Evaluating the EC Private Data Sharing Principles: Setting a Mantra for Artificial Intelligence Nirvana?

44

On the B2B data sharing, the underlying goal is to “ensure fair markets for IoT objects and for products and services relying on data created by such objects.”

45

When looking at the results of the Synopsis Report Consultation on “Building a European Data Economy”, [45] it is interesting to note that a considerable majority of the stakeholders were against any kind regulatory intervention because in their view, some of the data access issues set out in the Communication may result from the normal dynamic of an emerging market, rather than from a market failure. [46]

46

The question is why the Commission proposes this set of principles under the above-mentioned goal. Even though there is no clear evidence of a market failure, as recent economic studies have pointed out, it is not less true that we are in an ecosystem with a predominant presence of (traditional) data “silos”. [47]

47

For IoT and AI markets to emerge and consolidate in the European Union, we need a data sharing ecosystem. It is to the setting of such ecosystems that the Commission is proposing these five guiding principles. It also needs to be clearly stated that when considering IoT (and AI applications as an extension of IoT), we are talking about several markets, thus “markets for IoT objects and market for products and services relying on data created by such objects.” [48]

48

To help to understand this previous statement, it is crucial to understand what an IoT ecosystem consists of:

49

First, IoT objects do not “create” data but rather “collect” or “collect and act on” data. These objects are a different set of elements which constitute the first building block of an IoT platform. Those devices are part of the so-called physical layer, the hardware, the “thing”. These sensors, actuators and devices collect data from the environment or perform actions in the environment. They need certain computing power, electric power, cooling, memory, sometimes a special footprint, multimedia support, and connectivity. However, they do not work alone, they are part of an ecosystem - the platform. Accordingly, the electronic utility that measures physical properties, the sensor, sends collected data to an aggregator in a cloud that transforms groups of “raw data” into “intermediate data.” To get to the cloud, the sensor can be connected through a variety of methods including: cellular, satellite, WIFI, Bluetooth, low-power wide-area networks (LPWAN) or connecting directly to the internet via ethernet. Once the data gets to the cloud, software performs some kind of processing and then might decide to perform an action that goes back to the user.

50

Second, data management of IoT data is different from traditional data management systems. In traditional systems, data management handle the storage, retrieval, and update of elementary data items, records and files. In the context of IoT, data management systems must summarize data online while providing storage, logging, and auditing facilities for offline analysis. [49] Pattern recognition and data mining techniques can be used for the multitude of IoT applications and produce datasets, that, simply put could be useful for self-improvement of the IoT sensor itself, as well as for the development of new products, byproducts or services that might have no correlation with the initial aim for which data was collected in the first place, as illustrated in the figure below. For instance, data generated by location sensors could potentially be used by publishers to understand and reach a precise local audience or give local context to end-users.



Fig. 1: IoT data management framework  [50]

51

Next, we need to understand what IoT platforms consist of. An IoT platform is what makes IoT happen for the devices, that is, an IoT platform is an integrated service that offers the necessary tools to bring physical objects online. Trying to make it as simple as possible, and depending on the tools it provides, an IoT platform can be classified as:

52

Nonetheless, each of the IoT platforms listed above can provide very different byproducts, solutions and uses, completely different from a vertical perspective; from smart systems, such as Salesforce, which is connected to Microsoft Outlook, an Oracle Database and various sales phone systems. In this case, instead of having multiple places to sort through data, a custom designed dashboard can bring in all of this data into a single pane view. This IoT platform allows correlations discovering and process elimination of inefficiencies. Another type of IoT vertical platform is an industrial IoT, normally used by manufacturers, energy or healthcare, because it integrates Big Data, Machine-to-Machine (M2M) communication, machine learning, smart equipment or robots, and an array of sensors into optimizing processes within a system. Last but not least, if we consider Echo Amazon (popularly known as Alexa), this technology includes particular capabilities that have even prompted Apple’s founder to describe Alexa as the next big IoT platform. [52] We could endlessly continue as there are IoT platforms of every shape and size. There are platforms for specific industries like commercial real estate and family health. Some focus on one type of device; for example, there are platforms focused on augmented-reality headsets, whilst some are focused on a particular function, like manufacturing. [53] There are even IoT platforms for pets. [54]

