Naam Tilburg Institute for Law, Technology, and Society

November Property Rights in Personal Data: Would It Solve Privacy Problems? Prof. Corien Prins Center for Law, Technology, and Society (TILT) Tilburg University Oslo, 23 November 2007

November From Psysical Products to Immaterial Data Biobanks and Biometrics –it is all about personal data, information and knowledge Personal data, information and knowledge –it is all about power and money Power and Money –in the end our challenge is balancing interests Balancing interests –What instruments can best be used?

November Property Rights as the Ultimate Solution Argument: extend property interest to personal data of individuals (why not grant individuals same rights in their name as companies); Argument: developments in intellectual property Why: data about individuals nowadays have become a key commercial asset (e.g. data in biobanks; Google/YouTube); Why: individuals must be able to negotiate and bargain over the use of their data; Why: individuals need something in return (return benefits) Result: data markets will be allowed to function more effectively; Result: less privacy invasion and more trust.

November Economic Arguments Protection of personal data is expensive and in short supply, whereas the collection and use of personal data is wasteful and inefficient; Thus: we should consider market-oriented mechanisms based on individual ownership of personal data. Laudon, Communications of the ACM, 1996; Mann, First Monday, 2000.

November Law and Technology Arguments In our society protection mechanisms based on private instruments gain priority; Vesting an ownership right would make it expressly clear that data subjects own personal data, not the business that collected them; Advances in technology make it easier to create and sustain the conditions for individual and personalized choices of data use.

November Day-to-day Practice Customer data is a means of generating cash flow and silencing creditors; Personal data changes hands or ‘ownership’, as part of merger-acquisitions, reorganizations and other strategic company movements; Companies may even believe that they have ownership rights in the personal data (compilations; section 55 UK data protection act/stealing data) or body material/parts (add-on blood products); Companies offer benefits in return for using personal data (personalised services).

November Property Arguments and Human Right Dimension Property rights perspective does not fit the human rights perspective as adopted in, e.g., article 8(1) of the Rome Convention for the Protection of Human Rights and Fundamental Freedoms; Human right is a right of non-interference, not a right of positive entitlement; More than just a commodity (dignity, social value of privacy) Privacy is attached to individuals by virtue of their personhood, and, as such, this right cannot be waived or transferred to others; Privacy is linked to constituting and maintaining a person’s personal integrity. Thus, it is a non-commodifiable right.

November However: Various developments testify to the growing influence of property thinking in the human rights domain: –property in personality (name, appearance, voice, etc.); –property in human body parts. Contractual freedom and human rights (individuals are allowed to waive the protection of their fundamental rights/individual autonomy); Directive 95/46 (are provisions imperative; Directive favors utilitarian considerations; Distinguish Privacy from Personal Data (listing in art. 7 and 8 European Charter on Fundamental Rights).

November Would a Property Approach Solve Privacy Problems? Arguments made in legal literature: –merely addresses problems in relation to private sector use (what about public use of biometric data); –problems related to the concept of property and the concept of personal data itself; –Data may relate to more than an individual: groups of people –‘take it or leave it’ terms under the threat of exclusion or denial of access to digital services; –licensing all the necessary data would be costly, inconvenient, and time-consuming, liability?; –framing the debate in terms of proprietary rights neglects the fact that what data subjects really seek: control (and perhaps: benefits). And: What is our real privacy problem?

November It is all about Combining Data about Identities Individual data versus combined data (linking databases); Data are not just data (not one uniform category) Ambient intelligence; RFID, personalized services; Focus not so much on the individual data, but on the effects of the use of present-day technologies and the use of combined data; Thus: focus on identities (types of persons; types of citizens/types of consumers/types of healthy/unhealthy people, type of ethnic origin, etc.).

November Shifting in Our Attention Shift our attention from individual sets of personal data toward the statistical models, profiles and the algorithms with which individuals are assigned to a certain group or ‘identity’; Data protection mechanisms must be structured along lines of control and visibility. Data protection mechanisms must be structured along lines of transparency and trust … and maybe other benefits??

November What We Need We need to know and understand how social and economic identities are constructed, influenced and used; We need instruments to know and to control how our ‘lives’ are ‘created’ and influenced; Our identity is more that an administrative identity (ipse identity – idem identity) We do not need ownership of individual data.