Intermediating data rights exercises: the role of legal mandates

Data subject rights constitute critical tools for empowerment in the digitized society. There is a growing trend of relying on third parties to facilitate or coordinate the collective exercises of data rights, on behalf of one or more data subjects. This contribution refers to these parties as ‘Data Rights Intermediaries’ (DRIs), ie where an ‘intermediating’ party facilitates or enables the collective exercise of data rights. The exercise of data rights by these DRIs on behalf of the data subjects can only be effectuated with the help of mandates. Data rights mandates are not expressly framed in the GDPR their delineation can be ambiguous. It is important to highlight that data rights are mandatable and this without affecting their inalienability in light of their fundamental rights’ nature. This article argues that contract law and fiduciary duties both have longstanding traditions and robust norms in many jurisdictions, all of which can be explored towards shaping the appropriate environment to regulate data rights mandates in particular. The article concludes that the key in unlocking the full potential of data rights mandates can already be found in existing civil law constructs, whose diversity reveals the need for solidifying the responsibility and accountability of mandated DRIs. The continued adherence to fundamental contract law principles will have to be complemented by a robust framework of institutional safeguards. The need for such safeguards stems from the vulnerable position of data subjects, both vis-à-vis DRIs as well as data controllers. The vicious circle of rapid technological and economic developments, and exponential data production, brings about countless social, legal, and ethical concerns. Many of these concerns can be traced back to the significant information and power asymmetries that characterize today’s political economy of data.1 Transparency asymmetries result from the size and complexity of data infrastructures as well as engineered opaqueness by those who control the infrastructures.2 Power asymmetries result from the ability to exploit these data infrastructures in light of strong (commercial/political) imperatives at the expense of individuals, communities, and/or society at large. Data rights are emerging as an emancipatory legal tool to challenge these asymmetries, empowering people to render visible data infrastructures and govern the use of their data. They feature in a growing number of legal frameworks, in Europe3 and elsewhere.4 Indeed, we can observe a proliferation of data rights in recent EU policymaking, either reinforcing or introducing new legal mechanisms to mitigate information/power asymmetries in the data economy. As (EU) policymakers are gradually catching up with the digital transformation of society, we also anticipate future legal frameworks will increasingly include data rights in specific contexts. For the time being, the most important legal source for data rights is chapter III of the General Data Protection Regulation (GDPR).5 The ‘rights of the data subject’ in this Chapter are intent-agnostic and can be deployed in many different ways in order to safeguard countless interests, rights, or freedoms.6 While underused for many years, recent initiatives have demonstrated the value of data rights in a variety of contexts; from invoking the rights of access, portability and not to be subject to automated decision-making to obtain better working conditions,7 to reverse engineering discriminatory credit scoring algorithms,8 or enabling academic research using digital trace data.9 As these data rights not be as legal significant potential for at a collective the growing and of data rights, important as to their and from the size and complexity of data infrastructures as well as engineered opaqueness by those who control those and data and exercises of data rights. rights the legal, or to their rights. light of the is a growing trend of relying on a third party to facilitate or coordinate the exercises of data rights, on behalf of one or more data subjects. the of this we these parties rights data rights as where an ‘intermediating’ party facilitates or enables the exercise of data rights. for DRIs be from data The of the data is in a variety of to to that on data in one or DRIs not in the exercise of data rights, be the to or data. Data rights in can from to the for to to more initiatives data which an of the parties in data in many of these initiatives is data subjects can the data rights to a third For the of this we use the to to where a data subject to the power to a legal or exercise a on the can data rights be by the data on behalf of one or more data As a key source of data rights, the is about parties can exercise data rights on behalf of the data is to the GDPR data rights to be by an the GDPR the ability of data subjects to have specific of to obtain for GDPR such is in The of such is also in to data where are to the of data subjects or their on the this is also that the of of the that of the GDPR not that a to legal in the of a on for that of the of specific rights of a data by of the of or the of the use of and as the the of data subject rights by chapter III GDPR can be mandated to a As will more this are many different of the both in and in of the legal in different jurisdictions, the of from a significant of use in the recent and EU initiatives have a and increasingly important in a data This article the of this to highlight the of mandates data are to on both the of data and the fundamental of data rights. Data rights are legal to to and control data the most rights can be found in the chapter III in the GDPR data subject rights that can be in a variety of the rights of to to to portability to and not to be subject to automated decision-making While data rights have to data at the is only in the that have more research demonstrated the significant and of data also their light of the of digital in society, these rights will only more not on an more at a collective the the for data rights is the data ie the the and of the data more