Our Data. Our Agents. Our Choice.
Why data sovereignty becomes more important, not less, in the age of AI.
Frank Ricciardi
Founder & Principal Advisor
For the last 20 years, we have traded control of our data for convenience.
Often, we did not fully realize we were making the trade.
We downloaded the app. Created the account. Connected the wearable. Uploaded the document. Made the purchase. Took the meeting. Sent the message. Logged the workout. Applied for the loan.
And when presented with the terms governing what would happen to the data generated by all of that activity, most of us clicked:
I agree.
Not necessarily because we agreed in any meaningful sense of the word.
We agreed because reading pages of legal terms was inconvenient. Because accepting them was a prerequisite for using the product. Because we had another task to complete. And because few of us could have anticipated just how valuable the accumulated digital representation of our lives would eventually become.
Research supports this disconnect. Pew Research Center found that 56% of Americans frequently click "agree" without reading privacy policies. Even more telling, 61% believe those policies are ineffective at explaining how companies actually use people's data.[1]
56%
of Americans frequently click “agree” to privacy policies without reading them.
61%
believe privacy policies are ineffective at explaining how companies use their data.
Legally, we may have consented.
But meaningful, informed and intentional choice is something different.
For two decades, that distinction was important.
Artificial intelligence is about to make it critical.
The architecture of convenience
SaaS and cloud computing transformed technology.
Software became easier to deploy, continuously updated and accessible from almost anywhere. Companies no longer needed to install and maintain every application locally. Consumers gained extraordinary digital services, often for little or no direct cost.
But an architecture emerged alongside that convenience.
Our applications increasingly became the custodians of our data.
Health information lives with healthcare providers, electronic health record systems, wearables and wellness applications.
Financial information lives across banks, credit cards, investment platforms, insurers and financial applications.
Our professional histories live in HR systems and professional networks.
Our purchasing behavior lives with retailers and marketplaces.
Our relationships and interests live across social networks.
Our digital identities became fragmented across hundreds of databases controlled by organizations whose applications we use.
That data has extraordinary value. It helps companies understand us, personalize experiences, target advertising, develop products, train algorithms, assess risk and influence behavior.
In many cases, we became not only the customer, but an input into the product itself.
And now AI dramatically increases the potential value of that data.
AI changes the question
Until now, the debate around personal data has largely been framed as a privacy question:
Who can see my data?
AI introduces a much larger question:
Who can use my data to understand me and act on my behalf?
An AI agent becomes considerably more valuable as its context improves.
Consider healthcare.
An AI agent that knows nothing about you can answer a general health question.
But imagine an agent that, with your permission, understands your longitudinal medical history, medications, allergies, lab results, imaging, genomics, sleep, exercise, nutrition, wearable data, family history and personal health goals.
That is no longer simply an AI answering questions.
It can begin to develop meaningful health intelligence about you.
Now consider wealth.
An agent that understands your income, spending, assets, liabilities, investments, taxes, insurance, estate plan and financial objectives can potentially develop an increasingly sophisticated understanding of your financial life.
The same logic applies almost everywhere.
The more complete the context, the more useful the intelligence.
Which creates what I believe will become one of the defining questions of the AI era:
Who controls the data that gives an intelligent agent its intelligence about you?
From data privacy to data sovereignty
Privacy is necessary, but privacy alone is not enough.
I believe we need to move toward data sovereignty.
Data sovereignty at the individual level means something fundamentally different from asking a company to protect the information it holds about us.
It means the individual has meaningful control over the data itself.
Who can access it.
What they can access.
Why they can access it.
How long they can access it.
Whether they can write to it.
Whether they can share it.
Whether an AI can learn from it.
And, critically, whether that permission can be revoked.
This is where an important architectural shift is beginning to emerge.
The inventor of the Web is trying to change the model
Sir Tim Berners-Lee invented the World Wide Web at CERN in 1989. His original objective was remarkably simple and powerful: make it easier for people to share information.[2]
The Web succeeded beyond anything that could reasonably have been imagined.
But something happened along the way.
The open information architecture of the Web increasingly gave rise to centralized platforms in which applications accumulated and controlled enormous amounts of user data.
Berners-Lee has been working on an alternative architecture called Solid.
Solid is an open protocol designed to separate applications from the data they use.
