Data should be maximally held by the users themselves, and cryptographic means used to enable aggregation of useful statistics without compromising individual privacy.