14
The Legal Basis for a Data Economy Based on Trust

In the face of the many scandals we are experiencing as a result of personal data leaks, a recent example of which is Facebook, the question of confidentiality and the scope of this secrecy is becoming an urgent matter. Although privacy has a significantly different conception within the Member States of the European Union, a common basis exists beyond our borders, and all democracies tend to recognize a cyber-consumer’s right to privacy. This new kind of consumer, caught up in intensive Internet use, leaves digital traces wherever they go, most often unconsciously. We have moved from a more or less controlled information society to a mass information society, without control, the targets of which go beyond the simple Internet user. This makes it a major challenge for societies and democracy.

The recent case of Cambridge Analytica (see Box 14.1) has clearly demonstrated the intensive use of gold in this century: our data. Eighty-seven million users cheated, stolen from, looted, deceived, etc. Will a television mea culpa and a European road show be enough to calm the abused cyber-consumer?

In this context, the European Union has adopted the General Data Protection Regulation (GDPR), which came into force on May 25, 2018, in an attempt to strengthen and unify data protection for individuals within the European Union.

14.1. Personal data at the heart of the DGMP

14.1.1. Personal data: the black gold of the 21st Century

Primary data are produced by the cyber-consumer and covers their identity data (surname, first name, date and place of birth, place of residence, position) and sensitive data (sexual orientation, health, religious affiliation or membership of political groups).

Generated data are the data collected by various entities, whether or not they are profitable (websites, Internet service providers (ISPs), platforms, e-commerce companies, institutions, associations, NGOs), by trackers, cookies, etc., on the basis of the primary data. This concerns consumption data (purchasing habits), financial data (means of payment, loan status and financing), among other types of data.

Through its digital activity, the cyber-consumer generates even broader data, collected through the sophisticated tools of digital companies, such as connection data, navigation data, geolocation data and consumption data.

Companies are very keen on these data because they enable them to activate a cyber-consumer’s personalized profile and to offer appropriate products. Thus, we can suggest to the cyber-consumer products that they are likely to want, even if it means gradually falling into a panoptic society. But this raises the question of how much freedom the cyber-consumer will have in this world?

Aggregate data are those that are analyzed for a specific purpose and used for Mega Data purposes based on the data generated. This task is left to private companies, large and sometimes monopolistic groups. It is the speed and computational capacity of multiple data sources that make the result so rich.

The source of this lucrative market is always primary data, and it is the cyber-consumer who produces it. The cyber-consumer has thus become the first free provider of 21st Century wealth.

14.1.2. Personal data and brands: the cyber-consumer chooses brands that respect confidentiality

The study1 conducted by IFOP for Sendinblue, published on March 26, 2018, on “The French and the General Regulations on the Protection of Personal Data” shows that 88% of French people are concerned by the use of their personal data on social networks.

We are currently in a time of consumer mistrust toward brands and 77% consider that the criterion of transparency on the use of personal data will be decisive for the purchase of branded products. 8 in 10 French people think that the best protection is still individual vigilance.

This mistrust is justified by an unbalanced membership approach, since consent before the application of the GDPR was an opt-out consent, and the absence of a detailed reading of the general conditions of sale or use would lead to a membership contract whose terms, including judicial jurisdiction, are unfair2.

It is therefore important for companies to restore the trust of the cyber-consumer [WAE 18], and the GDPR is one of the tools of trust if the technical and organizational legal tools are put in place.

14.2. GDPR tools to restore trust

14.2.1. Clear and explicit consent

From default consent, the GDPR introduces the requirement for clear and explicit consent (this is Article 7 of the GDPR). Consent must, therefore, be in writing, detached from other questions that digital companies may ask. The form is free but it must be “easily accessible, understandable and formulated in clear and simple terms”.

The cyber-consumer must, therefore, be able to consent to the categorical and operator-specific use of their personal data. They must also be able to withdraw their consent at any time in a similarly easy way.

Consent is the cornerstone of the GDPR for all processing of personal data, but it is not always respected by European and American companies. For example, the use of cookies, which allow companies to target the consumer, requires the Internet user’s expressed consent (Article 22 of the GDPR). However, if the Internet user refuses, the application does not run properly. In some cases, cookies are inserted without the user’s knowledge and there is no compliance with the GDPR. The result is that operators take advantage of the consent given to trace or even track the Internet user and obtain data with high added value for advertisers. However, these cookies can be quite intrusive. The rate of disenchantment among Internet users toward brands is increasing [WAE 18]: 61% of them find that targeting is too intensive.

