This is the first article in a multipart series; an earlier version appeared on Medium.com.

In 1951, an impoverished 31-year-old African-American mother of five passed away from a malignant cervical tumor after being treated at the Johns Hopkins Hospital. It turned out that Henrietta Lacks’s cancer cells, nicknamed HeLa cells, had “immortal” properties.

Normal human cells can’t survive for long in culture, but George Gey, a cell biologist at Johns Hopkins, discovered that these cells could be kept alive and successfully propagated in vitro. Later, the HeLa cell line achieved significant commercial success through Microbiological Associates’ large-scale reproduction process, eventually allowing the cells to be deployed in labs throughout the world (and even in outer space). They were instrumental in the Human Genome Project, viral research and vaccine development (notably polio and HIV), genomic research, cancer research, and other scientific applications. HeLa cells drove innovations in technologies for tissue transport, tissue freezing, and genome sequencing.

For years, the Lacks family received no compensation for the role of these cells in enabling so much innovation. Henrietta herself had not been asked for her consent to use the original tissue sample for medical research, and her family was never made aware of the related, valuable breakthroughs. The story, which surfaced in an acclaimed book by Rebecca Skloot, The Immortal Life of Henrietta Lacks, helped enshrine a concept that many of us take for granted: informed legal consent.

The parallels with the ways in which data collected through the Internet of Things is starting to be used today are striking.

The Thorny Issues of IoT Data

With the rapid expansion of IoT applications in the last decade, data has proliferated exponentially. In late 2018, IDC estimated that by 2025, there would be 175 zettabytes of data in the world (one zettabyte equals one trillion gigabytes). This data represents an enormous potential for value creation in the form of downstream applications, business service platforms, and interindustry ecosystems.

Four similarities between the Henrietta Lacks story and the world of IoT data are immediately apparent. First, like Henrietta’s immortal cells, data has the potential for significant insights and value creation. But the individual who is the source of the data may not be aware of its value because its downstream uses may not yet be apparent—or even known, in the case of the Lacks cells. Second, a third party may be needed to recognize the value of data and transform it into commercial products or services, just as recognition of the scientific and commercial potential of the HeLa cell line depended on the insights of a biologist and a commercial lab. Third, new applications, built upon data in one case and cells in the other, are what drive the value of those raw materials. In the case of HeLa cells, thousands of scientists brought their potential value to life through high-impact medical innovations; similarly, the value of IoT data is generated by companies that develop high-value use cases. Finally, data can be replicated at zero cost and its end uses are difficult to monitor and control. ¹ 1 In fact, George Gey attempted to restrict the way HeLa cells were used, but he was rebuffed by a colleague who stated, “Once released [HeLa] becomes general scientific property.” See Rebecca Skloot, The Immortal Life of Henrietta Lacks, Crown Publishing, 2010. Notes: 1 In fact, George Gey attempted to restrict the way HeLa cells were used, but he was rebuffed by a colleague who stated, “Once released [HeLa] becomes general scientific property.” See Rebecca Skloot, The Immortal Life of Henrietta Lacks, Crown Publishing, 2010. Likewise, once HeLa cells were made widely available to the medical community, they could be grown and replicated by anyone at almost zero marginal cost for any purpose.

The use of IoT data, like that of HeLa cells, raises multiple questions of ownership, sharing, and consent. Take just one example: the relationship between automotive OEMs and telematics data aggregators. Drivers produce and consent to data from their cars being analyzed and shared with third parties. Data aggregators (such as Otonomo, Caruso, and HERE) collect, clean, package, and sell that data to enterprise customers for a variety of applications. Companies that service cars, create mapping software, and provide insurance, for example, rely on this transformed data for their products. But who owns the data and who has the right to profit from its uses?

As the data generated by connected equipment proliferates and as solutions and ecosystems mature, we are starting to see such questions being asked about data ownership and sharing. In the automotive industry, disputes are arising over the data rights of consumers versus OEMs, and of OEMs versus their industry partners. Relevant questions include:

• Who should own car data?
• Who should control the data and how it’s used?
• Who should derive financial value from the data?
• What challenges are there in the sharing of data?
• What enabling technologies are necessary?
• What are the public–policy implications of data ownership and downstream use?

The story of Henrietta Lack’s cells suggests three key lessons for B2B companies.

Data Privacy and Consent Are Critical

IoT sensors may collect data for very specific uses, but once in the “marketplace,” the information can be used in many other ways that were not originally contemplated. For example, manufacturing-equipment data can reveal information on plant utilization (and therefore on output and economic value) and on operator efficiency and break times. B2C data-sharing consent statements are often couched in legalese that fails to provide real transparency about the data’s potential applications. And while corporate procurement of large-scale B2B IoT solutions generally involves more scrutiny than the typical consumer’s review of a user agreement, companies’ ability to negotiate their rights with respect to data usage varies considerably.

Most of the Value Is in Applications

How does a company capture the value of its data once that value has been realized? How does a company negotiate when it’s difficult to predict the nature or form of value creation ahead of the actual innovation?

The way in which HeLa cells were used without the Lacks family’s knowledge or consent is now broadly recognized as presenting serious ethical problems, which were compounded by Henrietta’s race, class, and gender. But let’s say for the sake of argument that there had been a transparent and fair agreement between Johns Hopkins and Henrietta Lacks in 1951. Could her doctors have had any idea of the potential uses for her cells? And if the agreement had applied restrictions on the types of research or the parties that could access her cell line, would those limitations have restricted future innovation?

Innovation Depends on Broad Data Sharing and the Absence of Ownership Disputes

Precisely because HeLa cells were widely available, universities and research entities around the world were able to study their unique properties and build enormously beneficial health solutions. HeLa cells were a valuable tool, and their use was not limited by legal constraints.

Ownership questions raise important concerns with respect to potential innovations from IoT data. These include the following:

• Companies might collect and hoard IoT data because of legal or IP concerns about data sharing. What legal frameworks can encourage data owners to be more open and collaborative? Should (some) data be declared a public good?
• How can companies maximize value creation from IoT data while also addressing the valid concerns on value sharing raised by the HeLa story? George Gey’s tissue lab, the firm Microbiological Associates, and the countless researchers working with HeLa cells all contributed real value. How should companies design remuneration systems to capture value and promote data sharing while enabling downstream innovation?
• Data ownership can be a control point. For example, smart cities are investing in data platforms to encourage innovation and avoid lock-in to a single data provider. How can companies use data to attract third parties and avoid vendor lock-in?

IoT data sharing is in its early days. To realize the economic potential, new models for business and innovation will need to take shape. These will require different technologies and, more than likely, new governance mechanisms for data ownership and usage. Only then can we hope to enable innovations like those built on Henrietta Lacks’s cells and at the same time avoid breaching the privacy of the data’s sources.

The BCG Henderson Institute is Boston Consulting Group’s strategy think tank, dedicated to exploring and developing valuable new insights from business, technology, and science by embracing the powerful technology of ideas. The Institute engages leaders in provocative discussion and experimentation to expand the boundaries of business theory and practice and to translate innovative ideas from within and beyond business. For more ideas and inspiration from the Institute, please visit our website and follow us on LinkedIn and X (formerly Twitter).