practical challenges to data portability in the ... › files › 39320226 › 20180619... · 2....
TRANSCRIPT
IDP 2018, Collaborative Economy – Challenges & Opportunities21 June 2018
Practical Challenges To Data Portability In The Collaborative Economy
Laura Drechsler, Brussels Privacy Hub, LSTS, [email protected]
Table of Content
1. Introduction
2. Potential advantage(s) of using data portability in thecollaborative economy
3. Key challenges
1. Volatility of roles (collaborative economy)2. Portability of reputational data (right to data portability xcollaborative economy)
4. Conclusions
20-06-18 | 2
1. INTRODUCTION
20-06-18 | 3
Collaborative Economy
20-06-18 | 4
Collaborative platform
Seller/Service provider
Private individual
Professional seller/provider
User/Consumer
EC 2016: Collaborative economy =“business models where activitiesare facilitated by collaborativeplatforms that create an openmarketplace for the temporaryusage of goods and services oftenprovided by a private individual”.
EDPS 2018: Reputation and peerreviews are the currency of thecollaborative economy.
Right to data portability
20-06-18 | 5
Right to data portability
20-06-18 | 6
1. Right only concernsdata provided by thedata subject (whichaccording to WP29includes observed data)
Right to data portability
20-06-18 | 7
2. Right only applieswhen processing wasbased on consent orperformance of acontract, and is done byautomated means.
Right to data portability
20-06-18 | 8
3. Right shall notadversely affect therights and freedoms ofothers.
Right to data portability
Personal data
• The right to data portability is only applicable to data that was provided by the data subject, or observed by the controller.
Legitimate processing
• The right to data portability only applies if the processing was based on consent or performance of a contract and done by automated means.
Rights of others
• The right to data portability shall not adversely affect rights and freedoms of others.
20-06-18 | 9
2. POTENTIAL ADVANTAGE(S)
20-06-18 | 10
Potential advantage(s)
Lack of controlStrengthens
data subject’s influence
Lock-in effectEnables
switching to (better) provider
20-06-18 | 11
Problems of collaborative platforms Potential solutions provided by portability
3. Key challenges
20-06-18 | 12
Key challenges
1.Volatility of roles (collaborative economy)
2. Portability of reputational data (right to data portability x collaborative economy)
20-06-18 | 13
Volatility of roles (collaborative economy)
20-06-18 | 14
Collaborative platform
Seller/Service provider
Private individual
Professional seller/provider
User/Consumer
Controller? (determinespurpose and means ofprocessing)
Processor? (acts on behalf ofcontroller)
Data Subject? (individualsprotected)
Data subject rights (incl. right todata portability) need to beaddressed to the controller.
Volatility of roles (collaborative economy)
20-06-18 | 15
Collaborative platform
Seller/Service provider
Private individual
Professional seller/provider
User/Consumer
Controller = collaborative platform
Data subject = User/Consumer
What is the seller/service provider?
Volatility of roles (collaborative economy)
20-06-18 | 16
Collaborative platform
Seller/Service provider
Private individual
Professional seller/provider
User/Consumer
Professional seller/providerü Employee of platform
(= part of controller status platform)
ORü Joint controller
See: C-210/16 UnabhängigesLandeszentrum fürDatenschutz Schleswig Holstein
Volatility of roles (collaborative economy)
20-06-18 | 17
Collaborative platform
Seller/Service provider
Private individual
Professional seller/provider
User/Consumer
Private individual offerings goods or services
ü Household exemption (Art. 2(2) (c) GDPR)? (EDPS says no/also Lindqvist)
ü Processor? (lack of mandate of platform)
ü Data subject? (processes data)
ü Joint controller?!? (need for agreement platform/individual)
Key challenges
1. Volatility of roles (collaborative economy)
2.Portability of reputational data (right to data portability x collaborative economy)
20-06-18 | 18
Portability of reputational data
20-06-18 | 19
Portability of reputational data
Personal data
• The right to data portability is only applicable to data that was provided by the data subject, or observed by the controller.
Legitimate processing
• The right to data portability only applies if the processing was based on consent or performance of a contract and done by automated means.
Rights of others
• The right to data portability shall not adversely affect rights and freedoms of others.
20-06-18 | 20
Reputation as the currency of the collaborative economy (EDPS 2018)
Portability of reputational data
20-06-18 | 21
Whole user profile
User profile photo
Description of good/service
Customer reviews
Agglomerated score
Provided or observed personal data
Provided data Provided data Provided data BUT by a third party (special issue – see C-434/16 Nowak)
Other “further processed” personal data (not in scope of Art. 20 GDPR)
Compiled by controller, thus not observed or provided
Compiled by controller thus not observed or. provided
Portability of reputational data
20-06-18 | 22
4. Conclusions
20-06-18 | 23
Conclusions
ü Data portability could in theory be of use in the collaborative economy, if it wouldallow the portability of reputation, so that providers of goods and services couldmove their “business” without losing their customer base and not be locked intoexisting platforms.
ü Due to the restrictions to the right to data portability (limited personal data inscope, only applicable to two legitimate bases, difficult if personal data of thirdparties involved) it is unlikely that the right to data portability will counterbalancethe locked-in effect of existing platforms.
ü Additionally, the complexity of allocating data protection roles in the collaborativeeconomy can make it hard to address the right actor for a data portability requestand affect the usability of the response.
20-06-18 | 24
