Source: https://www.yalelawjournal.org/comment/the-eu-general-data-protection-regulation-toward-a-property-regime-for-protecting-data-privacy
Timestamp: 2019-04-18 12:40:31+00:00

Document:
The EU’s proposal includes three elements in particular that lend themselves to a property-based conception: consumers are granted clear entitlements to their own data; the data, even after it is transferred, carries a burden that “runs with” it and binds third parties; and consumers are protected through remedies grounded in “property rules.” In these respects, the proposed scheme is remarkably similar to existing, heretofore purely theoretical, proposals for property regimes for protecting personal data, especially the model proposed by Paul Schwartz in 2004.13 But the draft Regulation seems to be one of the first legislative proposals that would actually implement this kind of propertized personal data regime.
This Comment proceeds in two Parts. Part I outlines some theoretical proposals for propertized personal information designed to remedy the shortcomings of contemporary data protection law, exploring the features of “property” that scholars have seized on in presenting these proposals. Part II argues that these property-oriented safeguards are present in the draft Regulation, even though the Regulation is not at all framed in property terms. The Conclusion briefly explores the implications of this analysis for the broader question of whether propertizing personal data can be reconciled with treating privacy as a human right, pointing out that the draft Regulation seems to transcend this debate by adapting the rights and remedies commonly associated with property in service of a human-rights-driven approach to privacy.
In response to these concerns, scholars including Paul Schwartz, Edward Janger, and Vera Bergelson have proposed highly regulated property regimes that would carry some property-oriented rights and remedies but not others. Schwartz’s proposal is the best known—indeed, it was recently endorsed by Timothy D. Sparapani, the former Public Policy Director of Facebook23—and will be the primary focus of this Comment.
“Property” is a notoriously nebulous concept, and Schwartz (as well as other theorists of data property) has declined to adopt a cohesive definition, understanding “property as a bundle of interests rather than despotic dominion over a thing.”24 Proponents of a regulated data property regime all focus on the ways that personal information is already treated as a commodity by corporations and argue that protecting such data with a legally cognizable property entitlement, vested in data subjects and regulated in various ways, provides necessary protections that are absent in the status quo.25 Rather than arguing that the free market can do all the work of protecting privacy, as Lessig does, they instead seize on some of the other rights and remedies commonly associated with property regimes and explore how conceiving of data as property for certain purposes might in fact offer the best option for protecting consumer privacy while still enabling individuals to share their data with data users under certain circumstances. For example, Schwartz especially seizes on one of the features commonly associated with property regimes: under some property schemes, “the burden of a property right ‘runs with the asset’” in question.26 This feature allows for property rights to create burdens that bind third parties—third parties with whom I have no explicit legal relationship nonetheless have a duty to respect my property rights in an asset—in contrast to contract rights, which bind only the specific parties in privity.27 This is particularly important in the context of data privacy, because it allows a data subject to retain some rights in her data, even in transactions between data users to which the subject is not a party.
The next Part demonstrates that even though the draft Regulation is not presented as explicitly establishing property-like protections for personal data, these three features—default entitlements, burdens that run with the data, and property-rule-based remedies—are all present in the Regulation’s rights-and-remedies scheme. The Conclusion then explains the significance of this finding for broader debates about whether a human-rights-driven approach to privacy can be reconciled with treating personal data as property.
But despite the fact that the draft Regulation is grounded in human rights rhetoric and employs no property terminology, its protections nonetheless function remarkably like the regulated property schemes described in the last Part. While the right to be forgotten and the Regulation’s other consumer-protection rights are not themselves “property rights” enforceable against third parties, they stand for a set of interests in, and burdens placed on, consumer data that can be best understood in property terms. The remainder of this Part demonstrates how the draft Regulation creates a scheme that adopts three of the principal features of propertized personal information described by Schwartz and others: (1) default data subject entitlements that are only partially alienable; (2) burdens that run with the asset and bind third parties; and (3) property-rule-based remedies.