53

Also, from a single dataset perspective, a data marketplace is a platform on which datasets can be offered and accessed. [55] Often cited examples are the Microsoft Azure Marketplace, Xignite, Gnip, AggData, or Cvedia. Data that are being offered may be static archives or online streams of new data. Different modes of access may be offered; for instance, whole repositories, APIs or subscriptions. These are called “data products” as well, where the estimation of the value of such datasets is a continuous challenge. [56]

54

Finally, the latest reports on IoT platforms vendors alone in the global market, reveal that their number reached a new record in 2017, reaching 450 - a 25% increase compared to the 360 of the previous year. [57] Most of the increase occurred in the industrial and manufacturing sectors with more than half of the vendors headquartered in the US; the IoT analytics’ report also shows that more than 30 vendors included in 2016 have ceased to exist in 2017, they have either gone out of business or been acquired by others. Furthermore, if we search Crunchbase [58] for venture-funded IoT platforms, we will find well over 100 hits. This list does not include bigger technology players entering the market with IoT platforms like Microsoft, IBM, and SAP or several industrial companies with similar aspirations like GE, Bosch, and Siemens.

55

In view of this wide-ranging array of horizontal and vertical potential markets for IoT, ranging from hardware, software, connectivity and storage to humans using the information created from data analysis in order to make better decisions. In an ecosystem where IoT platforms are the essential element, collaboration by means of data sharing is more important than ever before. When businesses share data, it is usually for mutual benefit, determined by commercial negotiation and agreed contract terms. But as the study “Cross-Cutting Business Models for IoT” shows, in the IoT scenario, one step further than traditional cooperation, such as the application of an open business model, where data sharing is fundamental, will be key. [59]

56

These principles might constitute a good first step towards enabling adequate market conditions for both IoT and AI markets and for the creation of B2B platforms.

57

Overall these principles may be seen as too simplistic, but one cannot lose sight that they are framed in a Communication and that its accompanying document makes clear that “model contract terms for different types of data sharing agreements and for some sectors or types of data sharing are already being developed.” [60] The measure comes originally from the Telecommunications Sector. In particular, on page 42 of the “Annex to the Commission Implementing Decision on the adoption of the work program for 2018 and on the financing of Connecting Europe Facility (CEF)”. [61] We should not forget that the telecommunications sector has already faced very similar problems regarding giving access and re-using closed data and it may be worth looking at them for useful or inspiring solutions.

58

The Connecting Europe Facility (CEF) in Telecom [62] is a key EU instrument to facilitate cross-border interaction between public administrations, businesses and citizens, by deploying digital service infrastructures (DSIs) and broadband networks. If recalling what IoT platforms consist of, as explained above, the establishment of a Core Service Platform (central hubs which enable trans-European connectivity) with a Support Centre for data sharing, to support the knowledge exchange between all actors in the data economy would make sense. The aim of this Support Centre is also to provide practical advice, best practices, and methodologies for both data sharing and data analytics, and it will become operative in early 2019.

59

If looking at the principles in detail, the transparency one might somewhat resemble Article 5 of the Unfair Terms in Consumer Contracts Directive (UTD). [63] Yet, it is important to recall that B2B relationships have long been underpinned by freedom of contract and distinguished from B2C relationships which are heavily regulated. For instance, the European Commission’s Green Paper which looked into B2B relationships in the sector of food supply chain, [64] described freedom of contract as a “cornerstone of any B2B relationship in the market economy”; [65] consequently, parties should be able to design a contract that best suit their needs. Nonetheless, this well-established legal principle is increasingly questioned in recent times due to a lack of bargaining position of one of the parties to negotiate the terms on which they trade datasets.