with the data and with a of the to appropriate and to that their data with the are also to data by and by the and of their data have control of their data. of the key the GDPR is to data The and in the for a data back in to rights control and by the for the exercise of the a already that more control their with concerns and exercises of data subject the GDPR the number and of data rights in chapter also a number of at their The strong not on data subject empowerment not of Indeed, Data Protection of Rights of the the the of as a in to the to for and on the of this new fundamental is with such as and that the to data not have a and a strong for control data as for a data control data can be at the of the to data in the such not be the need for an of control in of data rights, and This both a the ability for data subjects to their a an environment where control data is not by power This is most not the a robust legal framework that the of data by of and a of specific which data subjects to III of the The value of these rights in stems from the that the and growing complexity of for to anticipate all potential and for to the the need for data law to and of data rights and the also the of and of data these the the need to data subject rights as This is increasingly important to a variety of and collective rights, and in a society, from to and to to and enabling this in also the and of data the ability to have parties in the exercise of data rights, is the exercise of data rights significant such as where DRIs not appropriate to or the mandated rights, or by the of the data rights. Chapter III of the GDPR is to the rights of data subjects, in their and these a can be at or the for the exercise of rights and rights for data subjects to For we will on the of data subject rights rights in Chapter III of data subject rights rights in Chapter III about data rights data rights have the of civil society, and the of and the to data rights are more as the of with data or for many different This with data rights, which are more of specific data to and or specific to and not be subject to automated Indeed, these different of data rights is important the which can be Data rights on on data and on specific As the can be to the invoking to be potential for these rights to a This also most DRIs to on rights of on behalf of data subjects. As the data subject rights are value in a society is that power This can be both and For to or that up on the of their There is also a growing number of where data rights are by to obtain more and their from these where data rights are by for their are also where these rights can be for of an who use of to data or by data data rights is to be and to data subjects to data subjects to their data. This can be both by by data as well as data legal, It can and many with data to a data a As the value and of data rights only at data rights can to and and have the of to their data to data are on the rights of and not be subject to automated decision-making in order to working in have rights in order to discriminatory credit scoring that of data rights’ potential can only the on and data rights at can be light of the DRIs are increasingly as a to and and collective exercises of data rights. The need not be to rights and DRIs can also in rights on data or While DRIs can their by the exercise of data rights in a that not on rights at the rights mandates. This will on the of data rights as well as the and data specific those DRIs that the of data rights only will to and as data as also on of their DRIs be to their by the data that is the of data rights is on the of data the collective exercise of data rights to data from one data to or to facilitate a data rights to obtain better and from data in obtain a variety of one important that a more and of for data rights to the of data subjects. on about the of data subjects their This more data rights are a use their to data and as a to mandated data rights to the data subject and mandated can the to the of the The of with the to on all the can not the of a data subject exercise the and for to the and of mandated will also need to be in light of the data that is As an a of data be to the mandated more rights as the to or The to exercise data rights a third party already at the of for data and civil The GDPR on and data rights can be mandated to third party and the Data that data rights rights of the data subject and that data subjects such of data rights on the legal of mandates as tools many jurisdictions, in this we the of data rights from a law both data rights are mandatable and the and that this will the we to at existing law which have framed the of of mandates to different of rights’ The is to and to the appropriate framework which mandates can their in data rights’ full Data rights already legal and traditions that rights’ such as contract law frameworks for order to that data rights their is important to these legal and traditions to data rights’ There are legal in the which rights can be on the and the of to the rights’ exercise and to the appropriate environment which rights can their legal As the for rights to The of legal also to the all of different rights and the in which be in for the exercise of rights are the law in order to or the power at and in more the this can be traced back to the of the the from and the which these be to their For a can be to value to the in Data rights in are as intent-agnostic tools at empowering data subjects in where the of data of their interests, rights, or light of the to facilitate the exercise of these rights, that exercise a be to be to specific or are to a party the rights’ to exercise the rights in to the with the this we an of the and of legal tools that third parties to exercise rights using from will highlight and from that can the of data rights. This at the different is a exercise and in and enabling the of data rights. rights mandates different legal that can be by the rights’ to exercise their is important in such as of a to be from the exercise of a Indeed, in on data rights exercises by third or for we observe the and of the inalienability of data rights is