In this respect, the draft Regulation is predicated on the assumption that although data is a kind of commodity capable of changing hands, the data subject always retains the ultimate entitlement to this property. A data user may essentially receive a “license” to use the subject’s data,51 since the data subject has temporarily waived her right to exclude it from using her information. But the data subject maintains the discretion to terminate this license and force the data user to cease storing or using her information.
The draft Regulation establishes that the data subject’s proprietary interest in her own data—her original entitlement to that information and right to reclaim it from the control of others—creates a burden that runs with the data and binds third parties. In other words, the data subject maintains a right to demand that her data be erased, not only by the original data user with whom she dealt, but also from the databases of any other entities that may have gained access to the data. The draft Regulation states that any data user must “take all reasonable steps . . . to inform third parties which are processing such data, that a data subject requests them to erase any links to, or copy or replication of that personal data.”55 These third-party data users would be bound to respect the data subject’s exercise of her right to be forgotten or risk incurring sanctions under the Regulation.
This requirement is one of the most property-like features of the new regime in that it creates a burden that “runs with” the data subject’s information. Rather than conceiving of privacy protection as purely in personam, the draft Regulation instead grounds these rights in the data itself. Like in Schwartz’s model, then, the data subject’s interest is “built in” to the data,56 functioning like a kind of negative covenant.57 Any data users that gain access to the data subject’s information, irrespective of whether they are in privity with the data subject, must still respect what Schwartz might call the “use-transferability” restrictions58 built into the data that give the original data user the discretion to terminate processing.
Though the EU’s draft Regulation is framed as stemming from the human right to privacy enshrined in European public law,66 this Comment has argued that it also, implicitly, treats personal data as a commodity capable of changing hands. While the Regulation forbids free marketization of data, it nonetheless uses property-derived rights and remedies—similar to those identified by Paul Schwartz and other scholars—to protect personal privacy in the course of data processing. By creating default data subject entitlements to data, a quasi-licensing scheme for data users who seek to use this data, use-transfer restrictions that “run with” the data, and property-rule-based remedies, the draft Regulation would dramatically overhaul the current system of primarily liability-oriented protections.
The fact that a regime might utilize some property-derived rights and remedies in service of human-rights goals may seem incongruous, considering that we often treat propertization as anathema to human-rights interests.67 But the draft Regulation model demonstrates that a regulated property regime—in which some but not all of the property-rights “sticks” are granted to consumers—might, in fact, be able to accommodate the same normative impulse that drives some to conceive of data privacy as a fundamental human right: the notion that uninhibited exchanges of personal data corrode human dignity and personhood.68 The draft Regulation is predicated on the assumption that we live in a world in which personal data has been and will be treated like a commodity and simply banning exchanges of personal data is not a viable option; instead, regulating these exchanges and providing consumers with additional agency, using property-derived rights and remedies,69 offers the best hope of protecting the dignitary, human-rights-driven privacy interests at stake.70 This reflects the assumption that “property is an artifact, a human creation that can be, and has been, modified in accordance with human needs and values”71 that also underlies the propertized data model proposed by Schwartz.
In this respect, the European Commission’s apparent willingness to implicitly use property-derived rights and remedies in the service of data privacy protection demonstrates that, notwithstanding claims that this approach has “passed its peak,”72 the prospect of crafting a regulated property regime to protect data privacy still has the potential to inform other data privacy law reform efforts in years to come.
Draft Data Protection Regulation, supra note 1, art. 3(2).
See infra text accompanying notes 67-71.
Paul M. Schwartz, Property, Privacy, and Personal Data, 117 Harv. L. Rev. 2055 (2004).
See, e.g., Janger, supra note 17, at 913-18; Schwartz, supra note 13, at 2095-2116.
Schwartz, supra note 13, at 2098.
Schwartz, supra note 13, at 2095-2100.
See Merrill & Smith, supra note 35, at 962.
Id. at Explanatory Memorandum §§ 3.2, 3.3.
Draft Data Protection Regulation, supra note 1, art. 6(1)(a).
Id. art. 19(1); see id. art. 17(1)(c).
For a definition of licenses, see supra note 35.
See Hansmann & Kraakman, supra note 26, at S386-87.
Draft Data Protection Regulation, supra note 1, art. 17(2).
