Private Law May Have Too Much Control Over Data, Says Professor

Private law has quietly taken over the regulation of new technologies and data, filling gaps left by public law and raising concerns about the unchecked power of business contracts, according to University of Virginia School of Law professor Elizabeth Rowe.

Rowe explores concerns that private law may have too much control over data in a new paper, “Private Law in Unregulated Spaces,” published by the New York University Law Review.

The paper highlights how contract law and intellectual property law have combined to define data ownership, allowing it to be monetized and controlled, often through private contracts that limit access and oversight. Developers of newer technologies that rely heavily on data, like implantable medical devices, facial recognition technology and algorithmic models in the criminal justice system, use private contracts — unbounded by public law — to define key terms of ownership, access and liability. These terms often limit public scrutiny, accountability and transparency, she argues. 

Rowe suggests exploring public law approaches such as those used in the European Union to govern artificial intelligence, and modifying tort law to address gaps in assigning liability for potential harms from new technologies.

Rowe co-directs the Center on Intellectual Property Law and the LawTech Center. In a Q&A, she answers questions about potential public-private vulnerabilities, asserting that there are opportunities to balance public and private interests through legal reframing.

What sparked your interest in exploring the intersection of private law and data ownership?

My interest in writing this paper arose out of several prior research projects where I explored the tensions between intellectual property, new technologies and regulation in various contexts. I observed that IP rights, especially trade secrecy, provided a strong, almost impenetrable, wall of protection for owners. But there was something else at play, facilitating these various transactions and even further bolstering the intellectual property rights: the contracts. This project was intended to explore that phenomenon.

What are some of the most significant risks associated with private law governing data ownership without public law guardrails?

The power and discretion to limit access in whatever way an owner chooses, without the benefit of the kinds of exceptions we have with real property, has caused particular tension with public values. Those concerns are especially challenging in private-public partnerships where the government acquires and uses technology created by private companies to provide public functions.

In the criminal justice system, for instance, when the government enters into contracts with private vendors for technologies such as facial recognition or AI that detects gun shots, those vendors assert ownership over their data, algorithms, and practically anything else that can be protected by intellectual property and trade secrecy. Even when the technologies are used to serving critical public functions like law enforcement and the administration of justice, they are cloaked in secrecy. Accordingly, concerns arise about such public values like transparency and accountability.

How do you see the balance between public and private law evolving in the context of new and emerging technologies?

In the U.S., regulation of data, AI and new technologies continues to be sparse or nonexistent. This is especially so on the federal level, where no federal regulation exists for determining data ownership and access regarding, for instance, biometric data. So, private law mediated through contracts governs the vacuum, for better or worse. Going forward, how best to achieve a better balance depends on the particular context and will require navigating the tensions between private intellectual property rights and the public interest.

I suggest consideration of high-level structural responses such as possible expansion of public law in some areas to reach or modify contractual agreements regarding ownership of data resources. Recognizing, however, that the question of public regulation is a complex and highly nuanced issue, I take no specific normative stance on where and whether limits should exist.

In your essay, you propose the formula “Intellectual property + Contracts = Property squared.” Could you elaborate on the implications of this equation for the future of data ownership?

The potential significance of this equation is that private law becomes the de facto regulatory framework for new technologies. That is because contractual provisions that declare ownership, coupled with intellectual property rights, create a new property formulation. The practical bottom line is that property ownership means control. Thus, when we view data resources as commodities of trade, self-declared owners have the power and discretion to limit and control access in whatever way they choose. So, for example, having a medical device implanted in your body does not mean you have access, control or rights to the data coming out of your own body, because a contract (to which you are not a party) says so.

How does the European Union’s approach to regulating new technologies differ from that of the United States, and what can be learned from these differences?

In general, public law and regulation are more salient in the EU, in contrast to the U.S. legal system, where private law and property rights prevail. Furthermore, regulation of new technologies for the public interest, while stalled in the U.S., has moved at a feverish pace in the EU. For example, for the last few years, the EU has been working on a comprehensive law to regulate artificial intelligence. With respect to liability issues, the EU has also proposed the AI Liability Directive, which is aimed at ensuring that, in non-contractual situations, victims of damage caused by AI can seek legal recourse in the same way that victims of harm caused by other products can.