From Personality To Property: Data Protection Needs Competition & Consumer Protection Law, Conference Says

MUNICH — Will personal data become a property right licensed to those who give you the best deal for it? Researchers at a conference convened by the Max Planck Institute for Innovation and Competition in Munich delved into a future “holistic approach” of intellectual property, data and consumer protection, with additional assistance from competition law.

The new European General Data Protection Regulation (GDPR), and the accompanying directive for the public sector, will go some way to protect users’ autonomy in deciding over his personal data. Provisions on data portability and transparency, coupled with considerable sanctions in case of violations, all would try to hand back some control to the users, Manon Ootvees. from the Institute for Information Law of the University of Amsterdam, said before 40 international young researchers from fields as diversified as IP, competition and antitrust law, economy and consumer protection.

Still data protection could not do it alone. “It might not work in the context of big data, or at least be less strong than we expect,” Ootvees said. Will people exercise the rights, will they be lured by the benefits platforms offer and how difficult will it be to proove, for example, that their personally identifiable data, spilled in aggregated versions to third party providers all over and used to construct profiles again for personalised adds or personalized pricing? “I see a lot of scepticism here,” said Ootvees.

The long-term effects in particular, said Kristina Irion, Ootvees supervisor in Amsterdam, are problematic, considering that people even would be served different versions of the information cocktail and their thinking possibly manipulated in some obscure way. “The concept of freedom of thought,” said Irion, “may get a completely different interpretation.” The information law experts therefore are curious about the results of what other legal regimes might add to the tussle.

From Personality to Property

The idea that property rights might be one part of the solution is already out there, said Andreas Sattler, researcher at the Department of Civil Law, Intellectual Property and Competition Law at the Ludwig-Maximilian University of Munich. Nobody denies that personal data is monetized and used as “counter-performance” in deals with big online platforms. Users pay with their data. The word of the “new currency” has been coined.

Several “property”-like rights have been developed or are under development. The new GDPR strengthens the right to damages, and establishes the right to portability and erasure of one’s data.

Certainly for the enforcement of portability technical standardization and interoperability is in high need – enabling to move between providers’ systems, according to Helena Ursic from Leiden University. Still all are useful steps towards more meaningful “prosumer law” and the “right to common data ownership should be considered.”

Official acknowledgement of the “property right” finally was included in a new provision the European Commission drafted into its proposal for the “EU Directive on certain aspects concerning contracts for the supply of digital content.” When consumers according to that draft directive terminate their contract (Art.13b), their provider has to stop making use of the content and personal data of the consumers that were used to pay for the service.

Under such a regime, according to Sattler, users would practically grant licences to the providers to use their personal data/property and could also sue where they felt the licence violated. But there are also differences between property and personal rights, Sattler acknowledged.

“Personal data cannot be divided from the person, it always sits close to the person and the dangers of abuse of personal rights are much greater,” he said. “Maybe a similar distinction as in copyright will be developed.” Continental copyright distinguishes between moral and economic rights.“

Irion noted that the approach taken by the Commission in the digital right directive meanwhile has come under heavy discussion and could be changed. What many researchers feel is that the new “property right” could do at least one thing – it could raise the awareness of users about the value their data has.

Competition and Antitrust

For Anca Chirita, researcher at Durham University, the recognition of this asset by the users is key, given the asymmetry of large data collecting platforms and users completely at a loss about what the profiling algorithm spits out about what they would buy at what price.

“Knowing a consumer’s usage, frequency, preferences, and choices builds up a picture of their prospective economic behaviour,” Chirita explained in a paper where she took a close look at what kind of data Google, Microsoft, Instagram, Whisper and LinkedIn log and crunch.

The list and matrix is quite impressive and includes beside classical personal data, personal search queries, behavioural data, experience data (like cookies, Google Analytics tracking via DoubleClick), economically relevant data, interactive ads data, to unique device identifiers and authentication data. “It dis-empowers such online consumers from any natural status of rational buyers while making them more vulnerable vis-à-vis online sellers or retailers,” she wrote.

Competition and antitrust authorities also have started to take that look, but in several cases on both sides of the Atlantic decided to stay out of the privacy debate. Chirita talked of missed opportunities and concluded in Munich: “I do not see online price discrimination as a standalone for antitrust interventions, but those who say that data protection can sort out all problems are wrong in my opinion.”

And she is not alone in this conclusion. Inge Graef, her colleague from the University of Leuven, pointed to the missed opportunity in the Facebook-Whatsapp merger two years ago. The European Commission just waived that through based on Mark Zuckerberg’s promises that he would never combine the data sets of both, yet now he does.

Perhaps data protection authorities should be given standing rights to file amicus curia briefs in antitrust procedures, the researchers considered. Graef thinks both sides would win: “It is not about extending the different regimes“, she said, “but applying the tools in a more complementary way. Relying on data protection infringements allows cartel authorities to tackle new forms of abuse in digital markets.”

Access and Other Ideas

There is also another side of the equation, the one worried about the closing up of the data goldmines in digital land. Bjoern Lundqvist, Copenhagen Business School, asked the conference participants to consider how data protection could be used to prevent access of new entrants, telling the story of a bank app provider who got customers to sign up to their app making them an intermediary for payment, but the customer’s bank denying access. Data protection and innovation are difficult, said Lundqvist, a statement that many digital providers certainly are ready to sign up to amidst the call for stricter privacy regulation.

 

Image Credits: Max Planck, MPII