IP Law and Policy for the Data Economy in the EU

2.1.1 Database Sui Generis Right – Broad Scope and Legal Uncertainty

The database sui generis right aims at protecting the database makers’ investment in a database by means of an exclusive right. Pursuant to Art. 7 (1) Database Directive, any substantial investment in obtaining, verification, or presentation of the contents of a database gives rise to the database maker’s right to prevent extraction and/or re-utilisation of the whole or of a substantial part of the contents of that database. As the European Court of Justice (ECJ) interprets the definition of ‘database’ very extensively (Freistaat Bayern v. Verlag Esterbauer, 2015, paras 18 et seq.), the vast majority of data sets aggregated in a data-driven economy in principle qualify for protection as database (Drexl, 2018, p. 67 et seq.; also Leistner, 2017, p. 27 et seq.; 2021a, p. 226 et seq.). Furthermore, the substantive threshold of database sui generis protection, i.e. the requirement of a ‘substantial investment’, is rather low (Leistner, 2017, p. 30).

The decisive criterion for possible protection under the sui generis right has, therefore, become whether the investment concerned the collection or mere creation of a database’s content. This distinction has been introduced by the ECJ in order to prevent protection by the exclusive right in sole source situations in which data are solely available from one particular source and cannot be obtained with comparable investments by another competitor or market participant otherwise (British Horseracing Board v. Hill, 2004, paras. 30 et seq.; Fixtures Marketing v. Oy Veikkaus, 2004; Fixtures Marketing v. Svenska Spel, 2004; Fixtures Marketing v. Organismos prognostikon, 2004). Parts of the literature have interpreted the ECJ’s argumentation (that investments in the creation of data, which is, for instance, collected as a mere by-product of another main activity (spin off-situations), cannot qualify for sui generis protection) in a strict way, as to generally exclude machine-generated data from the scope of Art. 7 Database Directive. But, as we have pointed out elsewhere, this is by no means sure: First, the ECJ’s interpretation was in principle tailored to sole-source situations, and second, numerous national courts have already recognised certain investments in necessary technical infrastructure for measuring, obtaining, or documenting existing data as sufficient for a protection under the sui generis right (German Federal Supreme Court (BGH), HIT Bilanz, 2005 and Autobahnmaut, 2010; Austrian Federal Supreme Court (OGH), 2015).

If this line of case law were further followed or even generalised by the ECJ in the future, most IoT data (and many others) would certainly qualify for protection, if based on substantial investments into the installation of sensors and similar measuring infrastructure (being regarded as investments into the collection of [physically] existing data in nature or of technical processes). Thus, this problem needed to be addressed (see already European Commission, 2022, pp. 15 et seq., 131 et seq.; Leistner, 2017, p. 27 et seq.). And indeed, in order to resolve the current legal uncertainty regarding the sui generis right’s conditions of protection, the proposal for a Data Act initially contained an explicit provision to clarify the sui generis right’s scope with respect to machine-generated data in Art. 35, which, albeit, followed a very sector-specific and limited approach to the problem (Derclaye & Husovec, 2022; see also below 4). However, both European Parliament and Council watered the provision down even further to solely exclude the applicability of the database sui generis right for the purposes of the Data Act. That would mean to miss a unique opportunity to clarify the scope of the database sui generis right and to reduce legal uncertainty significantly. Meanwhile, it seems that at least machine-generated data shall be generally excluded from the scope of the sui generis right. This, in turn, leaves certain crucial, more technical questions open, such as the question of whether the new provision would have a retroactive effect or not.

2.1.2 Trade Secrets Protection – A Flexible “Newcomer” with Growing Importance

Besides the database sui generis right – and in practice of even larger importance – trade secrets protection can extend in principle to all data collections (Aplin, 2017). Whereas the Database Directive dates back to 1991, the Trade Secrets Directive harmonised the protection of trade secrets in the EU only in 2016. Being thus a relatively “new” piece of legislation, the Trade Secrets Directive, on principle, offers sufficient flexibility to address the needs of a data-driven economy.

The protection of trade secrets is based on the consideration that incomplete information constitutes an indispensable prerequisite for functioning competition so that in particular market-related information has to be protected against unlawful acquisition, disclosure, and use. In addition, trade secrets protection – even though not an exclusive right – aims at reducing transaction costs for factual protection measures and at facilitating access to information by means of licencing contracts. Pursuant to Art. 2 (1) of the Trade Secrets Directive, information can be protected as a trade secret if it is not generally known, has commercial value due to its secrecy and is subject to reasonable steps to keep it secret. Due to this broad definition, diverse types of data sets but also algorithms and program codes needed for the processing of data are eligible for trade secrets protection if the requirements of Art. 2 (1) Trade Secrets Directive are fulfilled (Leistner, 2021a, p. 219 et seq.).

