it hard for the data’s owner to say no. When we draw up the data map, we need to make part of the requirements not only how the data will be used and with whom it will be shared, but also “with what intention it was collected, and that its owner can exercise their rights over the data whenever they wish.”

In this essay, I focused on the owner of the data; with a few questions, I examined the different kinds of data we feed the twin, and tried to understand whom that data belongs to; I came to think we must build and protect the owner’s right to say “no” as a natural behavior of the system.

Across this series, when I said “it worked,” the measure was always the same: not how many datasets sit in a portal, but what changed in a person’s life. I want the same for a data order — a good order must make a measurable difference: one person’s information must not be published without permission; and another must be able to say “no” to their data being used without fear of losing a service they need.

The next essay asks: can the twin fed by this data truly foresee what it promises?