The future e-privacy directive submits in article 8 of the document to make use of cookies subject to the Internet user’s expressed consent not only on personal data (which is the case with the GDPR) but also on metadata. At present, the Internet user must consent site by site to cookies through a consent banner that appears following each first visit. This system, however, should be replaced by a global consent that would change the settings from the first connection to implement the level of protection the user wants.

In the future, companies will have to find alternatives to cookies, such as contextual targeting or microtargeting [NDI 17] because of the use of artificial intelligence.

14.2.2. Ensuring the rights of the cyber-consumer over their personal data

The rights of the cyber-consumer are clearly established in sections 12–23 of the GDPR. In addition to the requirement for information on the use of personal data (Articles 12–14 on the transparency of information, GDPR), the cyber-consumer must be able to access their data (Article 15), rectify them (Article 16), erase them (Article 17), restrict their processing (Article 18), and be notified in the event of rectification, erasure or restriction of processing (Article 19).

The cyber-consumer must also have the opportunity to transfer their data from one operator to another (Article 20, data portability), must be able to oppose without application or system malfunctioning (Article 21) and they must also be able to oppose profiling (Article 22).

14.2.3. Creation of a Data Protection Officer role

The creation of a personal Data Protection Officer (DPO), internal or external, single or shared, is the first phase of compliance with the GDPR (Articles 37–39). The DPO becomes the new “strongman” of the company, to managing and coordinating data management and privacy protection, not only of employees but also of customers.

This function can only be carried out transversely: the DPO acts in coordination not only with the IT department but with all deparments, including Human Resources, marketing, sales and communication. They are the privileged interlocutors regarding the Commission Nationale de l’Informatique et des Libertés (CNIL) and must make technical, legal and organizational changes for the company.

14.3. The future of our personal data

14.3.1. A right of ownership over our personal data?

This ownership right is recognized by both case law, and criminal law, and now by the GDPR.

14.3.1.1. An ownership right over data recognized by case law

Data theft was characterized by the transfer of data (customer and supplier files) to a USB key and the court therefore recognized the status of data as a thing, within the meaning of Article 311-1 of the French Criminal Code, “fraudulent removal from the property of another”.

In a subsequent judgment, the Paris Court of Appeal4 recognized the theft, by the fraudulent access and storage in the automated data processing system of the Agence Nationale de Sécurité Sanitaire de l’Alimentation, de l’Environnement et du Travail (ANSES), and by the removal of data and then the downloading and recording of these data on several media (hard disk and data center).

14.3.1.2. A right established in the French Criminal Code

Since the law of January 5, 1988 known as the GODFRAIN law, there has been an offence of intrusion by access to a computer system, imprisonment of 1 year and a fine of 15,000 euros. These violations of automated data processing systems are now punishable by up to 2 years in prison and a fine of 60,000 euros. The deletion or modification of data contained in such systems is punishable by 3 years’ imprisonment and a fine of 100,000 euros.

Articles 323-1 to 323-8 of the French Criminal Code, therefore, confirm that data are an asset like any other, which may be concealed by attacks on automated data processing systems. Financial penalties reveal that a value is given indirectly to the data. The value is based on the damage generated by the breach in the system.

In 2017, France was sadly the second most affected country in the world in terms of data theft5, showing the urgent need for companies to tackle the issue head-on. Between October 2015 and October 2016, 85.3 million data related to the identity of French were stolen.

Criminal law, therefore, allows for prosecution and indirect reparation through sanctions.

The Cambridge Analytica scandal (see Box 14.1) reinforces the feeling that, more than ever, the right of ownership over personal data for the cyber-consumer shall be instituted in terms of their digital activities to protect this asset from unscrupulous operators.

On June 7, 2018, CNN explained that Facebook had triggered a security breach between May 18 and 22, 2018 for 14 million users by testing a new feature. The personal data of these 14 million had been made public. However, Facebook’s Chief Privacy Officer [UNT 18], Erin Egan, did not seem to understand the danger of security breaches and cyber-consumer privacy breaches.

Only an ownership right, with payment of damages, could change the business model of these operators.