Instead of your data being permanently locked inside each application's database, Solid enables personal online data stores called Pods. Applications and AI agents can be granted secure, permissioned access to information stored externally from the application itself. The Solid Project describes the principle simply: your data remains yours even when you change providers, applications or AI agents. You decide which applications and AI systems can access your information and for what purposes.[3]
That distinction becomes enormously important in an AI world.
Today's dominant architecture is essentially:
You → Application → Application's Data
A sovereign architecture begins to look more like:
You → Your Data ← Applications and AI Agents You Authorize
The application becomes replaceable.
Your data does not.
Today: Application-Centric
Fragmented data controlled by each application.
Sovereign: Individual-Centric
Access can be granted, limited, or revoked by you. The application becomes replaceable. Your data does not.
Health may be one of the first places this really matters
Healthcare provides an obvious use case because the data is deeply personal, highly fragmented and potentially extraordinarily valuable when brought together.
One company applying this architecture is EverBetter.
EverBetter is using the Solid Protocol to build patient-centered health data infrastructure based around secure personal data wallets and vaults. Its implementation is designed to allow individuals to retain control of their health information while granting selective access to authorized providers, applications and other services.[4] Instead of creating yet another healthcare application that becomes another silo, the underlying architecture is designed around the individual.
The data can include structured clinical information, medical imaging and other health information, while using healthcare standards such as FHIR, SNOMED CT and LOINC to support interoperability.
That creates the foundation for something much more interesting than data storage.
It creates the foundation for intelligence.
HealthLab, an EverBetter partner, is using this infrastructure as part of an emerging model for delivering clinical, diagnostic and therapeutic journeys to individuals. These journeys can be made available through health plans, healthcare providers and clinics, employee benefits platforms, and other trusted channels where consumers and patients already engage with their health.
The journeys can include AI heart scans, full-body MRI, cancer screening, continuous glucose monitoring, epigenetic testing and other prevention and care experiences.[5]
HealthLab uses AI to orchestrate the journey across diagnostics, providers, logistics, results and follow-up. EverBetter provides the underlying infrastructure through which health information can be securely managed around the individual.
The combination points toward a very different healthcare architecture:
AI-orchestrated care built around trusted, sovereign health data.
Instead of assembling another fragmented record every time an individual enters a new healthcare experience, the individual can increasingly become the persistent center of the data architecture.
That is a profound shift.
Health and wealth are only the beginning
Health data makes the argument easy to understand because most people instinctively recognize its sensitivity.
Financial data is similar.
But why should sovereignty stop there?
Think about the digital information accumulated over a lifetime:
Academic transcripts. Professional credentials.
Employment history.
Tax records.
Legal documents.
Insurance policies.
Property records.
Purchase history.
Subscriptions.
Travel.
Social media activity.
Content we have created.
Books we have read.
Entertainment preferences.
Organizations we support.
Products we own.
Communications.
Relationships.
Personal preferences.
Our digital activity increasingly forms a remarkably detailed representation of who we are.
I think we will eventually stop thinking about these as separate categories of data.
We will begin thinking about them as life data.
From life data to "you intelligence"
This is where the implications become much larger. Imagine that instead of hundreds of companies each possessing fragments of your digital identity, you had a persistent, interoperable digital footprint that you controlled.
Not one giant database that every company could access.
Quite the opposite.
A secure architecture in which different categories of your life data could remain protected while you selectively granted access based on purpose.
Your healthcare agent might normally receive access to health data but not financial records. But perhaps you choose to grant it access to certain financial signals because financial stress can have meaningful effects on physical and mental health.
Your financial agent might understand your assets and tax position but know nothing about your medical history. Or perhaps you selectively allow it to understand anticipated healthcare costs because those costs are relevant to long-term financial planning.
A travel agent might temporarily receive your passport information, loyalty programs, calendar and preferences, then lose access when its task is complete.
Another agent might receive permission to work across several domains because you specifically want it to understand the interaction among them.
The point is not that different categories of life data must remain isolated.
The point is that you decide when they should intersect.
You become the permission layer.
And that is where the possibilities become particularly interesting.
Some of the greatest value of sovereign life data may come from allowing AI to identify relationships across domains that are largely siloed today.
Health and wealth.
Sleep and work.
Nutrition and purchasing behavior.
Education and career.
Location and environment.
Calendar activity and stress.
The value is not simply in having more data. It is in creating context across that data.
