On legislating the ‘new oil’: article 20’s data commoditising effects
As of today, GDPR’s article 20 grants individuals the right to request (and transfer) their personal data, held by the various organisations possessing it, in a ‘commonly used’ electronic format. This is about to transform personal data into a commodity individuals can trade. How might it be regulated?
A few months ago I wrote my first article for The Outlier, arguing that the regulation of data-driven organisations is much like regulating financial institutions. Later that day, I attended a data-related event in Amsterdam which aimed at illustrating a world where ‘citizens can control and use their data’ to improve their cities and therefore their livelihoods. In a nutshell, and in anticipation of the upcoming GDPR, the cities of Amsterdam and Barcelona were making the case that cities could be made better places if individuals were to share their personal data, which are otherwise unscrupulously abused by big-tech companies. Smaller private organisations have also started offering individuals additional personalised services in exchange for their data. Some organisations, for example Datacoup, are even offering to help people monetise their personal information.
Data portability could have tremendous benefits to society. Services big-techs offer could easily be matched by smaller rivals, thus intensifying competition. Having access to the additional data could help organisations understand previously undetected patterns, thus allowing them to better cater to their subjects. Consequently, individuals would stand to benefit from better services, from financial and healthcare to social media and entertainment. Many other unforeseen benefits could arise. Notwithstanding, there are some challenges on the horizon.
The Other Side of the Story
Having private citizens trade data as a commodity implies that individuals are sufficiently informed to decide which organisations will help maximise their wellbeing in exchange for their personal information. For monetary compensation this might be easier, but this is not the case when services are offered in exchange. It also assumes that positive and negative externalities (i.e. the effect that transactions have on third parties) are well understood when transacting. This is greatly mistaken. In the words of Hal Varian (Google’s Chief Economist), data has ‘decreasing returns to scale’. In practice, this means that collecting the data for a subsample of the population is sufficient to develop algorithms which can be applied to the entire population. In addition, and as I argue in my previous article, the use of algorithms may have unpredictable effects on society.
Furthermore, and without doubting their best intentions, a number of fundamental privacy and security related issues might come to mind. To answer these, some relevant guest speakers were present who proposed various solutions from full democratisation of data to stringent regulation of the use of algorithms. A realistic solution suggested the use of a set of guidelines depicting how algorithms could be used in order to balance business and private citizen needs.
Provided that a set of appropriate guidelines could be established, who should oversee the organisations’ activities? Regulatory institutions are subject to regulatory capture by private and public sector and creating an effective supervisor might prove to be surprisingly difficult.
To counter this, funding agreements need to be reached and rules regarding the appointment of executives need to be drafted, among others. Then, the appointed regulators should be issued with a clear mandate and held accountable for their actions. This implies drafting public reporting requirements and transparency rules. Consequences for misbehaviour should also be agreed upon, in order to get the incentives mix right.
An article by The Economist makes the case that regulating data will be a messy, time consuming exercise. The GDPR is a step forward in the battle to regulate the data-driven economy, yet much is to be done. Expect a bumpy ride ahead.