by Kevin Chen (J.D. 2022)
The data we generate every day is not our own.[1] Data brokers like Spokeo and PeekYou as well as companies like Datalogix and Equifax collect and own that data.[2] However, data collection companies sometimes fail to properly handle our data, resulting in data breaches or improper sales to scamming companies.[3]
With the need to better protect Americans’ data, Democratic presidential candidate Andrew Yang has proposed a policy he has named “Data as a Property Right.”[4] This policy grants citizens ownership of their own data, with “certain rights conveyed that will allow them to know how it’s used and protect it.”[5] Yang has listed seven rights:
- The right to be informed as to what data will be collected, and how it will be used
- The right to be informed if ownership of your data changes hands
- The right to be told if a website has data on you, and what that data is
- The right to download all data in a standardized format to port to another platform
- The right to be informed of any data breaches including your information in a timely manner
- The right to opt out of data collection or sharing
- The right to be forgotten; to have all data related to you deleted upon request.[6]
As proposed, these rights may be voluntarily waived, and an individual’s data could be shared with companies for their benefit and the individual’s convenience. However, a portion of the economic value derived from the individual’s data would be returned to the user by companies that obtain the data.[7]
Because data fuels much of the revenue for companies that rely on an advertising rather than subscription model, there is concern for the logistical and economic ramifications of regarding data as property. For example, privacy expert Jim Harper describes property rights for data as a forced market rather than a free market, which he alleges would be difficult to administer despite its ideal empowerment of consumers.[8] Public Utility Research Center Director Mark Jamison points out that platforms often compensate users with discounted prices for online activities that help acquire data.[9] Thus, his concern is that if data became a property right, prices for online services would rise, and online experiences would decline in quality because platforms could not provide services that target individual interests.[10]
To evaluate these concerns, the federal government should pay attention to a few similar laws within and outside of the United States: the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR).[11] The CCPA’s regulations were publicly released on October 10, 2019 but will be implemented on January 1, 2020.[12] It includes the right to be notified about which data will be collected, how that data is being collected and used, and whether and to whom it is disclosed or sold (similar to Yang’s first, second, and third rights).[13] It also has the right to opt-out, identical to Yang’s sixth right, and the right to erase, similar to Yang’s seventh right.[14] Some of CCPA’s remaining consumer rights will be the right to “look back” on records of personal information collected for the previous year, the right to equal service and price (prohibiting unreasonable differing of prices based on data), and special protection to minors.[15]
The GDPR was passed in 2015 and fully enforced throughout the European Union in May 2018.[16] The data subject rights the GDPR affords include breach notification, right to understand data collection, right to be forgotten, and data portability, which are similar to Yang’s proposed rights 1, 4, 5, and 7.[17] While the CCPA and GDPR serve to update the landscape of data privacy and do not create property rights, some of their aspects do resemble traditional property concepts such as possession, use, and exclusion.[18]
Yang is the only candidate who has proclaimed such new ambitions for empowering consumer data rights. Critics may thus reasonably be skittish of the novel proposal’s unintended consequences. However, it is evident after examining the CCPA and GDPR that the only truly unprecedented aspect of the proposal is for data rights to be sold as a commodity by consumers to companies. Yang’s policy would have substantial trial runs through the CCPA, which impacts the technological advancements of Silicon Valley and the entire European Union. Therefore, only the right of disposition, selling the data to companies by individuals, is truly a theoretical question without any precedent; supporters and critics alike will be able to observe the benefits and drawbacks of rights 1–7 via the CCPA and GDPR in the coming years.
[1] See Jeff Desjardins, How Much Data Is Generated Each Day?, World Economic Forum (Apr. 17, 2019), https://www.weforum.org/agenda/2019/04/how-much-data-is-generated-each-day-cf4bddf29f/ [https://perma.cc/965V-3CQD].
[2] Louise Matsakis, The WIRED Guide to Your Personal Data (and Who Is Using It), Wired (Feb. 15, 2019, 7:00 AM), https://www.wired.com/story/wired-guide-personal-data-collection/ [https://perma.cc/M689-V6YT]; Yael Grauer, What Are ‘Data Brokers,’ and Why Are They Scooping Up Information About You?, Vice (Mar. 27, 2018, 7:00 AM), https://www.vice.com/en_us/article/bjpx3w/what-are-data-brokers-and-how-to-stop-my-private-data-collection [https://perma.cc/42KV-YKYM].
[3] See, e.g., Ines Gutzmer, Equifax Announces Cybersecurity Incident Involving Consumer Information, Equifax (Sep. 07, 2017), https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 [https://perma.cc/HNU4-UXEX]; FTC Charges Data Brokers with Helping Scammer Take More than $7 Million from Consumers’ Accounts, Federal Trade Commission (Aug. 12, 2015) https://www.ftc.gov/news-events/press-releases/2015/08/ftc-charges-data-brokers-helping-scammer-take-more-7-million [https://perma.cc/39GY-VMQD].
[4] Data as a Property Right, Friends of Andrew Yang, https://www.yang2020.com/policies/data-property-right/ [https://perma.cc/BB6G-MCML] (last visited Nov. 25, 2019).
[5] Id.
[6] Id.
[7] Id.
[8] Jim Harper, Perspectives on Property Rights in Data, American Enterprise Institute (Aug. 8, 2019), https://www.aei.org/technology-and-innovation/perspectives-on-property-rights-in-data/ [https://perma.cc/U3RU-SR43].
[9] Mark Jamison, 3 Myths about Online Data Property, American Enterprise Institute (Jul. 25, 2019), https://www.aei.org/technology-and-innovation/three-myths-about-online-data-property/ [https://perma.cc/XC7V-8YRM].
[10] Id.
[11] Cal. Civ. Code §§ 1798.100–99 (West 2019); Regulation (EU) 2016/679, of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 1 [hereinafter GDPR].
[12] Attorney General Becerra Publicly Releases Proposed Regulations under the California Consumer Privacy Act, State of California Department of Justice (Oct. 10, 2019), https://oag.ca.gov/news/press-releases/attorney-general-becerra-publicly-releases-proposed-regulations-under-california [https://perma.cc/4H4Q-W42A].
[13] CCPA Compliance The Most In-Depth Guide, Endpoint Protector, https://www.endpointprotector.com/epp/ccpa-compliance-the-most-in-depth-guide [https://perma.cc/6FJ6-N2LH]; See Data as a Property Right, Yang2020.com, https://www.yang2020.com/policies/data-property-right/ [https://perma.cc/74TZ-WKDE].
[14] Id.
[15] Id.
[16] Timeline of Events, EU GDPR, https://www.gdpreu.org/the-regulation/timeline/ [https://perma.cc/LB3W-FEAP].
[17] See The Regulation, EU GDPR, https://www.gdpreu.org/the-regulation/list-of-data-rights/ [https://perma.cc/K9GN-T6GY]; See Data as a Property Right, Yang2020.com, https://www.yang2020.com/policies/data-property-right/ [https://perma.cc/K3ES-8XKD].
[18] See generally Brotherton v. Cleveland, 923 F.2d 477, 481 (6th Cir. 1991) (“The concept of ‘property’ in the law is extremely broad and abstract. The legal definition of ‘property’ most often refers not to a particular physical object, but rather to the legal bundle of rights recognized in that object. Thus, ‘property’ is often conceptualized as a ‘bundle of rights.’ See, e.g., Loretto v. Teleprompter Manhattan CATV Corp., 458 U.S. 419, 435 (1982) (“The ‘bundle of rights’ which have been associated with property include the rights to possess, to use, to exclude, to profit, and to dispose.”).
