Why the Right to Data Portability Likely Reduces Consumer Welfare: Antitrust and Privacy Critique Peter Swire Moritz College of Law Yale Law School Information Society Project November 12, 2012

The Topic Right to Data Portability (RDP) A new right In draft EU Data Protection Regulation Applies in EU and to all software/services with EU users Will become a fundamental right, as defined further by EU Commission over time Portability sounds good, but no critique to date

Why Portability is Attractive You post your data to the cloud, a social network, an app High switching costs: manual downloads are slow, clumsy Avoid lock-in: you can switch to a new social network or cloud provider Openness is good: the second service can innovate and provide you with great new services Right to informational self-determination: its your data

RDP Requirements Article 18 of draft Regulation: Individual can download all personal data if in standard format Personal data broad Also, individual can transfer personal data and other info provided by consumer to 2d service Without hindrance Service must create Export-Import Module to ensure portability No similar law tried elsewhere

Assessing RDP Idea of data portability very attractive Antitrust perspective RDP likely reduces consumer welfare Privacy and human rights perspective Whence this new human right? Risk to existing privacy/security rights Interop/openness often desirable Previously, law has prevented first party from blocking second party This is unprecedented mandate on how all software is written by first party

Antitrust Concerns Antitrust goal to max consumer welfare Concerns with Art. 18: Applies to all online services, even start-ups No market power requirement Fails to consider efficiencies of what software companies include in offerings Interoperability difficult to achieve Cost of creating EIM Dynamic efficiency & incentives to compete for the market

Antitrust (cont.) In essence a per se rule requiring portability Refusal to deal – lots of company discretion Tying and Microsoft – rule of reason They require showing of market power before regulating Conclusion on antitrust Differs greatly from consumer welfare goal in US and EU antitrust analysis

Privacy & Data Portablity EU idea – fundamental right to autonomy, individuals should control their data Responses/questions: A human right to data portability? Created in statutory/reg process Reasoning from autonomy without the state interest/nexus analysis of facts of US 1 st Am analysis Applies globally, with discretion in EU enforcement

Privacy & Data Portablity RDP as a privacy regulation? Yes, is about personal data But, mostly about lock-in And, risk to users data security One moment of ID theft away from a lifetime of data

Some Conclusions & Questions Consumers do benefit from portability, from avoiding lock-in & high switching costs The rules should learn from antitrust experience with exclusionary practices Market power, efficiencies, rule of reason Be cautious about sweeping declaration of a new right, with no experience in practice Applies to any online services that sell to EU What to do now? Jawbone, and major companies have shifted Look for actual problems, and then act Great caution in drafting or implementing Art. 18