Who should own the data? The impact of data value creation on data ownership

With the popularization and application of the Industrial Internet of Things, equipment manufacturers as upstream enterprises can collect in real time the operational data of their downstream enterprise customers' devices. As the notion of "data as an asset" gains acceptance, enterprises increasingly value the data value chain. In the current market mechanism, ownership of data is not clear, which hinders the creation of data value. This study establishes a theoretical analytical model that considers the influences of the benefits and losses derived from value co-creation on claiming data ownership. Benefits obtained by upstream and downstream enterprises through data and losses incurred owing to data breaches are distinct, which impact their investments in data security and data authorization. Results reveal that investments in data security by upstream businesses are affected by benefits and losses and also correlated with data ownership. Conversely, if the downstream enterprise owns the data, its expected benefits can inversely affect the upstream's data security investment—increasing the downstream's benefits can lead to reduced security investment by the upstream, even though other factors may encourage the upstream to invest more in data security. The impact of who owns the data on the security investments of both upstream and downstream enterprises becomes less pronounced when the expected benefits or potential losses for one side grow. Lastly, the current study provides guiding principles for upstream businesses to claim data ownership, thereby facilitating the exploration and utilization of data value co-creation opportunities for upstream and downstream businesses.