Revisiting personal data : Ownership theories and comparative legal perspectives from Europe, Indonesia and the United States

The growing importance of personal data in the digital era has sparked global debates on whether it should be treated as property or a fundamental right. Different jurisdictions adopt varying approaches to personal data ownership, resulting in significant legal, regulatory and operational challenges. The US, through the California Consumer Privacy Act (CCPA), treats personal data as a tradable asset, allowing businesses to monetise it with limited consumer rights. In contrast, the European Union (EU) General Data Protect Regulation (GDPR) frames personal data as an inalienable right, prioritising individual control and privacy. Indonesia’s Personal Data Protection Law (PDP Law) takes a hybrid approach, recognising personal data as a fundamental right while permitting regulated cross-border transfers. This study employs a qualitative and comparative legal analysis to examine the implications of these differing approaches. It explores property ownership theories, such as first occupancy, labour, utility, libertarian and personality theories, to assess their applicability to personal data. The findings suggest that traditional property concepts are insufficient to address the complexities of personal data, as it is inherently tied to individual identity and autonomy. Instead of being commodified, personal data requires robust legal protections to safeguard privacy and individual rights. The study highlights key challenges, including regulatory fragmentation, compliance complexities and consumer protection disparities. It underscores the need for greater harmonisation of data protection laws and stronger international cooperation to balance economic interests with the fundamental right to privacy. The insights provided aim to inform policy makers, businesses and legal practitioners in developing ethical and effective data governance frameworks.