I think it's reasonable to place legal obligation on people and organisations that collect data on others. The data isn't their speech even if they own it, in the same way that I can own a book but the author has the copyright because it's in some sense their speech and not mine even though it's in my posession. Data protection laws are an enforced default contract in the same way as copyright. I think it's reasonable to assign rights to individuals over data about them, or pass laws obout how that data should be managed.