Draft Data Protection Regulation, supra note 1, arts. 46, 73(1).
Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, COM (2012) 11 final (Jan. 25, 2012), http://www.europarl.europa.eu/registre/docs _autres_institutions/commission_europeenne/com/2012/0011/COM_COM%282012%290011_EN.pdf [hereinafter Draft Data Protection Regulation]. The draft Regulation seems to be primarily designed to regulate data processing by private entities. While some agencies of EU member-states may also be bound by the Regulation, the majority would fall outside its purview. See id. art. 2(2) (listing, inter alia, “Union institutions, bodies, offices and agencies” and authorities devoted to the “prevention, investigation, detection or prosecution of criminal offences” as entities that are not bound by the Regulation).
Id. art. 17; see also id. art 6(a) (explaining the role of the data subject’s consent in determining the legality of processing).
Since January 2012, several European Union institutions have proposed amendments to the draft Regulation. For example, the Council of the European Union, a legislative body of ministers of EU member-states, proposed its own version in May 2013. A special committee is also examining various amended versions of the draft Regulation and preparing a text for consideration by the European Parliament. Once this version is approved, the European Parliament and Council of the European Union will enter into negotiations over the compromise version and likely vote on a final version in the next few months. Hunton & Williams LLP, Council of the European Union Releases Draft Compromise Text on the Proposed EU Data Protection Regulation, Privacy & Info. Security L. Blog (June 4, 2013), http://www.huntonprivacyblog.com/2013/06/articles/council-of-the-european-union -releases-draft-compromise-text-on-the-proposed-eu-data-protection-regulation. While some of the newly proposed versions of the draft Regulation significantly amend the original draft, the provisions of greatest significance to this Comment appear to be mostly unaffected. See, e.g., Proposal for a Regulation of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation)—Key Issues of Chapters I-IV, Council Eur. Union (May 31, 2013), http://register.consilium.europa.eu/pdf/en/13 /st10/st10227-ad01.en13.pdf (the Council of the European Union’s amended version). Because the final version of the Regulation remains in flux, this Comment focuses only on the text of the original 2012 European Commission draft. See Draft Data Protection Regulation, supra note 1. However, it is important to note that the final version of the Regulation may temper some of the 2012 draft’s more controversial proposals.
See, e.g., Jeffrey Rosen, The Right to Be Forgotten, 64 Stan. L. Rev. Online 88 (2012) (arguing that the “right to be forgotten,” as conceived of in the draft Regulation, may restrict speech protected by the First Amendment).
See Remarks by U.S. Ambassador to the EU, William E. Kennard, at Forum Europe’s 3rd Annual European Data Protection and Privacy Conference, U.S. Mission to Eur. Union (Dec. 4, 2012), http://useu.usmission.gov/kennard_120412.html (arguing that the draft Regulation could hinder law enforcement cooperation).
See Peter Druschel et al., The Right to Be Forgotten–Between Expectations and Practice, Eur. Network & Info. Security Agency (Nov. 20, 2012), http://www.enisa.europa.eu /activities/identity-and-trust/library/deliverables/the-right-to-be-forgotten/at_download /fullReport (highlighting challenges to implementing the draft Regulation under the existing technical structure of the Internet).
Vera Bergelson, It’s Personal but Is It Mine? Toward Property Rights in Personal Information, 37 U.C. Davis L. Rev. 379, 403-04 (2003) (describing how U.S. law does not grant individuals property rights in their personal information); see also Nadezhda Purtova, Property Rights in Personal Data: A European Perspective 153-220 (2012) (surveying European data protection law and contrasting it with a hypothetical property-based regime).
Under the famous framework developed by Guido Calabresi and Douglas Melamed, an entitlement is protected by a “liability rule” when a defendant may violate it in exchange for paying damages. Guido Calabresi & A. Douglas Melamed, Property Rules, Liability Rules, and Inalienability: One View of the Cathedral, 85 Harv. L. Rev. 1089, 1092 (1972). For a discussion of the differences between property rules and liability rules in the context of data protection, see infra notes 37-38 and accompanying text.
