Personalized medicine has generated massive investments in data integration initiatives and stimulated new flows of health data among multiple actors. Such flows raise questions as to who should be able to access data, for which purposes, and how this access and use should be regulated. We suggest thinking of these questions as matters of ‘data authority’: who can legitimately do what with health data? In this article, we analyze a public debate developing in written media about personalized medicine to understand negotiations of data authority. We demonstrate how the debate creates no consensus and yet seems to stimulate selective regulatory changes. The changes are selective in the sense that they focus on the protection of autonomy but fail to address concerns about, for example, commercial interests. We argue that data authority rests on enduring conflict and that this conflict can be seen as constitutive for personalized medicine as a sociotechnical phenomenon.