Life Data · Individually controlled
↓
↓
The value isn’t just the data. It’s the context created when you decide to connect it.
Over time, that collection of sovereign life data could create something extremely powerful:
"You intelligence."
A continuously evolving digital context that understands your history, preferences, relationships, behaviors, objectives and decisions because it is grounded in data you control.
That intelligence does not inherently belong to Google.
Or Apple.
Or your bank.
Or your hospital.
Or your employer.
Or whichever AI company happens to provide your preferred agent this year.
It belongs to you.
Your agent should work for you
This becomes especially important as AI moves from answering questions to taking actions. The first generation of generative AI largely waited for us to ask something.
Agents are different.
They can research, monitor, coordinate, communicate, transact and increasingly execute multi-step tasks.
For an agent to become genuinely useful, however, it needs context.
It needs to know something about the person for whom it is acting.
That creates an enormous temptation to recreate the same bargain we made during the SaaS era:
Give us all your data and we'll give you an extraordinary AI experience.
We should be very careful before making that bargain again.
The better model is not an AI company owning everything it knows about me.
The better model is my agent receiving permission to access what it needs to know about me to accomplish the task I have authorized.
Those are fundamentally different architectures.
One makes the platform more powerful.
The other makes the individual more powerful.
Sovereignty should also include economic choice
There is another dimension to this conversation that deserves attention.
Personal data has economic value.
That does not mean individuals should necessarily be paid every time their information is used. The economics, provenance and value creation around data are considerably more complicated than that.
But I believe the principle should be straightforward:
If my data has economic value, the decision about whether to exchange that value should begin with me.
I may exchange data for money.
I may exchange it for a better service. I may allow it to improve an AI model because doing so improves the product I use.
I may contribute my health information to research because I want to help find a cure for a disease.
I may donate it.
I may license it.
Or I may choose not to share it at all.
Sovereignty means these are choices.
They should not simply be defaults buried inside terms of service that almost nobody reads.
Regulation and national data architectures are beginning to move in this direction
This is not purely a technology discussion.
Governments are increasingly wrestling with questions of data access, portability, interoperability and individual control. Some are beginning to move beyond conventional privacy regulation toward different models for how data can be shared, permissioned and controlled.
India provides one of the most interesting examples.
Its Data Empowerment and Protection Architecture, or DEPA, was designed around a fundamental shift from organization-centric data sharing toward an individual-centric model. Rather than treating consent as a blanket "yes" buried inside terms and conditions, DEPA envisions consent that is granular, contextual, auditable, secure and revocable.[6]
Its premise is strikingly aligned with the broader idea of data sovereignty: individuals should have practical means to access, control and selectively share personal data held across multiple institutions.
DEPA was first applied prominently in financial services through India's Account Aggregator ecosystem, allowing individuals to authorize secure movement of financial information among participating institutions. But the underlying vision extends further. India's original DEPA framework contemplated personal information including medical records, purchasing activity, telecommunications data, education and employment information in addition to financial data.[6]
India has since established a broader legal framework for digital personal data through the Digital Personal Data Protection Act of 2023 and subsequent rules, further formalizing consent and responsibilities around the processing of personal information.[7] Switzerland is pursuing a related idea through a different model.
The Swiss government is developing a national Swiss Data Ecosystem based around trustworthy, interoperable data spaces and the principle of digital self-determination.
The language is important.
Switzerland describes digital self-determination as depending on users' ability to maintain control over their data and decide which data they share, who they share it with, for what purpose and for how long.[8]
In 2025, Switzerland published an architectural vision and reference architecture intended to provide a common framework for interoperable data spaces, including mechanisms for secure and controlled data sharing across organizations.[9]
Healthcare provides another important example.
The European Health Data Space Regulation entered into force in March 2025 and establishes a framework intended to give individuals greater access to and control over their electronic health data. As its provisions are phased into application, individuals will gain rights including access to and downloading of their health data, the ability to restrict access, request corrections, authorize others to access their data and, subject to applicable national rules, exercise choices around data sharing.[10]
These approaches are not identical.
India is developing consent-based infrastructure alongside data protection regulation.
Switzerland is advancing digital self-determination through trusted, interoperable data spaces.
The European Union is establishing individual rights and infrastructure through initiatives such as the European Health Data Space.
Solid approaches the problem through an open technical protocol.
