Report on the IMKR Lecture “Big Data in Law: Data Power – Data Strategies – Data Access” by Prof. Paal
On June 30, 2021, Prof. Dr. Boris P. Paal, M.Jur. (Oxon.), holder of the Chair of Civil Law and Information Law, Data and Media Law at Leipzig University, spoke on “Big Data in Law: Data Power – Data Strategies – Data Access.” After being welcomed by Prof. Rösler, Prof. Paal began by explaining that data protection law is no longer merely about restricting access to data, but increasingly also about shaping the data exchange relationship between data processors and data subjects. Antitrust law is also increasingly restricting data processing. This is evident, for example, in the Facebook case. That case centers on the question of whether the collection of data can constitute a market abuse under antitrust law. The Higher Regional Court of Düsseldorf has since referred this question to the European Court of Justice (Higher Regional Court of Düsseldorf, Kart 2/19 (V)).
Prof. Paal then explained the fundamentals of the data economy. As is well known, data collection and analysis have become a key competitive factor for companies. Against this backdrop, so-called “data sharing” or “data pooling” presents interesting legal challenges. In this context, companies cooperate and grant each other access to their customer data. However, such a practice could raise issues not only under data protection law but also under antitrust law.
Prof. Paal went on to discuss the regulation of data access. He noted that it is the task of the legislature, the courts, and academia to develop a regulatory framework to balance the diverse interests of data-processing companies and data subjects. With regard to the GDPR, Prof. Paal identified a need for reform. In particular, he noted that the GDPR does not take into account the needs of artificial intelligence. This puts Europe at a competitive disadvantage as a hub for innovation compared to the U.S. or China.
Prof. Paal questioned whether the “personal reference” – as broadly interpreted – still constitutes a convincing criterion for determining whether data is worthy of protection. The concept of private-autonomous consent to data processing (Art. 6 et seq. GDPR) should also be critically examined. In practice, consent is often not truly voluntary. This is particularly true given the information overload caused by the multitude of consent requests that internet users must accept, for example, when visiting a website. Furthermore, the lack of alternatives to major tech companies such as Facebook or Amazon seriously calls into question the voluntary nature of consent. Prof. Paal sees the idea of data trusteeship as a promising approach to better serve the interests of all parties involved. Data trustees could act as intermediaries between data processors and data subjects. However, the debate on this issue is still in its early stages.
The ensuing discussion focused, among other things, on the question of to what extent the more liberal U.S. data protection law should serve as a model for Europe in the context of global innovation competition. Prof. Paal explained that the EU does not need a paradigm shift in data protection law, but rather a further development of the legal framework. In doing so, the focus must shift more strongly toward the data exchange relationship between the various actors. Merely restricting data access to protect data subjects is not sufficient. In this context, Prof. Paal criticized the GDPR’s “one-size-fits-all” approach. Given the heterogeneity of the various markets, sector-specific regulations are preferable. In addition, Prof. Paal pointed out that the data power of Big Tech is also increasingly viewed critically in the U.S., as demonstrated by the antitrust case against Google (United States v. Google LLC, No. 1:20-cv-03010 (U.S. District Court for the District of Columbia), and the press release of the U.S. Department of Justice).
