Contextual Custody: Cross-context personal data and the limits of institutional aggregation

Contextual integrity explains when an information flow is appropriate. It does not say where the records of a person's different contexts can be kept together. Institutions may combine them on the basis of a statute or the person's consent, and whoever does so becomes a controller for a purpose set by the law or by that controller. This paper proposes that the person the records describe is the one place where they can come together without a new controller and without a purpose set by anyone else, and calls the arrangement contextual custody. Once a person's store exists, others may demand access to it; many legal systems forbid such demands, but mostly not demands by authorities. For what people write themselves and no authority certifies, the European Digital Identity framework has no designated place. Recital 19 of Regulation (EU) 2024/1183 mentions self-claimed assertions once; the operative provisions implement it only as a signature over user-provided data, and no rulebook (the specification that defines a kind of wallet credential) in the Commission's catalogue defines a type for such records. Health law provides a place for entries a person writes, but only within health care. Elsewhere the law often lets such a statement take effect on paper in the person's hands, but makes it findable only through a register or a provider. Changes in version 2.0: The central claim is narrower. Earlier versions said that no institution may combine records across contexts, so that the person is the only lawful place left. As a statement of law that is wrong: statute and consent let institutions combine records, as controllers. Version 2.0 claims only that the person is the one place where the records come together without a new controller and without a purpose set by anyone else, and the definition is changed accordingly. The paper now states that contextual integrity addresses aggregation, but by parties other than the person described. Self-authored records other than powers of attorney are no longer said to have no route; what is missing is a designated place, a type and, outside health care, a findable place without a new controller. Version 1.0 wrongly tied the type to the catalogue of attributes. Pressure to disclose, limits on authorities, hosted counterparts, evidence, clinical safety, supported decision-making and the loss of self-authored records have been added, in response to reviews and source and fact checks; the opening example and the description of the implementation have been corrected.