Of Elephants in the Room and Paper Tigers : How to Reconcile Data Protection and the Data Economy

On 10 January 2017, the European Commission published another package of documents within its Digital Single Market strategy. Among them is a Communication on the ‘Building of a European data economy’, accompanied by a Staff Working Document and a public consultation. Apart from some liability issues raised by the emerging Internet of Things and autonomous systems, which seem to have ended up in this package by some rather strange logic, the documents have a dual focus: in the first place, they address the ‘free flow of data’ in the EU and its restrictions by hindrances such as data localization requirements. In the second place, they discuss different possible avenues for boosting the European data economy, implicitly or explicitly starting with the assumption that the European data economy is somewhat lagging behind and has to catch up with other big players in order for Europe to meet the challenges of the global economy in the 21st century. It is in this spirit that the Commission documents suggest a series of potential steps to be taken. Apart from nonlegislative measures, such as incentivising businesses to share data, or fostering the development of technical solutions for reliable identification and exchange of data (e.g. APIs), the measures under consideration include the introduction of a new property right (data producer right), other schemes of investment protection akin to trade secrets law, compulsory access rights against remuneration (such as FRAND licences) and/or access rights for public interest or scientific purposes, and solutions in contract law including default rules for data-related contracts and unfair contract terms control in business-to-business transactions.For decades, the term ‘data’ had evoked entirely different associations because it was the protection of personal data that used to be at the focus of legislative endeavours at EU as well as at national level. Only in 2016, the General Data Protection Regulation (GDPR) was finally passed. It introduced some far-reaching novelties that will require implementation by businesses and other actors worldwide. Thanks to drastic sanctions that may be imposed for violations of the GDPR, including fines of up to 20 million Euro or 4 percent of the worldwide annual turnover, and damages for material as well as immaterial loss, this new instrument is taken extremely seriously and will require a much more cautious approach to any economic activities involving the processing of personal data. In the light of this, the new data economy initiative launched by the very same European Commission that has just celebrated the GDPR as a milestone in fundamental rights protection in Europe may have come a bit as a surprise. How would the two ends fit together?