This week's book giveaway is in the OO, Patterns, UML and Refactoring forum. We're giving away four copies of Refactoring for Software Design Smells: Managing Technical Debt and have Girish Suryanarayana, Ganesh Samarthyam & Tushar Sharma on-line! See this thread for details.
No. The user of data.java should do it. But you should document it well. Note that update(in data class) throws security exception if not provided with a valid coockie, so it has no sense that you lock and unlock in your data class.