Exercising data rights