See, e.g., Video Privacy Protection Act of 1988, Pub. L. No. 100-618, 102 Stat. 3195 (codified at 18 U.S.C. § 2710 (2012)) (establishing a private cause of action against video rental companies that disclose consumer information). For a survey of these statutes, see Daniel J. Solove & Paul M. Schwartz, Information Privacy Law 839-79 (4th ed. 2011); and Edward J. Janger, Privacy Property, Information Costs, and the Anticommons, 54 Hastings L.J. 899, 904-08 (2003).
See Directive 95/46/EC of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995 O.J. (L 281) 31 (mandating that corporations provide certain protections to data subjects during data collection and processing). Data subjects may seek damages from corporations that violate the Directive. Id. art. 22, 23(1).
See Jessica Litman, Information Privacy/Information Property, 52 Stan. L. Rev. 1283, 1284 (2000) (“Non-cash purchases are memorialized and toted up. Large cash purchases are memorialized and turned in. Cash withdrawals and deposits are recorded and saved. Visits to the doctor, diagnoses, prescriptions, and referrals are coded and passed along. Everything we look at on the Internet is noted and retained. All of this information is collected, aggregated, and stored on computers. Anyone with reason to do so can correlate the information stored on one computer with the information stored on another, and another, and another. The resulting dossier may be used, sold, published, or correlated with other sources of data. In the United States, that’s completely legal.” (footnotes omitted)); Schwartz, supra note 13, at 2069-72 (describing how personal information is “commodified and traded” in various contexts).
See, e.g., In re Nw. Airlines Privacy Litig., No. Civ. 04-126, 2004 WL 1278459, at *4 (D. Minn. June 6, 2004) (stating that when passengers voluntarily gave Northwest Airlines their personal information and Northwest Airlines compiled that information into a data record, the record “itself became Northwest’s property”); U.S. News & World Report, Inc. v. Avrahami, No. 95-1318, 1996 WL 1065557, at *6 (Va. Cir. Ct. June 13, 1996) (holding that the sale of a magazine mailing list did not constitute conversion because the plaintiff did not maintain a proprietary interest in his name, whereas U.S. News & World Report did maintain a proprietary interest in its collection of names).
See Lawrence Lessig, Code and Other Laws of Cyberspace 122-35, 159-63 (1999); Lawrence Lessig, TheArchitecture of Privacy, 1 Vand. J. Ent. L. & Prac. 56, 63-64 (1999) (“If the law gave individuals the rights to control their data, or more precisely, if those who wanted to use that data had first to secure the right to use it, then a negotiation would occur over whether, and how much, data should be used. The market could negotiate these rights, if a market in these rights could be constructed.”); Lawrence Lessig, Privacy as Property, 69 Soc. Res. 247, 261 (2002).
See Neil Weinstock Netanel, Cyberspace Self-Governance: A Skeptical View from Liberal Democratic Theory, 88 Calif. L. Rev. 395, 476 (2000) (“[M]ost users are not even aware that the websites they visit collect user information, and even if they are cognizant of that possibility, they have little conception of how personal data might be processed.”).
Timothy D. Sparapani, Putting Consumers at the Heart of the Social Media Revolution: Toward a Personal Property Interest to Protect Privacy, 90 N.C. L. Rev. 1309, 1313 (2012).
Schwartz, supra note 13, at 2094; see also Janger, supra note 17, at 901, 916-20 (describing a system structured by “muddy” property rules that can be “shaped by social policy concerns”).
Henry Hansmann & Reinier Kraakman, Property, Contract, and Verification: The Numerus ClaususProblem and the Divisibility of Rights, 31 J. Legal Stud. S373, S378-79 (2002); see Schwartz, supra note 13, at 2097.
Hansmann & Kraakman, supra note 26, at S378 (“[T]he attribute that distinguishes a property right from a contract right is that a property right is enforceable, not just against the original grantor of the right, but also against other persons to whom possession of the asset, or other rights in the asset, are subsequently transferred.”). Similar, though not identical, to this idea is the notion that “[p]roperty rights . . . are in rem—they bind ‘the rest of the world.’” Thomas W. Merrill & Henry E. Smith, TheProperty/Contract Interface, 101 Colum. L. Rev. 773, 777 (2001).
