That's why "ownership" is a bad model for this, and (to my knowledge) not really used in any privacy laws. They are not about who owns records, it's about who has which rights to them. Under GDPR, you do not own data about you a company has, but you have rights related to it.
What if party A is a small business and party B is a litigious user movement? We can substitute values for A and B all day. At what point can we parallelize the arguments? Modern laws aren't defining that line which, in some cases while trying to solve their immediate problems, have unintended effects on the non-targets.