2.1.3 The Impact of Protection Instruments on Access, Use, and Portability of Data

Because of their far-reaching applicability in data-driven business scenarios, both the database sui generis right and trade secrets protection have the potential to create hold-up situations and to aggravate access problems in certain situations. Based on empirical evidence, the database sui generis right’s unclear scope with regard to machine-generated data has been identified as an important obstacle for data sharing in the IoT sector, for instance, due to the risk that sui generis protection is invoked ‘opportunistically’ in order to ‘block’ data access (see European Commission, 2022, p. 15 et seq.). Looking at trade secrets protection for data, a clear answer cannot be given yet: according to a recent study on the legal protection of trade secrets in the data economy, there is still no unambiguous evidence for the question of whether trade secrets protection facilitates or – in certain situations – may hamper data sharing (Radauer et al., 2022).

As a consequence, precise identification of justified access requirements and the resulting actual or potential problem zones at the interface to IP protection is necessary, and in regard to such concretely identified actual or potential problem zones, an equitable balance between existing and future data access, use, and sharing liberties or rights on the one hand, and the existing protection instruments on the rightholders’ side on the other hand, has to be found.

2.2.1 The Status Quo

Under the existing acquis, data access, portability, and sharing are primarily governed by contract law, general competition law, certain very limited sector-specific instruments, and – in relation to personal data – by the General Data Protection Regulation (GDPR).

Art. 20 GDPR has introduced a claim to the portability of personal data as an individual right of the data subject. This entails the right to request the porting of volunteered and observed personal data from one controller to another. Even though Art. 20 GDPR also expresses the GDPR’s objective to safeguard the fundamental right to protection of personal data (Art. 8 (1) Charter of Fundamental Rights of the European Union; Art. 16 (1) TFEU), the implementation of the portability right was driven by the objective to reduce lock-in effects and thus reflects a robust pro-competitive approach (Metzger, 2021, p. 295). As a result, Art. 20 GDPR became the centre of a lively debate about whether portability rights should be applied broadly in order to foster the development of data markets. Currently, however, Art. 20 GDPR is not very effective in practice. This is partly due to certain shortcomings of the provision, namely its limited scope (not covering real-time access and inferred data). Most importantly, the practical difficulties resulting from a lack of interoperability prevent effective implementation of the portability right. Business models, which would be based on this right, such as porting services, do exist in certain fields (e.g. Soundiiz, Freeyourmusic or Songshift offer porting services with regard to music streaming platforms) but are still scarce. As regards potential conflicts with IP rights or trade secrets of the controller or third parties, Art. 20 (4) GDPR provides for a ‘balancing of interest’ clause which leaves sufficient room for a flexible and equitable interpretation.

Besides certain sector-specific regulations (further Graef et al., 2020), access to data in B2B relations can primarily be granted under the rather strict conditions of general competition law. Pursuant to the requirements established for IP rights in the ECJ’s Magill judgment (RTE and ITP v. Commission, 1995) and since then consolidated and cautiously broadened in IMS Health (IMS Health v. NDC, 2004) and Microsoft (Court of First Instance, Microsoft v. Commission, 2007), a claim to a compulsory licence can be based on Art. 102 TFEU where a data holder with a dominant market position (in an actual or even a hypothetical upstream licencing market) refuses, without objective reason, access to data which is indispensable to compete in a downstream market with the effect that any competition on that market is eliminated, thereby preventing the emergence of a new product or service^[1] (Microsoft v. Commission, 2007, paras 643 et seq.) for which there is a potential consumer demand (ECJ, Bronner v. Mediaprint, 1998, para. 40; IMS Health v. NDC, 2004, paras 38, 48 et seq.). In short, Art. 102 TFEU, on the one hand, solely applies to market-dominant firms controlling indispensable data and has, therefore, no effect below this threshold which significantly limits the impact of that provision. On the other hand, compulsory licences under that provision entail, first, even access to information protected as a trade secret (Microsoft v. Commission, 2007, para. 289) and, second, not only access but also the use of the information protected by IP rights or as a trade secret by a competitor of the data holder and, thus, can promote innovation even if this leads to innovative products or services in competition^[2] with the products or services of the data holder.

