ADRACA

Five things it would do

1. 01

   Recognize that all persons hold associational rights of privacy, control, and fair value in their co-created information—rights that may be exercised only through qualified DRAs and may not be waived, licensed, or released by individual agreement

2. 02

   Provide for the formation and member-aligned governance of DRAs

3. 03

   Empower DRAs to collectively bargain and secure favorable data governance terms from digital service providers (hereafter referred to as “data counterparties”), who would be required to hold sufficient DRA-granted permissions to collect, use, or productize covered data

4. 04

   Permit DRAs to fund and sustain their operations without ceding independence from data counterparties

5. 05

   Facilitate shared technical standards and infrastructure to ensure seamless assignment of data rights as well as frictionless, competitive, and transparent mechanisms for joining DRAs and applying DRA-negotiated terms across services.

Part III — Legislation to secure associational data rights →

Where the burden sits

The obligation runs the other way from today's consent model. A company must establish that it holds permission — nobody has to discover that it does not.

A data counterparty would be required to hold sufficient DRA-granted permissions both (i) at the point of collection and (ii) at each point of use or productization of covered data, with the burden resting on the counterparty at both points to determine the affected rightsholders and to identify which qualified DRAs represent them. At the point of collection, rightsholders would be those with lawful custody of the nonpublic information being collected or conveyed. At the point of use or productization, rightsholders would include all persons whose associational rights are impaired by the use, regardless of how the information was obtained or inferred—unless the counterparty establishes that it was obtained exclusively from public sources, meaning sources available to the public free of intellectual-property or other proprietary claims. Factual inferences drawn from content on proprietary platforms governed by terms of service would not qualify as publicly sourced, and covered information commingled with publicly sourced information would remain covered.

What counts as sufficient permission

The thresholds are the load-bearing detail. Set too low and a small friendly association can clear a company to do anything; too high and nothing is ever permitted. The framework's answer is any one of three tests, measured separately at collection and at use.

Permissions would be sufficient when negotiated and granted by (i) a qualified DRA, or coalition of DRAs, representing at least half of the affected rightsholders; (ii) any two of the three largest qualified DRAs representing affected rightsholders; or (iii) any three of the five largest such DRAs—with affected rightsholders identified separately at the points of collection and use. Collection or productization without sufficient permissions would give rise to civil liability, through causes of action held by DRAs, sufficient to punish and deter noncompliance.

These are not absolute vetoes. The paper is careful that the extent of a valid interest is calibrated, not fixed:

These rights would be conditional rather than absolute—rights to have privacy, control, and fair value interests vindicated, to the extent reasonable, through associations. The extent of valid interests in particular information would be informed by: (i) whether the information is obtainable from few or many sources; (ii) how large a role it plays in the downstream product; (iii) how severely the use impacts the interests of the persons and communities concerned; and (iv) how necessary it is to the generation of significant value. These factors would calibrate remedies and expectations upon data counterparties; they would not narrow coverage.

Why it cannot be signed away

An associational right that a terms-of-service update could waive would be worth nothing by the second week. So the statute makes waiver void — the same construction that keeps a single employment contract from cancelling a right to organise.

Because these interests are contextually dependent and often need to be balanced against one another, the exact extent and requirements of the three pillars of associational data rights resist strict codification. The terms a DRA will secure are generally not rules or hard entitlements that statute could fix in advance but instead reflect negotiated equitable arrangements: concessions and limitations that take their shape from the values and circumstances of the communities and counterparties involved. The English common law distinction between law and equity recognized that some interests are important enough to warrant protection yet too contextual to be reduced to fixed rules. The privacy, control, and fair value pillars are likewise vital interests of individuals and communities, which are being trampled under the status quo, and which warrant firm protection, yet also require flexibility and context sensitivity. Striking a sensible balance requires new associational mechanisms that enable otherwise atomized individuals to bargain as communities..