60

Transparency is a precondition for fairness and good faith. In that sense, it might be worth looking at what the European Court of Justice (ECJ) has ruled on Article 3(1) of the UTD and its unfairness test. Because although the Directive applies exclusively to B2C relationships, the ECJ has applied this unfairness test to some B2B transactions. The UTD defines unfairness by resorting to broadly formulated standards of good faith and significant imbalance. The ECJ has stated in both Invitel and VB Pénzügyi that it is up to the national courts to adjudicate whether such “significant imbalance” exists in view of the respective contract term and all other terms, based on the applicable contract rules of the national law of the Member State. [66] Therefore, national rules must construe the benchmark for finding whether a contractual term causes a “significant imbalance” and is “contrary to good faith”. [67]

61

At the European level [68] recent legislative proposals have agreed that B2B relationships are not to be completely left for the parties to determine, but that the weaker party, often an SME, should be given certain legal protection in a way that cannot be displaced or agreed otherwise between the parties. Declarations made by Elżbieta Bieńkowska, Commissioner for Internal Market, Industry, Entrepreneurship and SMEs, on April 24, 2018 follow this line of thinking: "We want to prevent the fragmentation of the Single Market through a patchwork of national rules. Today, the Commission is coming forward with an approach that will give EU businesses – particularly smaller ones – the transparency and redress mechanisms that will help them embrace the digital economy. It also gives platforms legal certainty." Moreover, as explained in previous sections in the PSD2 Directive, there is an example where an SME is treated as a consumer in a B2B relationship with regards to transparency of conditions and information requirements for payment services. [69] All the above builds on the studies and consultations related to data ownership and data sharing. [70]

62

In the Guide, the principle of transparency is linked to clearly expressing who has access to the datasets, what type of datasets are given access to and to what level of detail, and also for what purpose(s) is access and/or use license, all key to gain trust among parties. Whether this could also be a matter of unfairness, the truth is that to be able to identify who has been given access to datasets is essential to either determine any kind of liability for accuracy or completeness problems, damages arising from further connections, or use of the dataset by machines, devices, data user or third parties. But also, for determining liability in case of unlawful disclosure of trade secrets. Tentatively, a transparency principle could potentially help to assess a refusal to license situation as the more information provided in the contract on the datasets, the easier it could be to evaluate datasets substitutivity.

63

Similar reasons fall under the shared value creation principle and respect for each other’s interests. The assurance of undistorted competition is limited to the exchange of commercially sensitive data. This could suggest a reassurance of the protection of trade secrets and protecting against tampering in particular. Both were flagged in the Synopsis Report as two core fears for B2B relationships not to share information as well as why business partners in joint projects are sometimes not allowed to receive data. [71] Also, if we look at the relationship between suppliers and an end producer, a contractual principle advocating undistorted competition could fit. Let us consider the Block Exemption Regulation in the Motor Vehicle Sector for the repair and maintenance of motor vehicles and for the supply of spare parts. [72] The treatment of data on the functioning of the vehicle between the supplier of part and the manufacturer of the vehicle is not regulated within the block exemption. Accordingly, there is the risk that the vehicle’s manufacturer could implement contractual terms on data treatment concerning the parts that would place the supplier at a disadvantaged position.

64

More complicated at first glance is the last principle, namely, (to) minimize data lock-in by enabling data portability. Arguments supporting it are to be framed under two paradigms: on the one hand, the need to train artificial intelligence applications to boost innovation; [73] and on the other hand, the need to develop open, technical standards to foster interoperability (enabling data portability). [74] Both combined would ultimately improve Europe’s competitiveness in the international dimension.

65

An example of a data-sharing platform that illustrates the above is the joint venture of the three German car manufacturers, Daimler, BMW and Audi. They acquired Nokia’s digital map HERE [75] in 2015 as an important element of their systems for autonomous driving; in 2017, Intel bought 15% of HERE, and last April 2018, Bosch acquired 5%. There are other strategic partners such as Pioneer, Esri, DJI, NVIDIA, or Oracle and it is feasible to become a partner. The data produced by HERE are shared and simultaneously used by the partners, not only for systems of autonomous driving, but for other mobility sectors such as: transportation; logistics, publishers and advertising; improvement of cities infrastructures; and secure payment services, just to name a few. [76]