14.3.1.3. A new right of use of our data: the portability of personal data within the GDPR

In several ways, the GDPR reinforces the concept of data ownership, in particular, by introducing a new right, the right to data portability.

Article 20 enforces the right to data portability: the recovery of data and transmission of personal data to another system (operator in practice) to which the controller may not object. The right to the portability of personal data is intended to allow data subjects to retrieve the personal data they have provided to a controller, possibly to transmit them to a new controller. This only concerns automated processing operations based on the consent of the person concerned or the performance of a contract. In this context, it remains to be defined in concrete terms what the modalities of transmission and the associated technical standards are.

The data concerned is specified by the Article 29 Data Protection Working Party (A296) which, in its guidelines on the right to data portability, states that it is data actively and knowingly provided by the subject but also data observed or generated by the use of the service or device. The so-called inferred and derived data, created by the controller on the basis of the data provided, will not be affected.

The controller must inform the data subjects of the existence and scope of the right to portability and must respond to such a request within 1 month. This period may be extended to 3 months if the request is complex.

The Article 29 Data Protection Working Party recommends that data is transmitted over the Internet, but it may be considered to put them on a physical medium (CD, DVD, USB key, etc.) if this allows faster access to the request.

Data portability is also included in Book II of the French Consumer Code: “Article L 224-42-1 – The consumer has a right to recover all their data in all circumstances”.

The data must be retrievable by the cyber-consumer in an open way that must be reusable and exploitable by another automated processing system (Article L 224-42-3 of the French Consumer Code following Article 48 of the law for a digital republic).

Portability therefore clearly demonstrates the ab usus7 of personal data by cyberconsumers.

In this respect, portability should not be confused with transfer. In fact, portability does not imply the deletion of data; the data may always be kept by the operator in line with its processing purpose.

Data portability is not, in practice, very effective today, and instead data interoperability and processing issues are emerging. What about processing operations carried out by an ISP that are useful to somebody for administrative and tax declarations, and that would no longer be accessible to them by switching providers? There is a technical lock set up by the operator.

The Article 29 Data Protection Working Party recommends the creation of personal data warehouses, allowing the storage and access to its data on an SFTP (Secure File Transfer Protocol) server with an online application programming interface (API)8 or a secure Internet portal, of course.

This new right to the portability of personal data enshrines the cyber-consumer’s rights, such as a user of services and platforms. It tends to reintroduce balance into the economic value chain of the data market. Initiatives to facilitate the exercise of this right are being organized. For example, Onecub9 is a start-up that organizes data portability by facilitating the import and export of your personal data, while ensuring that the user controls these data. Onecub supports Internet users by identifying the processing and data concerned by portability, identifies uses, protects privacy from the design stage and defines data exchange formats with the Internet user. This company is supported by the French Data authority (CNIL) and the French Bank for Invesment (BPI).

14.3.2. The future: toward a right to an income on our data?

The GAFA business model, which makes the cyber-consumer a good “sleeping” supplier of data with enormous potential, can be disrupted by a French and European consideration of the rights of this homo numericus10 and the implementation of a new economic model based on a reversion of the generated revenues to the cyber-consumer: the price of their consent to a categorical exploitation or according to the pursued purpose of their data. We would then move from a free model to a paid model that will not only drive growth but also generate security.

Data belong to the person providing them (traditional design) and the business model should be based on the first data provider: the cyber-consumer, who will be remunerated on the added value produced by the data, whether it is primary, generated or aggregated.

This new business model would involve several stakeholders and would lay the foundations for the microrewarding of individuals for exploitation of their data.

14.3.2.1. The actors in the data exploitation chain

Several actors in the data exploitation chain with various professions are emerging:

  1. 1) the cyber-consumer: the leading provider of personal data, through their digital activity or connected objects;
  2. 2) the data collector (data centers, ISPs, operators);
  3. 3) the data aggregator: it will be the private (commercial or associative) or public entity (why not a state API that would collect EPIC11 category data?) that will have the technical and financial capacity to manage and analyze these data. The cyber-consumer must receive an income from this collection based on the volume of data and the relevance of the data they generate. The aggregator can sell these data to platforms;
  4. 4) the platform: it also seems necessary to reform the status of platforms. In 2014, the Conseil d’Etat in its annual report12 suggested reserving a special status for platforms that offer classification or referencing services for content, goods or services put online by third parties;
  5. 5) the data retailer13: the retailer or broker is the one who will sell a service related to the exploitation of the data;
  6. 6) the DPO will become the one who will be responsible for defining the content of the usable data and could be able, beyond the application of the GDPR, to decide to whom to sell them on the instructions of the cyber-consumer and the entity that appointed them.