Id. at 2093; see also Bergelson, supra note 14, at 444-45 (arguing that, under a hypothetical data property regime, some rights to personal data could be declared inalienable even while others are freely marketable); Janger, supra note 17, at 903 (recognizing that a “mandatory crystalline inalienability rule” could be included in a property regime). See generally Hansmann & Kraakman, supra note 26, at S411-12 (providing a general critique of the notion that property rights are synonymous with alienability); Thomas W. Merrill, The Property Strategy, 160 U. Pa. L. Rev. 2061, 2079 (2012) (arguing that alienation is not “essential to the property strategy”).
Schwartz, supra note 13, at 2094 (explaining that under Schwartz’s proposed “hybrid alienability” model, consumers would be able to “share, as well as to place limitations on, the future use of their personal information”).
Schwartz in fact outlines five features in a hypothetical data property regime: “inalienabilities, defaults, a right of exit, damages, and institutions,” Schwartz, supra note 13, at 2094, but also recognizes that “[a] key element of this model is the employment of use-transferability restrictions in conjunction with an opt-in default,” id. (emphasis omitted), which are the two features most tied to the unique nature of property-based protection. For that reason, I focus mainly on these property-based protections, rather than on the other features of the proposed regime.
For a comparison with licenses, see Bergelson, supra note 14, at 446. A license is defined as a property owner’s “temporary and revocable” waiver of his right to exclude. Thomas W. Merrill & Henry E. Smith, Property: Principles and Policies 449 (2d ed. 2012).
Janger, supra note 17, at 914; see also Bergelson, supra note 14, at 417 (“On a more abstract level, the choice between the tort regime and the property regime for the protection of personal information means the choice between property rules and liability rules as defined in the seminal article authored by Calabresi and Melamed.”). It is interesting to note that Schwartz self-consciously chooses to use compensatory damages as the main remedy in his model, in lieu of property-rule-based protections. Schwartz, supra note 13, at 2109 (“A state determination of damages through privacy legislation is preferable to the Calabresi-Melamed approach of enforcing the subjective valuations of private parties with injunctions.”). However, in keeping with this Comment’s goal of exploring the unique features that a property regime can bring to data protection, I choose to focus on Janger’s and Bergelson’s use of property-rule-based protections.
The new legislation is a “Regulation,” meaning it would be binding on all EU member-states as law and enforceable in any member-state court. In contrast, the EU’s current data protection Directive, supra note 18, must be implemented by member-states through domestic legislation. Jane Finlayson-Brown, How to Prepare for Proposed EU Data Protection Regulation, Computer Wkly., Mar. 2012, http://www.computerweekly.com/opinion /Proposed-EU-Data-Protection-Regulation-what-should-companies-be-thinking-about.
For example, it would impose more rigorous consent and notice requirements and costly administrative sanctions for failure to comply. See Draft Data Protection Regulation, supra note 1, arts. 7, 14, 35-37, 79.
Q. and A. with Viviane Reding, N.Y. Times, Feb. 2, 2013, http://www.nytimes.com/2013/02 /03/business/q-and-a-with-viviane-reding.html. See generally Joel R. Reidenberg, E-Commerce and Trans-Atlantic Privacy, 38 Hous. L. Rev. 717, 730-32 (2001) (describing how the EU has generally “treat[ed] privacy as a political imperative anchored in fundamental human rights”).
See supra notes 34-35 and accompanying text. The data could be said to be partially protected by what Calabresi and Melamed call an “inalienability rule.” Calabresi & Melamed, supra note 15, at 1092-93 (“An entitlement is inalienable to the extent that its transfer is not permitted between a willing buyer and a willing seller. The state intervenes not only to determine who is initially entitled and to determine the compensation that must be paid if the entitlement is taken or destroyed, but also to forbid its sale under some or all circumstances.”).
Henry Hansmann & Marina Santilli, Authors’ and Artists’ Moral Rights: A Comparative Legal and Economic Analysis, 26 J. Legal Stud. 95 (1997) (describing the right of integrity, one of the moral rights of artists).
