Reclaiming Personal Data: How One ID Can Make Enabling Data Ownership a Competitive Advantage

Photo by Global Residence Index on Unsplash

Personal data has been treated like free oil for the last 20 years. Credit where credit is due: Clive Humby, famous data scientist, mathematician, and entrpreneur said “data is the new oil” back in 2006. He read the Texas-tea leaves well.

Companies pump data out of us, refine it in their own datacenters, and then use it to power their products and business models. And we are left not quite sure how or if our data has been used. We are left in the dark.

But we have hit the limits of that paradigm. Regulations are tightening, more frequent and severe data breaches keep hitting the headlines, and people are getting (rightly) fed up with systems that say “you’re in control” while burying the real story behind walls of legalese and below-par technical transparency.

The not-so-secret truth that Big Tech doesn’t want to tell you is that without your digital engagement and the data it creates, their businesses would crumble. But that veil is being lifted. What more and more people are realising is that we need a better way to manage personal data. But we cannot do it alone, especially with the juggernaut of tech marching forward and juicing the world economy with AI. These companies would be silly to cut off their precious supply of free data and sacrifice profit. There must be some way that profit motive can be turned toward putting personal data control and ownership back in the hands of the people that create the data.

A possible enabler is the One ID standard. Born from the International Air Transport Association (IATA) vision of a frictionless air passenger journey, One ID represents a framework for the airline industry to improve operations and customer experience. It offers not just a smoother way to get through an airport. It serves as a mechanism that helps answer a much larger and crucial question: can large-scale digital systems actually strengthen personal data ownership across industries instead of eroding it?

What “personal data ownership” really means

Let’s start by burying this myth: You don’t get real data ownership just because there’s a “Manage my data” link in your profile page. The data being collected about you, in aggregate, from all around the different websites, mobile apps, companies, government agencies, and other parties we engage with every second all constitute what I call your “digital self”. If one were to, without limit, access, collect, and see all your data residing in digital systems everywhere you would have a very full and detailed picture of who you are.

Why does this matter? Simply put, without real personal data ownership, you will never be truly in control of your digital self.

With this digital self in mind, your personal data ownership should mean at least four things:

1. Visibility: You can actually see your data and how it is being used. No mystery, no guesswork, no need to file a formal request just to find out who touched and used your data.
2. Location control: You decide where your data lives. Not “we’ll store this forever on our servers and maybe in a few backups we forgot about.” Your data could live on your own device, servers you’ve chosen, or severs chosen for you. In all cases, you know where it is and can decide to move or remove it without starting from scratch.
3. Access control: You decide who can use your data, for what purpose, and for how long. You’re not limited to “we reserve the right to share this with trusted partners.” Moreso: “This company can use X for check-in only.” or “Access to X data expires automatically next month.”
4. Reversibility: You can change your mind about the data. You can turn sharing off, delete your data, or revoke credentials.

And you can do this without hammering a support inbox or waiting 30 days for “processing.”

That’s the bar. Most companies today aren’t close. We deserve better. So why One ID?

Why One ID is more than “fancy airport biometrics”

On the surface, One ID looks like a convenience play. Use your face (or another biometric) as your boarding pass, glide through the airport, no digging for documents or juggling apps along with bags and other travel-related encumberments. No doubt that convenience is a key benefit.

But under the hood, if it’s done right, One ID is something much bigger:

• A reusable digital identity that you control
• A way to prove things about yourself (who you are, your travel entitlement, your age) without handing over a full dossier every single time
• An architecture that can move us from “company profiles about you” to credentials held by you

The key phrase there is “if it’s done right.”

If One ID is just another giant central database of faces and passports, it’s a privacy disaster waiting to happen. If it’s built around user-held credentials, on-device biometrics, and tight governance, it’s a powerful enabler of personal data ownership.

Same technology stack. Completely different outcome.