14.3.2.2. A micropayment based on the categorical use of data governed by the legal provisions of the GDPR

The reversion of the actors in the data exploitation chain could be done on the basis of a financial counterpart to the consent to the categorical and temporal exploitation of one’s personal data (pay per loyal use, PPLU14) integrated into the data collection system.

The system would be as follows:

  1. 1) the cyber-consumer creator of data would consent to the categorical and temporal exploitation (with a specific purpose) of part of their data by a platform data manager and could create an income either via connected objects, or via platforms, for a category of data and a specific purpose;
  2. 2) this consent would be contained in a license agreement for the categorical exploitation of data for a specific purpose in a blockchain15 that allows for data security and integrity.

This use of the cyber-consumer’s personal data meets GDPR criteria, i.e. categorical and limited in time and quantity.

This could be valid for any cyber-consumer but also open to any company working on Mega Data16. A (declare system what you use) DWYU17 could be imagined. This required consent should be explicit. In concrete terms, one could imagine that the cyber-consumer would go to a data management platform or API of a data management company, where they would register with their personal data. This platform would be a management center for the exploitation of personal data. The cyber-consumer would then receive a request for the categorical use of their data on this platform, and they would respond to the request and expressly consent to accept a fair and monetized use of their data;

  1. 3) the platform manager would resell the use of this database to enterprise platforms and/or ISPs and/or GAFAs through a smart contact in the blockchain. From then on the purpose and category of data would be locked up and encrypted by the blockchain;
  2. 4) the platforms, FAI and GAFA, would pay a percentage to the cyber-consumer for the exploitation of the data category according to the declared purpose;
  3. 5) the manager of the data platform would receive an income through micro-payments based on the use value of the data category;
  4. 6) the data would be stored on the platform which would become its data broker;
  5. 7) a payment by fair use PPLU18 (pay per loyal use for what you declare you use) would be introduced. The control of the use of the data would be the CNIL’s responsibility. Any illegal and unfair use, of which the cyber-consumer would be informed by an intelligent alert system, would result in the suspension or withdrawal by the cyber-consumer of the selective exploitation of their data on the platform or API.

There should be an equal correspondence between the DWYU list and the PPLU list, which can be controlled by the CNIL in order to respect the rights of the cyber-consumer who creates data. The CNIL would remain the authority to impose sanctions in the event of exceeding the categorical exploitation that does not comply with the declared purpose.

The latter system is relatively easy to set up because it is based on an existing administrative authority, the CNIL and current mechanisms. It is part of the data production chain, respecting all the actors involved. It is in line with the new GDPR through the use of expressed consent and ratifies the usus (use) and (abusus) abuse of personal data made by Articles 17 and 20 in particular.

14.3.2.3. Concrete models for reselling personal data in France

Several companies have already invented systems for monetizing personal data with a reversion to the cyber-consumer.

Virtuous models:

Zerotrace (https://www.zerotrace.fr/) is a Toulouse-based start-up that monetizes photo privacy by asking individuals for the privacy threshold they want. Users decide who can read and see their information, and then choose a partner who can create advertising content that will be seen by unauthorized third parties by hiding the original photo. The photo is immediately encrypted and the user can distribute it securely according to their privacy level. They receive a micro-income shared between the partner they have chosen, which can be a charity, and also themselves.

Confidentiality is assured, the business model is virtuous and everyone wins.

MyCo.coop (https://www.myco.coop) is the first cooperative of Internet users that pays the Internet user. Navigation is private because it is invisible. The browser, myCo, allows you to have a secure email address with an encrypted message exchange system. The user’s identity is therefore not revealed. The browser also gives the user the ability to manage projects between friends or professional relations, or to participate in tests and quizzes that allow the user to earn myCoins. As soon as a person registers, they become a member of the cooperative and receive a remuneration up to the value created by the cooperative in which they participate. Ultimately, the user can deposit this money into their account or reinvest it in the MyCo community to finance private or public projects.

Business models:

Business models use data from the web to analyze them and provide services to the market sector.