66

Other examples are Automotive Grade Linux (AGL) and Mobilityxlab, which are heading in a similar direction. [77] The former is a collaborative open source project aiming at bringing together car manufacturers, suppliers and technology companies to build a Linux-based, open software platform for automotive applications that can serve as the de facto industry standard. Its underlying idea is that adopting a shared platform across the industry will reduce fragmentation and allow car manufacturers and suppliers to reuse the same code base and same data-format, leading to innovation and faster time-to-market for new products. The latter, Mobilityxlab, is a coalition of leading Swedish firms that cooperate with startups to develop joint projects for solutions to the transport of the future, primarily to multiply the use of AI in the areas of electrification, connectivity and self-driving vehicles. [78]

67

Yet, discussing interoperability in the context of data portability or Art. 20 General Data Protection Regulation (GDPR) [79] still raises a number of controversial issues. On the one hand, the lack of obligations for interoperability in Art. 20 could have detrimental effects on users. For instance, the lack of interoperability and compatibility requirements could lead to a race to the “lowest common denominator” of standard datasets provided by data controllers. Adoption of universal requirements to interoperate with all other services would be expensive for companies with uncertain benefits for most users and such a burden would fall disproportionately on start-ups and SMEs, who would have to enter the market with systems in place to interoperate with all other systems already on the market. [80] Eventually, where competing services would need to have common features and functions, it would result in less variety and feature competition, also reducing consumer choice and finally reducing innovation. [81] Additionally, as a Joint Research Center’s report indicates, many of the economic results supporting that a welfare-maximizing policy maker would prefer interoperable services in both traditional and platform markets, have been extracted from analyses that do not take data considerations explicitly. Therefore, more economic research is necessary to launch definitive conclusions. [82]

68

All in all, there are quite a lot of incentives for the private sector to follow, or at least to not disregard these set of guiding principles. Under these conditions, and as both scholars and industry operators have tabled over the last years in their dialogues and consultations with the Commission, it seems the approach taken finally goes towards “(regulating) self-regulation”, borrowing Prof. Dr. Hilty’s pun. [83]

69

It is not the intention of this analysis to compare a public policy tool such as the principles contained in the Commission’s communication “Towards a Common European Data Space” with a regulatory tool such as competition law. Yet, some reflections are necessary here for two reasons.

70

First, the results of the public consultation on “Building a European Data Economy” showed that a majority of stakeholders where satisfied with the effectiveness of competition law and its enforcement in addressing potentially anticompetitive behavior of companies holding or using data. [84] Yet, several respondents pointed to the difficulties that the concept of “data sharing” could pose on competition law, as well as that stakeholders believed that competition law should evolve in order to adapt to the digital economy and duly account for the reality of data-driven markets.

71

Also, some scholars have pointed out that access to data is a disputed topic under general competition law. [85] As this contribution looks at data sharing, the paper circumscribes to the example of refusal to license access to datasets. It is article 102 TFEU, which bans the misuse of a dominant position by one or more undertakings. The CJEU has ruled that this provision may be used for the granting of compulsory licenses (even) to information protected by intellectual property rights. [86]

72

Compulsory licensing for data access is a topic that has also been discussed in reference to sector specific regulations such as the PSI Directive, [87] the eCall Regulation [88] and in the field of financial services, [89] or in reference to e-platforms. [90] What all these ex ante sectorial regulations and proposals have in common, is that they imply an obligation either to share the data or to grant open access to the data collecting device.

73

For a unilateral refusal to license access to datasets that are found to be in violation of Art. 102, the following considerations are to be considered.

74

For starters, the definition of the relevant market plays a central role in all three areas competition law regulates. To determine abuse of a dominant position, it is important to determine whether a company has a dominant position in the first place. And to that end, the market on which it occupies that dominant position must be established. In 1997, the European Commission published a notice on the definition of relevant markets for the purposes of EU competition law. [91] Accordingly, the market definition is composed of the relevant product market and the relevant geographic market. Ever since, the Commission has continuously “commissioned” reports or launched consultations on market definition in different sectors such as the media (1997), pharmaceutical (2009), telecoms (2002), etc. [92] However, the application of competition law in general, and the definition of the relevant market in particular, are inherently case-specific. For example, while assessing merger control involves a prospective analysis, application of Art. 102 (and 101) TFEU look into past behavior.

