Many people talk about individuals data, but do individuals really have a right of ownership over their personal data ? Banks provide their customers a lot of information including the account number, credit card number, cryptogram … These are probably personal data. Since these data are provided by banks, do they belong to them or to customers ? Many questions are unanswered. Indeed, there is no legal regime on the ownership of data or banking data.
The presumption of ownership of data subjects of personal banking data
There is currently no legal status for the ownership of data and especially banking data. This creates a legal vacuum. Neither a general scheme nor a special scheme is expressly provided for the question of the appropriation of banking data.
Banking data « have no intrinsic value and are not the result of intellectual or creative work on the part of the bank ». The banking data would be used only for the management of an account and can not be the object of any appropriation. Data appropriation criterion, in particular banking data, would be, on the one hand, their creation, and on the other hand, their originality. In this case, the common property law including the property regime could then be mobilized, or even copyright if their originality can be proven.
For some, banking data described as "raw" can not be owned, but those described as "derivatives" could be under certain conditions. Personal banking data are those related to the nature and identification of a bank account. These include account details, number, account type, and more.
One of the objectives of the GDPR is to give back control of their data to the individuals referred to as the persons concerned. The french Law for a Digital Republic in its first article confers on individuals "the right to decide and control the uses that are made of personal data concerning them ...". Do the powers conferred on the persons concerned with regard to their data presume ownership ? This is the interpretation we can make of the above mentioned rules. The presumption does not seem, despite that to settle the question of the ownership of Banking data.
Opportunities offered by special mechanisms for the appropriation of Banking data ?
The ownership of banking data as mentioned above does not benefit from any specific legal regime. Although there is no specific regime, other mechanisms offer opportunities for appropriation to fill the legal vacuum.
First, contract Law seems to fill the vacuum. « The organization of the ownership of the data produced, stored and collected by the banks could, like what Ryanair had done through its general conditions of use, identify contracts offered by the institutions concerned ». The appropriation of bank data can be contracted. Contractual protection is recognized by the Court of Justice of the European Union in the Ryanair case (CJEU, 15-01-2015, Case No. C-30/14, Ryanair Ltd v. PR Aviation BV).
On the other hand, one might think that the appropriation of data can also be possible through business secrecy. However, according to Article 2 of 2016 EU Directive on the protection of undisclosed know-how and commercial information, the qualification of business secrecy is subject to three conditions namely the secrecy of the data, their commercial or market value and that the person who has the control could make reasonable arrangements to keep them secret. These conditions are cumulative. In this situation, can banking data be appropriate by the business secrecy regime ? In our opinion this seems impossible to us, because the banking data and in particular certain personal data related to the banking activity are not secret. For example, the account number is not secret.
Finally, for some, the right of the database producer could answer the question of the ownership of bank data and fill the legal void. Indeed, the right of database producers is a sui generis right. Bank data may be subject to the regime laid down for database producers. The data can then be protected if there is a material, financial or human investment by the producer. It is also a means of appropriation.
Ultimately, although there is no specific regime for the ownership of bank data, natural persons benefit from a simple presumption of ownership. However, mechanisms of contract law and the right of database producers may allow banks to appropriate banking data.
Posted from my blog with SteemPress : http://blog.economie-numerique.net/2019/06/23/the-ownership-of-banking-data/