If the data is generated by or concerns the users, then they have ownership (degree varying on jurisdiction).