Data Navigator: Data Act by Design

In episode 45 of the Data Navigator podcast, Dr Martin Schirmbacher and Dr Hubertus von Roenne talk to Prof. Dr Max von Grafenstein about regulation, innovation and data sharing. Prof. Dr Max von Grafenstein is Professor of Digital Self-Determination at the Berlin University of the Arts (UdK) and co-director of the research programme “Data, Actors, Infrastructures: Governance of Data-Driven Innovation and Cybersecurity” at the Alexander von Humboldt Institute for Internet and Society.

The focus is on the question of how regulation affects innovation. Prof. Dr Max von Grafenstein brings a research-based perspective to this: drawing on his work with around 140 start-ups, he has empirically investigated the influence of regulatory requirements on innovation processes. At first glance, his findings are counterintuitive: the data protection principle of purpose limitation need not hinder innovation; indeed, it can even promote it if applied correctly. In practice, however, the assessment is that companies are still a long way from achieving this.

Prof. Dr Max von Grafenstein describes a key problem using George Akerlof’s economic ‘Market of Lemons’ model. If users cannot intuitively recognise which service offers what level of data protection, a downward spiral ensues. The so-called privacy paradox is therefore not a result of irrational user behaviour, but a consequence of a lack of transparency. Better UX research is crucial: transparency and intervention mechanisms such as consent or objection must be designed in such a way that they can actually be understood and used.

Applied to the Data Act, this results in a specific task. For data exchange between data owners, users and third parties to function, intuitive visual decision-making interfaces for data requests are required. Furthermore, third parties must be able to identify, via a kind of data catalogue, which data is actually available.

Prof. Dr Max von Grafenstein explains why data owners frequently block requests despite the lack of rational grounds by citing two factors: a behavioural economic fear of loss and the real cost burden arising from the operational effort involved in providing data. His formula for voluntary data sharing is: data is only shared if the expected added value is significantly greater than the compliance risks and compliance costs. The same logic applies, conversely, to the user’s legal entitlement.

In addition, Dr Martin Schirmbacher and Dr Hubertus von Roenne discuss the Digital Omnibus. The basic principle of the Data Act is to be retained, the Data Governance Act integrated, and the protection of trade secrets slightly tightened. They view efforts to replace direct access with indirect access critically. The VW example in particular demonstrates how important reliable interfaces are for effective data access.

Finally, Prof. Dr Max von Grafenstein recommends that companies do not start by focusing on risk, but rather on concrete use cases. The Federal Network Agency should establish a use-case repository containing anonymised cases that have been approved and those that have been rejected. This would enable start-ups in particular to build on existing examples without having to have every project legally reviewed from scratch.