75

Second, when looking at the current practice on refusals to deal and to license as a guide, [93] there is one difficult obstacle to overcome when considering datasets. Data is a non-rivalrous resource; if datasets could be substitutable, meaning the same individual data could be found in various datasets, this would count against the requirement of dominance. Thus, a refusal to deal or to license would not prosper.

76

Finally, if we consider dataset negotiations for analytics involving techniques of data mining by searching datasets for correlations necessary to improve algorithms of artificial intelligence applications, contractual agreements on access to datasets may simply fail because of asymmetries regarding the value of the datasets, not because of anti-competitive conduct. [94] This could also be the case with IoT platforms.

77

Therefore, Art. 102 may not be readily applicable to provide access to datasets per se, except when those datasets are indispensable to access an industry, or a relevant market and parties are not able to agree on price. [95]

78

All in all, in such an emerging market sector as the IoT platforms, with so many players and different niches, abuse of a dominant position and refusals to grant access to data might be very problematic to articulate.

79

Thus, relying on competition law as the only regulatory tool, might not be the smartest move. On the other hand, following the results of the consultation launched in 2017, the idea of setting the ground via recommending standard contract terms was generally preferred to the proposal of legislating laying down non-mandatory rules for B2B contracts. [96] Thus, the idea proposed by the Commission to test ex-ante measures in the field of contractual relations may be beneficial towards supporting fair markets for IoT products, byproducts and services.

83

From a business-to-government perspective, the question would be how to find a way that private companies would share and open their private datasets to public bodies to support AI development, not only for matters of public interest but for innovation. [98] In addition to that, such openness would need to be in a way that privacy of individuals is respected and guaranteed. And if this would be possible, how to set the conditions for collaborating without harming the legitimate interests of businesses, while also mitigating potential limitations of private sector data.

84

Three of the principles proposed by the Commission, namely “do no harm”, conditions for data re-use, and mitigation of limitation of private sector data, show that there is a clear understanding that pursuing a public good is not a sufficient driver to incentivize data sharing for innovation. Businesses are profit driven. They share data typically by selling integrated analytics services, and they can provide different levels of access under different business models. From this perspective, these principles aim to create incentives for the private sector by either securing monetization, compensation, or by lowering costs:

85

If these principles would turn into a legislative proposal, it would be critical not to lose sight of how to develop incentive mechanisms. This would comprise an assessment on the legal, economic and technical obstacles preventing B2G data sharing, and advise on concrete actions to promote B2G data sharing for public interest purposes.

86

Beyond that, there are many questions left open, such as whether private data shared with public bodies could become open data, and if so, which and to what extent, or whether it could be re-used for official statistics. The good news is that the Directive on the Re-Use of Public Sector Information is currently under review, and some of its objectives are aligned with these proposed guiding principles. In particular, addressing the risk of excessive first-mover advantage by requiring a more transparent process for the establishment of public-private arrangements by:

87

The bad news is that we do not know how the PSI Directive would move forward, nor whether these principles would have any impact at all. In the meantime, besides giving these B2G principles an overall weak evaluation, we would need to see whether the Commission moves relatively quickly on developing this strategy.

88

The famous quote by Walsh and Pollock: “the coolest thing with your data will be done by someone else” comes in handy here. Government agencies or researchers make use of private company data to address societal issues. As the Communication points out, statistical offices in some EU Member States use data from mobile telecom operators as an alternative source for official statistics, for instance on mobility or demography. [100] Nonetheless, a private telecom company such as Vodafone offers packaged services to public bodies based on the mobility data gathered by their antennas. In developing countries, they offer their data services as an alternative to poor-quality official statistics, and their main incentive lies in corporate image and the potential indirect business benefits. [101] These exact same datasets have proved an invaluable source for controlling outbreaks, surveilling and modeling of infectious diseases. [102]

89

Symmetrically, as explained previously, the re-use of (certain) public sector information by private companies is regulated by the PSI and in force since December 2003. [103] The evolving approach of this Directive is to overcome the resistance among public bodies in Member States to make public data more accessible to the private sector, obviously safeguarding the fundamental right of privacy and personal data protection of individual citizens.