as the challenge and these rights be mandated to a as will rights can be a a of different ways in which rights can be third parties for their The one on the is the exercise of rights by and in the of this As the the rights exercise from the a a rights and in most rights at rights mandates in data rights this will on the of different of exercise of rights The in the of of exercise of rights. of different of exercise of rights The in the of of exercise of rights. rights’ ie a rights’ exercise by will be from of a the of the of a and the of a from one to refers to the where a is not only from the of the and also from the in This is a that the is the of the Rights can be are by the The of a from the legal to the of a as is to the This of a is in as the a is to a the to For a their the an that not the the of a from a for a of not constitute an of the in data rights are They be are to the of the EU of to the a to data with The of the rights enabling the of fundamental rights, with a of in fundamental rights all to the to GDPR data rights by The recent Data by in that rights Regulation (EU) are rights of the data subject and that data subjects such This to the to data not on the different GDPR data rights can be a to power that to to a of exercise of these data rights are most in in or in for a or for for a of time or the of the are subject to the the parties and to the of The for the rights the of the a the and that of the as a ‘rights is the that are for the to the of rights to a the on the the legal of of rights to a data rights’ can only not Data rights are to the data data and are a data rights be can be subject to and legal tools for of rights. The most in this is the of law to data and data This that the of data rights to an party can be specific legal that the data subject to not the data rights’ ie to the without in of a with and There are legal that are in civil law such as the in these to their law It is important to highlight that these legal the data subject of their data in this not render the of data rights, as by one in the GDPR where this is expressly GDPR the to for the of in to the of exercise of these data rights to be in light of the The also that of responsibility can exercise data rights the is to the in their The for the exercise of data rights of the data This be a of a without only the framework of the to a is the for which or are the need for an exercise these data rights for their This is by the Data Protection recent on the exercise of the of to the of the be the in all with to the exercise of the of in the of in where the of is on behalf of the for by the of of the GDPR framework and the of data rights, the that a of on behalf of a can be as of exercise by that can be on a law to the the exercise of the of to data of to of by a third party the data that the GDPR not to the data of The is with by law as for the of data of are already the exercise of rights the to an the exercise of data rights It is important to highlight that the to data and the to these data of all of the of this the to exercise data rights on behalf of a is to either by law on who data rights’ exercise from or are as the rights’ exercise by a party the the of this legal this the of and to mandates of these can be to GDPR data rights mandates of data rights’ The exercise of a can be to a party the rights’ which to exercise the on behalf of the in the of the exercise of a the by the ie the data jurisdictions, mandates are as with specific and mandates are and as the by which one the power to for the and in their are a of rights’ They either as subject to specific or as expressly subject to the contract law For the law a framework that to both and as which one power to for and on their This of to rights as is also by the civil chapter in which can be power of legal for rights to an in the civil in a to expressly that these the of law as as the of the legal or the legal not to this civil law and both and mandates. The such as the one in of the civil are subject to the as the by of the civil also and to and a for relying on that the legal from these are the framework the rights’ exercise can be or by law and/or by for the for in power of This the of a rights in a by the contract the parties and by duties and This of the parties is legal that the and fiduciary and of The is not by the contract also by the legal and which in of in the for in are both a framework and the of the for the mandated party to be a a legal in the of that is to as a mandated for this specific rights GDPR a of the third party that can be mandated by data subjects to exercise a number of rights. As already this expressly that the to a on behalf of data subjects can be mandated to a or which in with or EU enables to exercise a of rights to the data subjects the GDPR specific of already for in and rights in of in the exercise of GDPR rights are a not be by an of the Data which in that rights Regulation (EU) can only be by and be or to a data that this the diversity of GDPR rights and the of their exercise which can only be with the have already that the for GDPR data rights on empowering data subjects in order to their and ‘Data rights’ The exercise of these rights data subject empowerment can power asymmetries which can more be with the mandated in the rights’ The of this to exercise a a mandated only as an an in the of data subjects. is also we the in the of the that rights Regulation (EU) are rights of the data subject and that data subjects such which is in with in mandates of data rights in The GDPR to data subjects in their data rights, in the specific for data rights will be by the of data at ie data rights on on or on specific This is of the and of different data rights. mandates which an the data subject to exercise data rights specific are not The of rights in the of a data subject vis-à-vis a is one of these is from data in these mandates can be for the rights of and for a specific an order to the of data subject rights. This that such mandates the can also the to the data rights exercise from the data the refers to this only to a in the of an exercise of the of or a of portability the framework of