But they point toward a common idea:
Data should increasingly move around the individual, rather than requiring the individual to surrender control of data to every organization they interact with.
India
Data Empowerment and Protection Architecture (DEPA)
- Individual-centric data sharing
- Granular consent
- Revocable consent
- Account Aggregator ecosystem
Switzerland
Swiss Data Ecosystem
- Digital self-determination
- Trusted data spaces
- Purpose-based sharing
- Time-bound access
European Union
European Health Data Space (EHDS)
- Health data access
- Portability
- Individual rights
- Controlled sharing
Different approaches. Common direction: more control moving toward the individual.
That is meaningful progress.
But regulation and architecture solve different problems.
Regulation can give an individual rights over data that organizations hold.
Sovereign architecture can make individual control an inherent characteristic of how the system works.
Ultimately, we need both.
Data sovereignty is not just about privacy
There is an even longer-term implication.
Our digital footprint will increasingly outlive individual applications and perhaps eventually outlive us.
The photos, writing, communications, health histories, professional accomplishments, financial records, relationships and ideas accumulated across a lifetime form something previous generations never possessed at this scale:
A persistent digital record of a human life.
That creates questions not only about privacy and artificial intelligence, but also about legacy.
What happens to that data when we die?
Who controls it?
What should be preserved?
What should disappear?
What can our children access? Could a future generation understand not simply what we owned, but what we thought, created, valued and experienced?
Data sovereignty ultimately means having agency over those decisions too.
From sovereignty to agency
This is why I believe data sovereignty is only the foundation.
The larger objective is data agency.
Sovereignty means I control my data.
Agency means I can do something with that control.
I can move it.
Combine it.
Protect it.
Share it.
Revoke access to it.
Allow intelligence to be created from it.
Authorize an agent to act against it.
Contribute it.
Monetize it.
Preserve it.
And eventually determine what happens to it after I am gone.
That is a fundamentally different relationship between people and technology.
We have another choice to make
More than three decades ago, the World Wide Web dramatically democratized access to information.
What followed changed humanity. But the architecture that emerged also concentrated extraordinary amounts of personal data inside applications and platforms.
For much of the last 20 years, we accepted that model because the products were useful and the convenience was compelling.
Often, we barely noticed the bargain we were making.
AI now makes that bargain much more expensive.
Because the next generation of technology will not merely store information about us.
It will use that information to understand us, make recommendations to us and increasingly act for us.
That makes control of the underlying data one of the most consequential questions of the AI era.
The future of AI should not require us to surrender more of ourselves to technology.
It should give us greater control over the digital representation of who we are.
Our data.
Our permission.
Our agents.
Our choice.
Sources & Further Reading
1. Pew Research Center. How Americans View Data Privacy. Pew's research examines Americans' understanding of and behavior around privacy policies, including the frequency with which people accept policies without reading them.
2. CERN. The Birth of the Web. CERN's history of Tim Berners-Lee's invention of the World Wide Web in 1989 and the Web's original information-sharing purpose.
3. Solid Project. About Solid. The Solid Project describes personal online data stores, or Pods, interoperability, user-controlled permissions, and the relationship between personal data, applications and AI agents.
4. EverBetter. EverBetter and Solid. EverBetter describes its use of Solid-based infrastructure for patient-controlled health information, personal data wallets and vaults, access controls and healthcare interoperability.
5. HealthLab. HealthLab's public materials describe its AI-orchestrated health journeys and preventive diagnostic offerings.
6. NITI Aayog, Government of India. Data Empowerment and Protection Architecture. India's framework describes a shift from organization-centric toward individual-centric data sharing using granular, revocable, auditable and secure consent.
7. Government of India. Digital Personal Data Protection Act and Rules. India's broader legal framework governing digital personal data and consent.
8. Swiss Confederation. Swiss Data Ecosystem Principles and Digital Self-Determination. Switzerland's framework for trustworthy data spaces emphasizes users' control over what data is shared, with whom, for what purpose and for how long.
9. Swiss Confederation. Architectural Vision and 2025 Reference Architecture for the Swiss Data Ecosystem. A common framework for developing secure, controlled and interoperable data spaces across Switzerland.
10. European Commission. European Health Data Space. The EHDS establishes rights and infrastructure intended to give individuals greater access to and control over electronic health data.
Written by
Frank Ricciardi
Founder & Principal Advisor, FARVENTURES