The comparison with moral rights is also instructive here: to the extent an artist maintains a right that future purchasers not destroy or alter her work and “the artist can . . . enforce that right against subsequent third-party transferees of the painting,” she maintains “a property right in the painting.” Hansmann & Kraakman, supra note 26, at S379. We might understand the burden placed on future holders of the artwork as “a type of negative covenant held in gross (that is, personally) . . . that would let the artist prevent any subsequent owner of a work of art from altering it.” Id. at S377. So too here, a data subject’s right to demand erasure by any third parties that gain access to her personal information, irrespective of whether that party is in privity with the data subject, creates a kind of negative covenant on the data that binds third parties.
Where an entitlement is protected by a liability rule, the defendant may choose to violate the right and pay damages. In other words, a non-consensual taking may precede negotiation over price. Propertization changes the order of this interaction. Either through criminal sanction, affirmative judicial order, or prohibitively high (and/or punitive) fines, a property rule makes a non-consensual taking infeasible.
Janger, supra note 17, at 914.
See, e.g., eBay Inc. v. MercExchange, L.L.C., 547 U.S. 388, 395 (2006) (Roberts, C.J., concurring) (“From at least the early 19th century, courts have granted injunctive relief upon a finding of infringement in the vast majority of patent cases. This ‘long tradition of equity practice’ is not surprising, given the difficulty of protecting a right to exclude through monetary remedies that allow an infringer to use an invention against the patentee’s wishes . . . .”).
For example, in a now-famous case, the Wisconsin Supreme Court affirmed an award of $100,000 in punitive damages to a victim of trespass, even though the actual damages were minimal, because “the individual and society have significant interests in deterring intentional trespass to land, regardless of the lack of measurable harm that results.” Jacque v. Steenberg Homes, Inc., 563 N.W.2d 154, 159 (Wis. 1997).
See Margaret Jane Radin, Incomplete Commodification in the Computerized World, in The Commodification of Information 3, 17 (Niva Elkin-Koren & Neil Weinstock Netanel eds., 2002) (“It makes a big difference whether privacy is thought of as a human right, attaching to persons by virtue of their personhood, or as a property right, something that can be owned and controlled by persons. . . . Human rights are presumptively market-inalienable, whereas property rights are presumptively market-alienable.”).
See id.; Marc Rotenberg, Fair Information Practices and the Architecture of Privacy (What Larry Doesn’t Get), 2001 Stan. Tech. L. Rev. 1, ¶ 93 (arguing that a “market-based model [of the right to privacy], which seeks to facilitate the transfer of control over privacy interests, is clearly at odds with th[e] tradition” of treating privacy as a personhood interest).
Notably, Radin’s skepticism of protecting privacy using a property regime is grounded in the assumption that under a propertized personal data regime “online commerce will be governed more and more by contracts between providers and users, and less by a priori (default) entitlement structures.” Radin, supra note 67, at 18 (footnote omitted). In contrast, default entitlement structures (and curtailed free marketability) are essential to the regime presented in the draft Regulation, which explains its greater compatibility with a human-rights approach.
Cf. Hansmann & Kraakman, supra note 26, at S386 (noting that while Europeans often think of the artist’s moral right of integrity as a “right of personality,” not a property right, it can nonetheless be conceived of as a human right that is protected through property-based rights and remedies).
Schwartz, supra note 13, at 2095 (quoting Hanoch Dagan, The Craft of Property, 91 Calif. L. Rev. 1518, 1532, (2003)).
See Purtova, supra note 14, at 2 (claiming that the “American debate on the propertisation of personal data has since passed its peak”).
* I am incredibly grateful to Professor Claire Priest for advising the project from which this Comment stems. I would also like to thank Professor Amy Kapczynski for her helpful comments on an earlier draft, Professor Oona Hathaway for introducing me to the draft Regulation, and Alex Metz and the editors of theYale Law Journal for their excellent suggestions and careful editing.

References: art. 3
 art. 6
 art. 19
 art. 17
 art. 17
 art. 2
 art. 17
 art 6
 § 2710
 art. 22
 v. 
 v. 
 v.