“ Why the Right to Data Portability Likely Reduces Consumer Welfare:

1. “Why the Right to Data Portability Likely Reduces Consumer Welfare: Antitrust and Privacy Critique” Peter Swire Moritz College of Law Yale Law School Information Society ProjectNovember 12, 2012

2. The Topic • Right to Data Portability (RDP) • A new right • In draft EU Data Protection Regulation • Applies in EU and to all software/services with EU users • Will become a “fundamental” right, as defined further by EU Commission over time • Portability sounds good, but no critique to date

3. Why Portability is Attractive • You post “your” data to the cloud, a social network, an app • High switching costs: manual downloads are slow, clumsy • Avoid lock-in: you can switch to a new social network or cloud provider • Openness is good: the second service can innovate and provide you with great new services • Right to informational self-determination: it’s “your” data

4. RDP Requirements • Article 18 of draft Regulation: • Individual can download all “personal data” if in standard format • “Personal data” broad • Also, individual can transfer personal data and other info provided by consumer to 2d service • “Without hindrance” • Service must create “Export-Import Module” to ensure portability • No similar law tried elsewhere

5. Assessing RDP • Idea of data portability very attractive • Antitrust perspective • RDP likely reduces consumer welfare • Privacy and human rights perspective • Whence this new human right? • Risk to existing privacy/security rights • Interop/openness often desirable • Previously, law has prevented first party from blocking second party • This is unprecedented mandate on how all software is written by first party

6. Antitrust Concerns • Antitrust goal to max consumer welfare • Concerns with Art. 18: • Applies to all online services, even start-ups • No market power requirement • Fails to consider efficiencies of what software companies include in offerings • Interoperability difficult to achieve • Cost of creating EIM • Dynamic efficiency & incentives to compete for the market

7. Antitrust (cont.) • In essence a per se rule requiring portability • Refusal to deal – lots of company discretion • Tying and Microsoft – rule of reason • They require showing of market power before regulating • Conclusion on antitrust • Differs greatly from consumer welfare goal in US and EU antitrust analysis

8. Privacy & Data Portablity • EU idea – fundamental right to autonomy, individuals should control “their” data • Responses/questions: • A human right to “data portability”? • Created in statutory/reg process • Reasoning from autonomy without the state interest/nexus analysis of facts of US 1st Am analysis • Applies globally, with discretion in EU enforcement

9. Privacy & Data Portablity • RDP as a privacy regulation? • Yes, is about personal data • But, mostly about lock-in • And, risk to user’s data security • One moment of ID theft away from a lifetime of data

10. Some Conclusions & Questions • Consumers do benefit from portability, from avoiding lock-in & high switching costs • The rules should learn from antitrust experience with exclusionary practices • Market power, efficiencies, rule of reason • Be cautious about sweeping declaration of a new right, with no experience in practice • Applies to any online services that sell to EU • What to do now? • Jawbone, and major companies have shifted • Look for actual problems, and then act • Great caution in drafting or implementing Art. 18