This on data and data portability the all data be to their enabling for data rights as well as their in data It also be an to on the of these rights in particular. most and to on the rights of and we is important to mandates data rights This their and these the which mandates can be their and potential or mandates by are an tool to are by in the of a of as well as fiduciary have a in data and are in the of the of data rights. this we can be from fiduciary to to data rights mandates. order to fiduciary duties can the of data rights is to a critical at the of The of about in to data that economic and to be to such in for their This is on not the to which fiduciary are with of of on this with of also a in the of the fiduciary of DRIs in particular. is to that not for an of towards a in data by data subjects a responsibility towards their not be to such an of their fiduciary towards data subjects, such have to be of imperatives by these imperatives the of data or While the potential for of to the only a fiduciary towards data subjects is with data responsibility towards their While this is on of in the of we to be of for DRIs as As a need not data. While need not on value from a be with significant of For a to exercise their rights to or have which from in the by those a fiduciary not only a robust of of also an ability to to the and of the in the data this the by be in a position that is to that of a who a on or a who a to for in that are as an to the of legal in civil law these is the of fiduciary that need to be to mandated to exercise specific data rights on behalf of the data As to different jurisdictions, fiduciary the is to be the most of fiduciary are legal in civil law that to the as those of the is that a of fiduciary in civil law most civil law jurisdictions, the of a rights with of fiduciary The most one is a to the of the For the civil a fiduciary to all the law principles for all mandates or and the mandated is to be subject to the fiduciary the The fiduciary refers to a framework that duties of and to that are by a of such that one of the parties to the There are a variety of legal that such such as the law the the in responsibility The include a of on the of the of the or of the and a to not the of these duties will be the that the This the on in the of fiduciary the legal the is a specific where the party in of a for a specific for the of one or more It is only to a of and who not the ie in the or in the and and This a of of can be as in the is to the to subject only with a of to this The of the in this is in of the civil which that the is for their The of this or is in specific the for to the in to their have a to and in with the of their and are civil law frameworks fiduciary and the to a of fiduciary jurisdictions, a need for fiduciary as an This one the political economy of this that in of the the fiduciary can to a more data As the recent on data subject the of the that this exercise can be by a third The that are third parties that can on behalf of data as as accountability are in this the expressly refers to the legal of which specific for to a on behalf of the data be the GDPR not regulate this The to legal frameworks is the power in the have to a of the need for duties that a of The delineation of such duties from to with fiduciary the the of for fiduciary duties and their potential as an for in can be traced back to in is an number of who is time for the of fiduciary such duties are better to the of at The is of to the delineation of accountability mechanisms in the of data rights mandates. legal a mandates be specific to the and of the data and in a that the asymmetries in or legal can also be to the and/or data at The duties and safeguards for are not the to which the are to to power the mandated the of for the a of power in such as and be to the of the data in where is in with the delineation of fiduciary This delineation be by or and to be by robust institutional This institutional is without institutional mechanisms to as the in the of data fiduciary more This in a a of the power to light of their to and the of the GDPR we data are the most to data rights mandates are This will need to be complemented by a not the the in which and in light of the at Indeed, to the that a for data rights, data have an to are with to As the need to a legal that the exercise of data rights is increasingly the value to their collective exercise is this DRIs have as with rights with a on the of and the to data this we explored the of legal frameworks for data rights. rights’ mandates are not expressly framed in the GDPR and as by in the Data their delineation can be ambiguous. is important to highlight that data rights are in mandatable and this without affecting their nature. The of this article is we the of data rights are mandatable can be by an and we existing law different can be to such mandates. that law can already the legal framework and to a law and fiduciary duties both have longstanding traditions and robust norms in many jurisdictions, all of which can be explored towards shaping the appropriate environment to regulate data rights mandates in particular. The of in civil law is not not the shaping the of data rights mandates. Indeed, legal can help institutional safeguards for we that the key in unlocking the full potential of data rights mandates can already be found in existing civil law the diversity in different legal regulate fiduciary with that in contract reveals the need for solidifying the responsibility and accountability of mandated DRIs. The already the need to fiduciary duties for data as data order to the legal and safeguards to be by we need to that mandates are The continued adherence to fundamental contract law principles will have to be complemented by a robust framework of institutional safeguards. The need for such safeguards stems from the vulnerable position of data subjects, both vis-à-vis DRIs as well as data controllers. This article explored and key to be in such a as to data rights can a tool in the of data subjects. The to this article by a research from the Data which is by the and have from the the research and from the