Priceless data: why the EU fundamental right to data protection is at odds with trade in personal data. Issue 45 (July 2022)

• Record Type: Journal Article
• Authors: Custers, Bart; Malgieri, Gianclaudio
• Is Part Of: Computer law & security review. Issue 45(2022)
• Publication Date: 2022-07
• Subjects: Data ownership -- Data subject rights -- Digital single market -- EU charter of fundamental rights -- EU data economy -- GDPR -- Right to data protection -- Inalienability for fundamental rights -- Personal data -- Privacy; Computers -- Law and legislation -- Periodicals; Computer security -- Law and legislation -- Periodicals; Electronic commerce -- Law and legislation -- Periodicals; Data protection -- Law and legislation -- Periodicals; Computer security -- Law and legislation; Computers -- Law and legislation; Data protection -- Law and legislation; Electronic commerce -- Law and legislation; Periodicals; 343.0999
• DOI: 10.1016/j.clsr.2022.105683
• Languages: English
• ISSNs: 2212-473X

Abstract

Abstract: Many free online services, including search engines and social media, use business models based on the collecting and processing of personal data of its users. The user data are analysed, leased or sold to generate profits. Basically, the users are not paying for the services with subscription fees or any kind of monetary payment, but with their personal data. In this paper, we argue that these business models, treating personal data as a commodity, are problematic under EU data protection law, which disqualifies personal data as a commodity. Both under the EU Charter of Fundamental Rights and the General Data Protection Regulation (GDPR), the legal rights to data protection are inalienable. This is at odds with the actual trade in personal data in the data economy, since the 'payment' cannot be a transfer of ownership of personal data. It could be argued that the 'payment' is not a transfer of ownership of personal data, but rather a transfer of personal data rights, i.e., granting a right to collect and process the data. However, even from that perspective, users would retain inalienable rights to stop or restrict the data processing, as the GDPR does not allow mandating data subject rights to others. Because the legal basis for the processing of personal data is often consent, people can invoke their data subject rights (and thus withdraw their 'payment') at any time and at will after having received (access to) online services. This causes considerable legal uncertainty in transactions, particularly on the side of data controllers, and may not contribute to the EU's envisioned data economy.