The core shift: From profiles to user-held credentials

Right now, almost every company you deal with tries to build its own profile about you:

• Airlines have a version of you
• Hotels have a version of you
• Banks, telcos, retailers all have their own slices of you

None of them really agree, and none of them are fully under your control.

One ID points in a different direction. Instead of everyone storing their own version of you, you hold a set of verifiable credentials. Those credentials might include:

• Your identity document details
• Proof you’ve been KYC’d
• Proof you’re allowed to travel on a given route

When a company needs to check something, they ask for a specific proof, you decide whether to present it, and they don’t necessarily keep the raw personal data.

It’s closer to how physical documents already work where you show your passport, security looks, verifies, and hands it back. They don’t photocopy every page “just in case” (or at least, they shouldn’t).

Digitally, One ID can push systems back toward that verification-not-collection model. You hold your identity artifact, and companies or other parties temporarily verify what they need.

On-device biometrics: The difference between “creepy” and “comfortably secure”

Biometrics are emotionally loaded, and for good reason. A face template or fingerprint, once leaked or stolen, isn’t something you can change like a password. It stays out in the open and you cannot grab it back. So the architecture matters a lot. And security is critical. Companies are in an unsustainable security spiral today with the data-hoarding approach used today. Capturing and storing personal data, especially biometric data, exposes companies to tons of risk.

Why not take a more data ownership–friendly approach that flips the script. Rather than store all that personal data why not support an approach where:

• A customer biometric template is stored on their own device or in a secure personal wallet
• When that customer approaches a gate, the system asks their device: “Does this live capture match the template you hold?”
• The response is basically “yes/no,” not “here’s their entire biometric file.”

For companies, this is huge! Not only do they still get the operational benefit of fast, secure verification, but they also avoid sitting on a massive, irresistible data trove that is a security breach target. They can honestly say, “We don’t have your biometric… we just verify it.”

And for the rest of us, it’s the difference between “I feel tracked and exposed” and “I’m using my biometric as my key, not their data.”

Why companies should lean in, not resist

It’s easy to see data ownership as something companies “have to” do because of regulators. That’s short-sighted. A One ID-based, user-owned model gives companies some big advantages:

1. Trust that actually moves numbers: If users can see, control, and revoke data, they’re more likely to more thoughtfully say “yes” to sharing when there’s real value. Quality not quantity, right? That translates into higher opt-in rates for personalization that genuinely helps customers and stronger brand loyalty in markets where people feel burned by surveillance capitalism. Brand attributes like “people-first”, “freedom” and “be yourself” get proven through action and begin to have real customer resonance.
2. Risk reduction by design: Storing less sensitive data and storing it in the right place reduces risk. The cyber-target on a company’s back becomes smaller. And a security event or breach has a shrinking blast radius. Don’t forget reduction in incident response cost, and regulatory fine exposure. One ID-style architectures are basically data minimization and purpose limitation turned into system design.
3. Better signal, less noise: When sharing is intentional rather than automatic, you often get cleaner, more accurate data. People are more likely to share truthful information when they know what it’s for, can revoke it, and believe you’re not going to quietly, secretly expand its use over time.

In other words: stronger personal data ownership can be good business, not just good ethics. Think of the brand loyalty and brand strength that this trust creates. This goes way beyond just travel credentials.

The big idea is simple

One ID can be implemented as yet another way to capture and control people’s personal data. Or it can be the moment we pivot to a model where people finally, meaningfully, own it. The benefits are clear to both people and companies.

Which way this goes is going to depend less on the standards, and more on the principles companies stand for and the choices they make from here.

If you enjoyed this article, please follow me on Medium or sign up for my email list to read more about today’s technology impacts, the history of the future, and other twists on reality to help understand how we can move more mindfully and positively in our world.

**This story is brought to you by Michaelangelo Velasco — Principal Innovation Evangelist — Member of the AI @ Pace Collective **Contact the TCS Pace London Team or Michaelangelo on LinkedIn.