The current approach to governing digital data is stuck in the paper age. Regulations such as the European Union’s European Health Data Space (EHDS) have been designed to protect primary data subjects—the people who provide their data—and especially sensitive information such as their medical data. In digital societies, however, the risks and benefits of digital practices, ranging from data creation to secondary data use, routinely affect a much wider range of people than the people that the data come from. Data from one group can be used to benefit or discriminate against another group. Digital practices are also embedded in stark power asymmetries, between platform providers and users, and within and across countries. To tackle these challenges we need an approach that goes beyond merely giving individuals more control over their own data, but also enabling communities and other groups to exercise meaningful control over how data are used, by whom and for whose benefit. Just as in pu