Flux vision (https://www.orange-business.com/fr/produits/flux-vision) is a project launched by the telephone and Internet operator Orange working on presence or mobility data that make it possible to know how many people pass through a given commercial area and their frequency of passage according to gender profiles and shopping baskets.

To date, the sectors concerned are mainly banks, product manufacturers and local authorities.

14.4. Conclusion

The GDPR is one of the cyber-consumer’s legal tools, which restores, slightly, the balance between Internet operators and the consumer. This is a step forward, as it confirms the cyber-consumer’s rights of access, information, rectification, limitation, opposition and deletion.

It brings new rights, in particular the right to data portability and the right to take legal action against the non-transparent use of their data.

According to a study conducted by Pegasystems, 96% of French cyber-consumers19 are determined to ask companies about the data they hold.

The cyber-consumer data economy must be oriented toward the exploitation of cyber-consumer data, and thus of the cyber-consumer themself. The cyber-consumer is no longer simply a potential buyer; with digital tools they become a prescriber and a potential seller. Connected objects, the increasing accessibility to the Internet and the volumes of data transferred reinforce nomadism and hyperconnection. The cyber-consumer becomes a sales force because of the different communities to which they belong. We must therefore listen to them.

On the corporate side, if they still have fears or even misunderstandings about the GDPR, it is now essential that the cyber-consumers understand it as an asset in terms of customer relations. It is important to restore trust through data confidentiality and the GDPR through the introduction of technical, organizational and legal measures to restore this eroded trust.

We must, therefore, listen to the cyber-consumer, and without entering into a panoptic society of targeted, paralyzing recommendation, leaving no more opportunities for choice, we must introduce more services and more humanity to support the cyber-consumer’s choices. CRM must, therefore, evolve from customer relations for the company to a relationship of trust with the consumer, and from CRM to trust management based on GDPR tools: consent, rights, information and portability among others.

Companies must think beyond the next 3 years. The customer must be seen as a trusted actor where the sum of their data, analyzed and aggregated, will make them an essential actor for brands to innovate and sell. The indications to be taken into account should not be based on emotion alone, as many brands tend to believe, as the consumer is not just an emotional being. The cyber-consumer changes and becomes an ethical being where non-monetary considerations come into play.

For brands, therefore, it is necessary to consider the cyber-consumer as a trusted third party who can contribute to the improvement of the product, taking into account their experience and their commercial and ethical expectations. The measurement of brand satisfaction must join the BIB: the French gross domestic happiness index launched by the OECD in 2011 [OEC 11].

On the basis of the criteria of the 2006 [BOA 06] OCED study, brands must therefore integrate the following concepts into their deployment strategy:

  • – the autonomy of the cyber-consumer: it is therefore necessary to support them with personalized services when the products are complex and to make the products compliant with the protection of privacy from the product design stage (Article 25 of the GDPR);
  • – personal service by offering training, support in getting started, webinars, user seminars, sharing experiences, etc.;
  • – equity between cyber-consumers by creating the same conditions of access and use between men and women and between wealthy and less wealthy cyberconsumers;
  • – the relationship with the cyber-consumer should be based on a private community sharing information related to the product and the company.

Let us become more human and use this “auxiliary intelligence” that will help humanity, as Joël de Rosnay [ROS 18] describes it, to be more human.

14.5. References

[BOA 06] BOARINI R., JOHANSSON Å., MIRA D’ERCOLE M., “Les indicateurs alternatifs du bien-être”, OECD, Cahiers statistiques, no. 11, 2006.

[NDI 17] N’DIAYE M., “Les marques devront-elles se passer des cookies?”, Les Échos, September 26, 2017.

[OEC 11] OECD, Des politiques meilleures pour une vie meilleure, Report, May 24–25, 2011.

[ROS 18] DE ROSNAY J., La symphonie du vivant: Comment l’épigénétique va changer votre vie, Les liens qui libèrent, Paris, 2018.

[UNT 18] UNTERSINGER M., “Facebook: Après Cambridge Analytica, les annonces en trompe-l’œil”, Le Monde, available at: https://www.lemonde.fr/pixels/article/2018/03/28/vie-privee-apres-cambridge-analytica-les-annonces-en-trompe-l-il-de-facebook_5277694_4408996.html, 2018.

[WAE 18] WAELBROECK P., “Données personnelles, le temps de la defiance!”, Les Échos, January 9, 2018.

Chapter written by Isabelle LANDREAU.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset