The conclusion after I read this post is that the user is the owner who has the power over their own data, not a centralized third party.