What is your personal data worth?
When we consider the value of personal data, what price are organisations placing on it and how do individuals protect and retain its worth?
If you’ve been involved in implementing a new system or technology, you may have completed a data protection impact assessment (DPIA). The DPIA was introduced in 2018 but how useful are they today and are they still necessary? There is a new ISO standard on anonymisation and de-identification. We review the details below.
What is an individual’s personal data worth?
What happened
A class action lawsuit brought against Facebook’s parent firm Meta* in the Competition Appeal Tribunal alleged that Facebook (FB) had abused its market dominance in setting an unfair price for free use of Facebook US users’ personal data.
FB forced its users to give up their valuable personal data in order to receive personalised, targeted advertising and access to the social network. The data was ‘harvested’ between 2015 and 2019 and provided information on internet use, helping FB make large profits.
Another significant case that involved a class action (and personal data), was Lloyd v Google**. This also highlighted the value of personal data as an asset, but the FB case is more complicated as it considers both sides; the value of the data to the individual using FB and the commercial value of that data to the firm.
The value an individual attributes to their personal data is subjective. It will be important to strike a balance between users who are happy that their data is monetised but want a return and those that see the return as the value of the service they are receiving. The FB case has a key role here.
Case studies:
*Meta faces billion-pound class-action case – BBC News
**Lloyd v Google: the funder perspective | Feature | Law Gazette
Why it matters
The sheer volume of data being captured by social media companies demonstrates that data has a value, whether it is commercial, economic or both! From a privacy perspective, the important issue for organisations is protecting the rights of individuals rather than facilitating large profits and this is where GDPR can support the FB case.
Mergers and acquisitions that have taken place in the retail sector, have demonstrated that the value of a business is not seen as its stock or physical assets but its customer database and its intellectual property. The World Economic Forum’s definition of data gives weight to this. The forum describes personal data as a ‘new asset class that is generating a new wave of opportunity for economic and societal value creation’. Personal Data: The Emergence of a New Asset Class (weforum.org)
If personal data is in the public domain, is it fair for companies to make a profit from that data? If so, are individuals happy to give up their data for free or should they be incentivised?
The outcome of the FB case will hopefully answer this question. The case has brought to light, the tension between personal data as a right and personal data as a saleable asset. It is important now, for the law to strike a balance. What is the value of data and who is the data valuable to?
The future regulation of the internet will be important, and also the provision of online services on digital platforms. The outcome of the FB case will provide a benchmark in terms of assessing the value that can be attributed to personal data and it might well change how businesses and individuals view this going forward. In time this could lead to changes in regulation that provide more guidance on the monetisation of, and protection given to personal data.
Important Considerations
The FB and Google cases have shown that personal data is valuable and that is demonstrated by the way it is used in such large volumes by many organisations.
What do you believe your own data is worth to an organisation? Is it more valuable to you than to organisations who collect it and would you expect something in return if they want to use it for marketing or other purposes?