Data Portability and Interoperability – SWIRE – June 2021 OECD discussion
0 likes9,344 views
Professor Peter Swire discusses the conflict between antitrust objectives of promoting data portability and the privacy/security concerns that often lead to restrictions on data flows. He proposes a structured impact assessment called the 'portability and other required transfers impact assessment' (port-ia) to evaluate the risks and benefits of data transfers systematically. This assessment aims to inform legislative, regulatory, and enforcement decisions while balancing competition goals with privacy and cybersecurity considerations.
Data Portability and Interoperability – SWIRE – June 2021 OECD discussion
- 1. “Enforcement Cooperation & Balancing Portability/Interoperability Objectives” Professor Peter Swire Georgia Tech OECD Competition Committee Hearing on Data Portability, Interoperability, and Competition June 9, 2021 (version 2)
- 2. Publications Using the Portability and Other Required Transfers Impact Assessment (“PORT-IA”) in Antitrust Law Competition Policy International https://www.competitionpolicyinternational.com/using-the- portability-and-other-required-transfers-impact-assessment-port- ia-in-antitrust-law/ The Portability and Other Required Transfers Impact Assessment: Assessing Competition, Privacy, Cybersecurity, and Other Considerations Available at SSRN https://ssrn.com/abstract=3689171
- 3. Overview Dilemma: antitrust tends to open data flows, but privacy/security tend to close them Proposed answer: the Portability and Other Required Transfers Impact Assessment (PORT-IA) Multiple enforcement agencies
- 4. Terminology: PORT Right to data portability is about an individual right to transfer data “Portability” is a term of art for transfers of data of one person An individual right to transfer to self or 3d party Actual or proposed mandates to transfer databases, data of more than one person In Europe, called “data sharing”; vague term, because data is shared in so many ways “Interoperability” often a technical term about 2-way operations My papers propose “Other Required Transfers” PORT: Portability or Other Required Transfers U.S. health care – individual portability, and a hospital has a right to transfer all of its records to a new software provider EU Free Flow of Data Regulation – similar to hospital
- 5. The Dilemma: Open or Close Data Flows? Competition/antitrust – many reasons to open data flows Idea: if more companies have access to commercially valuable data, then more innovation and competition Lock-in/switching cost effects more prominent than network effects Privacy and Cybersecurity – close data flows What if data gets to the “wrong” people? Cybersecurity – focus on unauthorized access Privacy – focus on what access should be authorized, and often be cautious unless there is user consent Phone number portability not typical Large benefits, low security/privacy risks
- 6. Responding to the Dilemma Create a well-designed Portability and Other Required Transfers Impact Assessment (“PORT-IA”) Similar to Privacy Impact Assessment (U.S.) or Data Protection Impact Assessment (E.U.) Methodology Draft “structured questions” for a systematic assessment Test the draft questions against multiple case studies EU/US Phone number, health care, financial services, open data, auto dealers Validate the structured questions based on the case studies
- 7. Institutional use of PORT-IAs Conduct PORT-IA for legislation, regulation, and company product choice Systematic process to assess risks and benefits across domains PORT-IAs can inform antitrust enforcement decisions E.g., are cybersecurity and privacy arguments for exclusion genuine or a pretext FRAND as one criterion for that decision PORT-IAs can assist enforcers and judges to design remedies Meet competition goals Avoid unnecessary harm to data security and privacy
- 8. Conclusion Opening up data flows – transferring data – can have great benefits, for competition, innovation, freedom of choice, etc. Closing data flows – for privacy and cybersecurity – also can have great benefits PORT-IA provides a method that is agnostic about each proposal What are the benefits and costs from this required transfer? Can we increase the benefits? (such as focusing transfers where will help competition) Can we reduce the costs? (such as tailored privacy rules) Can we assist regulators in enforcement decisions and remedies? For this complex and increasingly important topic, the PORT-IA can assist policy-makers and companies to reach better decisions