90

There are other examples in the acquis where access to information is promoted by specific legislative means based on the nature of the information. For instance, scientific information is often controlled by academic publishers who tend to seek exclusive licenses for digital management of such information (publications), while public institutions tend to promote open-access systems. The Commission Recommendation of 17 July 2012 on access to and preservation of scientific information [104] provides a set of tools to ensure incentives so that businesses benefit as well as society and ultimately promote the use of open-access systems.

91

Yet, when considering public interest, some comments are deemed necessary.

92

First, the Commission’s proportionality principle reiterates that the public interest reason for requesting data should be clearly and demonstrably justified. It shows a clear intention of an enhanced public interest reason; for example, to give an extra assurance to private companies when handing over their private data. There are examples in the European acquis, such as the processing of data for archiving, scientific or historical research or statistical purposes, and safeguarded by the GDPR. [105] In the field of patent law for instance, the EU Regulation on compulsory licensing of patents for the manufacture of pharmaceutical products for export to countries with public health problems outside the EU, where access to the patent information shall be given to others against a fee, [106] or in the case of law enforcement and national security. [107]

93

The question in the case of these principles comes with their legal status. If they are a non-binding instrument, how can a request to supply private data based on (enhanced or not) public interest be enforced? It looks good on paper, but there are no instruments that allow this principle to actually operate.

94

Second, can the fundamental right of privacy be overridden by public interest? And if so, how would this affect a provision of private data by a company to a public body in the context of these principles?

95

These questions arise after a ruling by the Court of Justice of the EU in 2017, related to the Universal Services Directive and telephone guides data, Tele2 (Netherlands) and Others. [108] European Directory Assistance (EDA) is a Belgian company offering directory enquiry services and directories accessible from the Belgian territory. EDA requested the companies which assign telephone numbers to subscribers in the Netherlands (namely, Tele2, Ziggo and Vodafone Libertel) to make available to EDA data relating to their subscribers, relying on an obligation provided for under Dutch law, which is itself the transposition of Article 25(2) of the European Universal Service Directive. [109]

96

The Court was asked whether an undertaking is required to make data relating to its subscribers available to a provider of directory enquiry services and directories established in another Member State; and whether it is necessary to leave the subscribers with the choice of whether to give their consent or not depending on the country in which the undertaking requesting that data provides its services. To the first question, the CJEU declared that the Universal Service Directive covers all requests made by an undertaking established in a Member State other than that in which the undertakings which assign telephone numbers to subscribers are established. To the second question, the Court confirmed that the passing of the same data to another undertaking intending to publish a public directory did not require the subscriber’s “renewed consent”.

97

It is undeniable that data held by private companies can be invaluable for addressing social issues. They are not a low hanging fruit: they require substantial investment and a degree of direct involvement for the supplier of the datasets. Thus, a mandatory data sharing measure without contemplating returns on investment could put in jeopardy the emerging data driven economy as well as the development of artificial intelligence. Each ecosystem is building its own set of business models and organizational arrangements to fit their particular system of incentives, thus for a B2G data sharing relationship to maximize, this should be the way too. And last but not least, as regards to the information contained in private data, or better said, private datasets, a distinction between which are in the public interest and which are only of commercial interest is very difficult to make. To overcome this highly challenging task, the principles proposed by the Commission try to set a framework where the supply of private datasets should be mutually beneficial and proportionately compensated to the supplier. The use of words and expressions such as “proportionality”, “purpose limitation”, “clear and demonstrable public interest”, “do no harm”, “mitigate limitations of private data”, clearly suggest the Commission’s goal is to build on trust while creating business incentives to foster this kind of data flow. To take into account the investment in data collection or adaptation that would be necessary before any private dataset could be supplied and used by public bodies (conversion into relevant formats, anonymization of personal data or confidential business information) while allowing companies to keep on monetizing the insights derived from the datasets provided to public bodies with respect to third parties.

98

In this scenario there is no “silver bullet” to ensure a boost of Europe’s technology and the democratization of AI technology. It is a matter of setting the right policy mix of raising awareness among the market players and providing information and guidance about options, modalities and building trust to remove fears. In this sense, the set of principles as such, without any further enforcement measures and the articulation of real incentive mechanisms, would amount to a quite a naïve proposition.