[ska]

re: revocation, non-transferable, etc.

What I am suggesting is that data/learning companies need to start thinking of this sort of data differently, that what you are negotiating is access to the data under certain terms not ownership of the data.

If the individuals retain ownership, we the company should not be able to say sell that access on to a third party (c.f. Cambridge Analytics), or use it in a different way than negotiated for. If the company does not live up to the terms negotiated, the individual should be able to revoke the permission. There are various ways to do this, one being something like you describe.