The Digital Markets Act implements further access and portability rights. The DMA, however, only applies in relation to so-called gatekeepers. Gatekeepers are very narrowly defined in the Regulation. Practically, the DMA only applies to the GAFAM companies plus presumably a handful of companies of comparable size and impact. Art. 6 (9) contains the right for business users and end users to port data provided or generated in the context of their use, thus volunteered and observed data, including continuous and real-time access. In addition, Art. 6 (10) foresees a right to data access for business platform users free of charge, with effective, high-quality, continuous, and real-time access, including inferred data from such use in aggregated or non-aggregated form. Whereas these two provisions enable users to access and port individual-level use data, Art. 6 (11) introduces a sector-specific access right for search engine providers to ranking, query, click, and view data – thus, aggregated data – of the gatekeeper under FRAND terms. Notably, Art. 6 (11) allows for access to aggregated data even for search engine providers which directly compete with the gatekeeper (and data holder).

In European contract law, access to individual-level data in B2C relations is provided solely by the Digital Contents Directive ((EU) 2019/770), which provides for a post-contractual portability right for non-personal data in Art. 16 (4). With respect to B2B relations, a right to access and portability of individual-level use data does so far not exist in European contract law. However, the Platform to Business Regulation ((EU) 2019/1150) stipulated certain transparency obligations for platform providers in relation to business users concerning contractual and technical access to volunteered and observed data of the user (further Schweitzer et al., 2022, p. 130).

Horizontal data access and sharing is primarily based on contractual agreements (European Commission, 2022, p. 17; OECD, 2019, p. 101). Whereas so far neither well-established business practices nor model contract terms exist (Schweitzer et al., 2022, p. 273 et seq.), in the recent years several soft law instruments have been developed in order to provide guidance (American Law Institute and European Law Institute, 2021; European Commission, 2018). Nonetheless, contracting ‘on data’ is still characterised by significant information and transaction costs as well as legal uncertainty in the EU market.

2.2.2 The Way Forward

Meanwhile, certain case groups can be distilled from the academic and policy discussion in which actual or potential market failure seems conceivable and access, sharing, and use rights might therefore be justifiable. The first case group refers to access, use, and portability of individual-level data that is collected by a producer or service provider. The second case group concerns access of competitors to complete, aggregated data sets, where this is necessary in order to establish workable competition in aftermarkets or complementary markets. The third case group relates to access to large aggregated datasets held by big data conglomerates necessary for the development of innovative unrelated products or services, e.g. in the context of AI (Crémer et al., 2019, p. 75 et seq.).

As described earlier, the currently existing statutory EU framework of access, use, and portability rights does particularly address the first case group, hence, access to individual-level use data which has been provided by a data subject/user or observed by a provider – such access rights mainly address switching cost problems (lock in) or access to data in order to provide individual aftermarket services. Existing mechanisms in EU law are Art. 20 GDPR (personal data), Art. 16 (4) Digital Contents Directive (on B2C post-contractual level), as well as Arts. 6 (9) and (10) of the Digital Markets Act (in relation to gatekeepers).

General EU competition law can under certain conditions reach further: it can not only mandate access to (and use of) individual-level data but also under certain conditions grant access for competitors to aggregated datasets where this is objectively indispensable for innovation in a downstream market, which can even be the market, where the data holder offers products or services, since any downstream market in relation to the upstream market for data licences will suffice even if the latter is a hypothetical market (Crémer et al., 2019, p. 102 et seq.; Schweitzer & Welker, 2021, p. 141 et seq.). However, Art. 102 TFEU applies only in relation to market dominant firms (and as far as the further requirements for a compulsory licence are fulfilled). Thus, essentially, Art. 6 (11) of the Digital Markets Act is the only current provision in the European data acquis covering access to (certain) aggregated datasets which extends even to directly competing search engine providers.

In sum, current EU law is characterised by a differentiated IP protection situation which is balanced as regards the ‘classic’ IP rights as well as trade secrets protection, but which reveals certain problematic uncertainties and tendencies to over-protection as regards the database maker’s sui generis right laid down in the Database Directive of 1996 (European Commission, 2022, pp. 15 et seq., 131 et seq.). As for access rights, certain sector-specific access rights in regard to individual level data help reduce switching costs and do allow for certain specific aftermarket services (further Schweitzer & Welker, p. 115 et seq., with examples). By contrast, broader access rights to foster data markets and in particular sharing and use of data in order to develop innovative products or services are not yet broadly foreseen. In regard to this latter objective, the Digital Markets Act introduces some limited data access rights in relation to so-called gatekeepers. Besides, compulsory licences can be based on Art. 102 TFEU (i.e. general competition law), albeit only in relation to dominant firms and under certain additional conditions.