The law on machine data
Who owns sensor data? Machine-generated data in EU, UK and US law
Updated
No statute hands anyone ownership of a temperature reading. What decides who may sell sensor data is the contract with the platform, a handful of rights over collections of data, and the rules on personal data.
Ask about my sensor data 6 of the 11 IoT platforms we read say the readings belong to the business. Tell us what your devices log and where it is stored, and we will reply by email.
The contract comes first
6 of the 11 IoT platforms on our board say in their terms that the data belongs to the business, and 5 keep an aggregated or anonymised use for themselves.
Source: IoT software data terms
| Right | Where | What it covers | Source |
|---|---|---|---|
| Database right | UK | A database for fifteen years from the end of the year its making was completed | Sensor data rights law |
| Copyright | US | Never an idea, procedure, process, system or discovery, so not a raw reading on its own | Sensor data rights law |
| Trade secret | US federal statute | Confidential process data; a misappropriation claim within 3 years | Sensor data rights law |
| Trade secret | EU member states | Confidential process data; a limitation period of no more than 6 years | Sensor data rights law |
- When a reading names someone
- UK GDPR treats information as personal data when a person can be identified from it directly or indirectly, and location data is one of the named identifiers.
- Often personal
- Vehicle traces and smart meter readings.
- Rarely personal
- Vibration logs from a pump.
A US motor carrier must keep electronic logging device records for 6 months, with a back-up copy on a separate device, so licensing a copy of those logs does not mean deleting the originals.
Source: Sensor data rights law