Data portability has become a hot topic in competition law. Legislators and enforcement officials around the world have shown increasing interest in data portability as a competition law remedy. Although some commentators have suggested that data portability represents low hanging fruit compared with more complex remedies such as interoperability, the debate about how to implement any such mandate remains underdeveloped.
This paper, available here, argues that data portability is not a panacea, and that enforcement officials will have to engage in the type of nuanced, fact-specific determinations that characterise classic antitrust analysis.
Section 2 points out that not all data are created equal.
To date, discussions have largely treated data as a monolithic phenomenon without drawing any distinctions among particular types of data and their different uses. Although advocacy rhetoric tends to talk about “big” data, the trade press repeatedly emphasises that size is not the only thing that matters. The most famous formulation claims that data consists of three Vs: volume, velocity (rate of change) and variety (differences in type and source). Other commentators have expanded the list, with one consulting firm listing as many as 42 Vs. The multidimensionality of data is clear enough.
A more important distinction is between structured data collected intentionally to inform a specific model – e.g. traditional column-row databases that record different types of data – and unstructured data collected incidentally and used to inform emergent models – e.g. video, audio, photos. Structured and unstructured data serve very different purposes. More importantly for purposes of competition law, structured and unstructured data have different economic characteristics. Empirical studies have shown scale economies with respect to structured data to be modest enough that relatively small competitors should be able to achieve them on their own without needing to gain access to the resources of others. The scale economies for unstructured data are more significant, but often there are numerous alternative sources of data available – as is apparent from the demographic and other information used to create advertising profiles.
Section 3 considers the role of regulatory alternatives.
U.S. law holds that the presence of a regulatory regime through which competitors can obtain access renders the essential facilities doctrine inapposite. In Europe, the situation is clearly different: the recent decision of the German Federal Court Justice in the Facebook case ruled that the presence of related relief under privacy law does not foreclose actions under competition law.
These jurisprudential differences suggest that each regime may accord different effect to the fact that data privacy laws already provide for data portability rights. In the U.S., the existence of a regulatory mechanism for compelling data sharing likely precludes access to data under the antitrust laws. In Europe, it would seem that one could rely on competition law to gain access to data despite there also being alternative regulatory duties requiring that data to be shared. However, the fact that the relevant European privacy law did not cover the precise conduct in question in the German Facebook case does leave some room for a different outcome with respect to data portability.
Section 4 discusses the tension between portability and privacy.
A central concern raised about data sharing is that it may impinge on privacy. One of the cornerstones of U.S. privacy law is notice and consent, under which the parties enter into an agreement as to the permitted uses of any data collected. This makes the enforcement of promises made in privacy policies a matter of contract. While data subjects have sufficient privity of contract with the firm that collects their data in the first instance to have standing to sue them for any breaches of that agreement, that contract does not provide any enforceable rights against third parties that obtain the information through data portability. Thus, exercises of data portability carry some risk of weakening privacy protections.
The same problem arises with respect to the re-identification of data. The most common way to de-anonymise a dataset is by correlating it against an identified dataset. The reliance on contract to protect against de-identification in the US again places data portability in tension with privacy by potentially limiting the data subjects’ rights against firms that use data portability to obtain access to their personal information.
Section 5 reviews implementation challenges.
Mandating data portability under antitrust law would raise significant practical challenges. First, it would require establishing new systems for ordering and provisioning requests for data. A data portability mandate would require firms to establish new systems for ordering and provisioning request for data. Court considering implementing such mandates will need to decide how much metadata will be disclosed. If the data are substantial, the process may take some time and require considerable resources.
Such remedies would probably also mandate data compatibility. To promote competition, the data that is being shared must be compatible. The need for compatibility suggests two natural solutions, both of which have considerable drawbacks. The first is the reconfiguration of the data, most likely by the competitor who requested them. The problem is that enterprise-grade databases are often prohibitively expensive to reconfigure. In addition, any process of conversion or translation runs the risk of introducing errors. The second solution is standardisation. Any form of standardisation of data formats necessarily structures interactions in ways that can limit the functionality of these systems. Requiring that a firm use a particular data structure thus inevitably has a direct impact on innovation.
This is a typically thoughtful piece, which highlights many of the challenges lurking underneath a generic formula such as ‘data sharing’. At the same time, it is very US-centric, which may limit its relevance for other jurisdictions – even if I think the main concerns identified by the author are probably shared across the world.