Personal Information Management Systems (‘PIMS’) provide technology-backed mechanisms for individuals to mediate, monitor and control how their data is accessed, used or shared.

Their purported goal is to empower individuals with regards to their personal data (Abiteboul et al., 2015; EDPS, 2016; IAPP, 2019; Royal Society, 2019; Janssen et al., 2020a). Given the discourse around how data is currently being extracted and used, the concept is growing in prominence in the research and commercial space (Janssen et al., 2020b), as well as gaining policy attention (European Commission, 2020).

There are growing concerns regarding the opacity concerning how data is being processed and (mis)used, where individuals typically lack meaningful transparency, visibility and control over what, how, why and by whom their data are captured, analysed, transferred, stored, or otherwise processed and used (Zuboff, 2015; Lehtiniemi 2017; Berners Lee, 2018). In response, and in line with the growing public discourse regarding data-related issues, PIMS as a concept generally aims to better inform and empower users with regards to the processing of their data (Royal Society, 2019). PIMS are a form of privacy enhancing technology (PET), representing an instance of an approach for privacy self-management—whereby users work to manage their own privacy interests (Solove, 2013; Solove, 2020).

PIMS typically involve an ecosystem, which generally entails a platform providing the PIMS infrastructure. The platform provides users with some components for handling their personal data. Within this ecosystem, third parties seek to process user data (Janssen et al., 2020b). PIMS employ technical, legal and organisational measures that enable users to manage and control their data, and to ensure and validate that the behaviours of third-parties accord with user and platform requirements. Though the specifics of which vary by offering, measures often include (to varying degrees) the ability to determine:

(i) the data collected, captured, stored, or that otherwise available for processing;

(ii) that computation, analytics or other processing performed over that data; as well as providing

(iii) oversight measures to validate, review and audit what happens to their data.

PIMS often enable decentralised data processing, where third-parties that wish to process user data will not directly access a user’s data (e.g. where user data are transferred to the third party). Instead, such mechanisms enable the third-party’s desired computation, analytics, or other processing to be brought to the user’s data (typically residing within a physical or virtual user-centric PIMS device), with only the results of that processing returned to the third-party (Janssen et al., 2020a). This (as with other forms of processing) occurs in line with a user’s agreement, and only over certain data, as determined by the user.

PIMS may be supported by other novel technologies, such as Distributed Ledgers (Zichichi et al., 2020; see separate entry regarding DLTs).

The term PIMS is not novel; some older references to the term can be found, for instance, in Barreau, 1995; Jones & Thomas, 1997; Bergman et al., 2008. Nowadays, the term ‘PIMS’ broadly refers to a class of technology that provides users with means for managing their data vis-à-vis those wishing to process it. Note that PIMS is an ‘umbrella term’, and we see a range of related terms used including: personal data stores (World Economic Forum, 2013; De Montjoye et al., 2014; OpenPDS, 2017; Crabtree et al., 2018; Royal Society, 2019; Janssen et al., 2020a); personal data vaults (Schluss, n.d.); personal information management services (ControlShift, 2014), or personal data spaces (European Commission, 2020). The concepts also bear a relationship with some forms of data intermediary (see separate entry regarding “Data intermediary”).

PIMS have been proposed by actors in civil society (MyData movement, 2015); academia, where offerings such as OpenPDS or Databox were developed; the private sector (some examples include CozyCloud; Mydex; CitizenMe, or Digi.me), or by actors in research environments with the PIMS developing into a commercial offering (Dataswift/Hub of All Things, or Solid/Inrupt, the latter being developed by Sir Tim Berners Lee). PIMS are increasingly gaining attention from policymakers, who currently consider mechanisms for regulating and advancing data intermediation services in general, of which PIMS are one example (e.g. European Commission Data Strategy, 2020; European Commission proposal for a Data Governance Act, 2020; German Bundestag bill for Consent Management Services, 2021; Centre for Data Ethics and Innovation (an expert body of UK’s government Department for Digital, Culture, Media and Sports, 2021)).

PIMS generally adopt an approach that is firmly grounded in the logic of privacy self-management and ‘notice and consent’, whereby users are charged with managing their own privacy interests (Solove, 2013; Solove, 2020; Janssen et al., 2020b). However, such approaches are the subject of critique, with arguments that they are largely ineffective given the systemic issues inherent in digital ecosystems, such as those regarding power and information asymmetries (Barocas & Nissenbaum, 2009; Sloan & Warner, 2013; Bietti, 2020).

Although some forecasted that PIMS could generate considerable economic benefits for businesses and consumers alike (ControlShift, 2014; Brochot et al., 2015; European Commission, 2020), the business cases for PIMS platforms vary and continue to be developed (Bolychevsky & Worthington, 2018).

Personal Information Management Systems (PIMS) aim to inform and empower users by equipping them with mechanisms for mediating, monitoring and controlling how their data is accessed, used, or shared. Their purpose is to provide an alternative to the data processing practices common today. PIMS are growing in prominence with many offerings in the pipeline. While gaining attention from developers, researchers, industry and policymakers, questions over the business cases and the ability for PIMS to overcome the systemic issues in digital ecosystems remain.