Controlling Dataflows with a Bolt-on Data Escrow

In today's data-driven economy, individuals share their data with platforms in exchange for services such as search, social networks, and health recommendations, platforms use the data to provide those services and create other revenue-generating opportunities, e.g., selling the data to data brokers, all of which generate tremendous value. With the ever-expanding data economy comes the growing concern about potential data misuse. While most platforms give individuals specific control over their data (i.e., what data is being shared), individuals cannot limit the purposes of sharing their data since they cannot control how their data is used once it is shared. In this paper, we introduce a data management solution to this socio-technical problem. We present a data escrow design that permits individuals to observe all dataflows -- not just what data is shared but also for what purpose it will be used. Rather than having individuals' data flowing to the platform, the platform delegates their computation to the escrow, where individuals can observe and manage their data. We propose a minimally invasive programming interface to enable the escrow's delegated computation model; developers specify dataflows via the interface and the escrow runs the computation based on developers' specifications. In addition to proposing the escrow design, which is general and applies to different ecosystems such as web browsers, wearables, and mobile platforms, we also contribute a concrete escrow implementation in the Apple ecosystem. In our evaluation, we analyze the dataflows in real-world applications and show that the escrow's programming interface supports implementing a wide range of dataflows, and thus applications. We show that our escrow-based solution is a feasible and practical alternative to today's data governance and has minimum overhead.