The GDPR: Halfway between consumer protection and data ownership rights

Abstract

Digitalisation is changing the way firms create value. Today, one will frequently hear that ‘data are the new oil’. The data to be monetarised in such a ‘digital value chain’, however, are usually customers’ personal data, which are — in the case of banking – traditionally kept in a bank account. In the last two decades, the global internet giants have introduced a model of ‘reversed’ value creation, in which services for the customers are ‘for free’ but paid for by digital traces of personal data, and in which advertisers pay for the output of data aggregation. Current European regulations not only regulate data protection but, in parallel, provide ‘open access’ by the revised Payment Services Directive (PSD2) or ‘portability of data’ by the General Data Protection Regulation (GDPR). A comparison of the actual data economy (represented by global business platforms) and the current regulations with the duality of data protection and ‘open access’ (or ‘free flow of data’) reveals that the metaphor of ‘data as new oil’ lacks clear ownership in data as a valuable asset. Together with the known problem of ‘time preference’, that is, the inclination of consumers towards current consumption (with benefits ‘free of charge’) over future consumption (based on the long-term value of personal data), the omission of ownership results in an asymmetry in the digital market economy. One solution could be the development of data ownership rights, which would provide certainty to all actors along a ‘data value chain’, from consumers to existing banks, global business platforms or new start-ups.