Page 33 - ITU Journal - ICT Discoveries - Volume 1, No. 2, December 2018 - Second special issue on Data for Good

ITU JOURNAL: ICT Discoveries, Vol. 1(2), December 2018

internal market, and to the well-being of natural to another controller. The right of data portability
persons [17, Recital 2] and especially the stated ‘encouragement’ for
interoperability introduces a new paradigm within
Indeed, it has the aim to create “...trust that will the digital economy and compromises the dominant
allow the digital economy to develop across the position and business models of certain large tech
internal market” [17, Recital 7]. The GDPR applies to firms most notably, Facebook. With the importance
all processors and controllers of personal data of big data for many DDBMs, the data portability
(information that makes a person identifiable). feature of the GDPR introduces competitive
Whereas a controller outlines the reason and pressure in the digital markets (especially for
format of the processing of personal data, a Facebook) where combined with various principles
processor is the one who conducts the processing of the GDPR (e.g. data minimization) as well as other
[18]. The main principles of the GDPR are the rights (e.g. right to erasure), data portability
following: lawfulness, fairness and transparency; provides consumers with leverage.
purpose and storage limitation; data minimization;
integrity and confidentiality; and accountability. 3. GDPR’S INDIVIDUAL RIGHT TO DATA
The GDPR attempts to provide users with control of PORTABILITY AND FACEBOOK’S DDBM
their data and the principles reflect the spirit of the
GDPR (which in many cases does not provide With the rise in social media, the US company
specific rules) and thus, very difficult to navigate Facebook has established market leadership.
around. Failure to show compliance can lead to Initially developed as a small social communication
maximum fine of 4% of global turnover or website used at elite universities in the US, it has
20 million, whichever is more [18]. Furthermore, grown to become a global, multi-billion dollar social
the GDPR establishes fundamental rights, namely: networking company with more than 2.19 billion
the ‘right to be informed’, the ‘right of access’, ‘the monthly active users [19]. In addition to their own
right of rectification’, the ‘right to erasure’, the ‘right social network platform, Facebook Inc. acquired
to restrict processing’, the ‘right to data portability’ other companies such as the digital photo service
the ‘right to object’, and rights related to automated Instagram, the instant messaging service
decision-making including profiling. Other aspects WhatsApp, and the virtual reality technology
of the GDPR include data protection by design and provider Oculus VR amongst others [20], [21], [22].
default, showing proof of consent for processing as Since 2013, the corporation’s revenue streams grew
well as having the duty to report certain personal from 7.87 billion to 40.7 billion US dollars with a net
data breaches among others. In light of the central income of 15.9 billion in 2017 [19]. Facebook
role the control, collection and use of vast amounts harnesses the data economy of billions of their
of user data plays for DDBM, the GDPR’s principles users to derive patterns of preferences and brand
of data minimization, transparency, purpose affiliation. As a result, they can provide brands with
limitation to name a few as well as certain extremely targeted advertisement opportunities
individual rights enclosed in the GDPR strongly and market insights [23].
compromises the status quo of certain DDBMs and
certain firms’ revenue streams. According to strategist Tom Goodwin, Facebook
evolved to become the “...world’s most popular
2.5 The GDPR’s right to data portability media owner [that] creates no content...” itself
[24 p. 6]. The quality and quantity of this content is
One of the most prominent new features of the driven by the users and their data. As indicated
GDPR is the right to data portability. The right above, the generation of content, the targeting of
allows individuals to obtain the personal data advertisements and the individual’s utility of the
(without hindrance) that they have given a social media platform rely heavily on network
controller “… in a structured, commonly used and effects [16]. These features call for an approach to
machine-readable and interoperable format…” [17, analyze Facebook with a specific focus on the
Recital 68]. This right applies when processing has data-driven nature of their business model. For this
been based on consent, when you need to fulfil a purpose, we rely on the comprehensive data-driven
contract or when the processing has been done business model framework of Hartmann et al. [1],
through automated mechanisms. This right allows who analyzed business model data of a hundred
the user to not only obtain a copy of their personal data-driven start-ups and deduced a taxonomy that
data but also the ability to transfer this information structures a DDBM into six dimensions and thirty-

© International Telecommunication Union, 2018 11