The subject disclosure is directed towards a technology by which access to a protected entity's data is controlled by a data brokerage service. The service determines whether a requesting entity has appropriate access rights to requested information, and if so, the service returns a response corresponding to the protected data. In one aspect, the protected data may be location data of a protected entity that is maintained independent of a payment instrument. The location data is used to compute feasibility information as to whether the protected entity is authorized to perform a transaction using the payment instrument.