[penagwin]

I would argue that as an entity when communicating with other entities they may be able to refer to the data they store as "their data", but the data itself is still yours.

It's kinda the whole point of GDPR and stuff...