Priceless data: why the EU fundamental right to data protection is at odds with trade in personal data

• Published in: Computer law & security review Vol. 45; p. 105683
• Main Authors: Custers, Bart, Malgieri, Gianclaudio
• Format: Journal Article
• Language: English
• Published: Elsevier Ltd 01.07.2022
• Subjects: Data ownership; Data subject rights; Digital single market; EU charter of fundamental rights; EU data economy; GDPR; Inalienability for fundamental rights; Personal data; Privacy; Right to data protection; EU charter of fundamental rights; Right to data protection; Privacy; Data ownership; Inalienability for fundamental rights; Data subject rights; Digital single market; EU data economy; GDPR; Personal data
• ISSN: 2212-473X; 2212-4748
• DOI: 10.1016/j.clsr.2022.105683

Many free online services, including search engines and social media, use business models based on the collecting and processing of personal data of its users. The user data are analysed, leased or sold to generate profits. Basically, the users are not paying for the services with subscription fees or any kind of monetary payment, but with their personal data. In this paper, we argue that these business models, treating personal data as a commodity, are problematic under EU data protection law, which disqualifies personal data as a commodity. Both under the EU Charter of Fundamental Rights and the General Data Protection Regulation (GDPR), the legal rights to data protection are inalienable. This is at odds with the actual trade in personal data in the data economy, since the ‘payment’ cannot be a transfer of ownership of personal data. It could be argued that the ‘payment’ is not a transfer of ownership of personal data, but rather a transfer of personal data rights, i.e., granting a right to collect and process the data. However, even from that perspective, users would retain inalienable rights to stop or restrict the data processing, as the GDPR does not allow mandating data subject rights to others. Because the legal basis for the processing of personal data is often consent, people can invoke their data subject rights (and thus withdraw their ‘payment’) at any time and at will after having received (access to) online services. This causes considerable legal uncertainty in transactions, particularly on the side of data controllers, and may not contribute to the EU's envisioned data economy.