Page 34 - ITU Journal - ICT Discoveries - Volume 1, No. 2, December 2018 - Second special issue on Data for Good

ITU JOURNAL: ICT Discoveries, Vol. 1(2), December 2018

five sub-dimensions. For the scope of this paper, we user’s browsing behavior with the use of ‘cookies’.
will focus on the first level of dimensions and These gather user data on previously visited, as well
analyze and discuss only the effect of the GDPR’s as subsequent visited websites. In addition, they can
individual ‘right to Data Portability’ on the specific track users on other websites which have
dimensions of Facebook’s DDBM. integrated Facebook products such as the ‘like’
buttons or social logins [25].

External data refers to commercially acquired data
from third party providers and represents a smaller
share of Facebook’s data pool. The company
announced in a press release in March 2018 to shut
down the acquisition of third-party data from data
analytics and polling companies such as Experian.
However, they still gather and exchange data with
the advertisers that are active on Facebook such as
with certain customer loyalty programs [26].

Fig.1 – The impact of GDPR’s right to data portability on the
DDBM of Facebook based on an adaptation of The internal data source component of Facebook’s
Hartmann et al., 2016 [1] business model is very likely affected by the GDPR’s
individual right to data portability. Previously,
Fig. 1 depicts an adapted illustration of the users of platforms such as Facebook experienced a
dimensions identified by [1]. As a result of the lock-in effect because of the switching costs
limited scope of the paper, we do not include the associated with leaving their data at the former
dimension ‘cost advantage’ in the discussion. We platform (e.g. if they wanted to switch from
adapt Hartmann et al.’s [1] framework and have Facebook to Google+). The GDPR’s right to data
deduced dimensions in order to categorize portability addresses this lock-in which is
Facebook’s business model in detail and discuss the important as lock-ins according to Shapiro and
effects of the GDPR’s ‘right to data portability’ on Varian [27], distort competition by establishing
each level if applicable. The dark green color market barriers. These arguments are also valid for
indicates where this individual right is very likely to Facebook’s external data usage, but we conclude
influence Facebook’s data-driven business model. that they are less likely to affect the business model
The light green color points to a likely impact. The and not in a similar holistic way as the amount of
grey color suggests that this dimension is either not internal data. Before the GDPR came into force,
relevant for Facebook’s DDBM or that the individual Facebook already offered a ‘Download-your-
right to data portability will not likely play a role for information-feature’. It was further improved to
the business model. ensure compliance with the requirements that
users’ data be formatted in a ‘structured’,
3.1 Data sources ‘commonly used’ and ‘machine-readable’ way. This
might be realized by interoperable data formats
Hartmann et al. [1] differentiate between two types such as JSON, CSV or XML. Facebook now offers the
of data source: internal and external data. Internal possibility to export their data in JSON and CSV
data is the key component of Facebook’s data pool formats. In addition, they also have to ensure that
and includes the data provided by the users they can transfer this user data to other data
themselves. Facebook processes data on the user’s controllers (such as their competitor Google+) and
own status updates, contact info, timeline features, vice versa, incorporate structured data of new users
visited and saved events, messages, photos and coming from other data controllers [18]. These data
videos, contact and friend history, access devices, controllers could also be established companies or
visited and interested events, likes, pokes and start-ups seeking to establish a new business model
comments. Moreover, Facebook collects data on the (e.g. in a niche) using data that users allow to be
usage of “...games and other applications...” exported from social media sites such as Facebook
[23 p.528]. In addition, Facebook potentially also to their systems. Thus, we hypothesize that the
processes the amount of time users spend on GDPR’s right to data portability can also spur
certain components, of the platform such as on innovation as it is outlining interoperability
other pages and profiles. Facebook also tracks their standards.

12 © International Telecommunication Union, 2018