Private Data Law. New Technologies and the Tensions between Data Protection and Private Law

将联合收割机跟踪技术、人工智能和物联网结合成万物互联的网络环境的日益建立也跨越了传统法律领域的界限。本书认为，这需要制定一部“私人数据法”，将欧盟数据保护法纳入成员国私法。本书的第一部分为这一奋进奠定了技术和经济基础。从这次审查中出现了三个具体的监管挑战：个人数据的多重关系，这体现在频繁包含第三方提供商（第三方跟踪）;关于个人数据的风险和利益的内在矛盾;以及各自数据主体的数据保护偏好的异质性。本书的第二部分考察了现行数据保护法下可用的资源，普通私法应对这些挑战。对数据保护法的分析表明，基于数据的商业模式以及物联网的发展都受到数据保护法的重大限制，特别是由于GDPR禁止搭售。然而，这些限制原则上可以通过有效的合同协议或通过各提供商自愿提供数据安全选项来克服。这些通向合法性的途径反过来又把交换关系的契约设计置于聚光灯下。在这方面，方法论的重点在于与GDPR规则并行的成员国私法的适用性。本书将数据保护法下的同意声明纳入德国民法典（BGB）的原则，并详细审查了BGB“监管部分”对合同效力的限制。然而，从总体角度来看，数据保护和民法下的授权结构在法律的和事实方面都存在相当大的缺陷。在具体的决策情况下，绝大多数用户没有充分考虑数据保护问题，无法在这方面做出有意识和知情的决定。因此，本书的第三部分表明，用户需要以双重方式获得支持，以科普上述三种监管风险：在技术上，通过日益自主的数据保护助手;在监管方面，通过数据安全选项的权利。自动化数据收集和分析必须通过自动化通信和执行异构隐私偏好来回答;知情同意必须由技术同意取代。只有这样，才能在高度网络化的环境中实现交换过程的自主设计，至少是以机器为媒介的受限形式。这也意味着，新兴的数据处理技术不仅应该被视为一种风险，而且应该被视为自决和数据保护的机会。

The increasing establishment of networked environments that combine tracking technologies, Artificial Intelligence and the Internet of Things into an Internet of Everything also crosses the boundaries of traditional fields of law. It requires, this book argues, the creation of a “private data law” which integrates EU data protection law into Member State private law.The first part of the book lays the technical and economic foundations for this endeavor. Three specific regulatory challenges emerge from this review: the multi-relationality of personal data, which manifests itself in the frequent inclusion of third-party providers (third-party tracking); the inherent ambivalence concerning the risks and benefits of personal data; and the heterogeneity of data protection preferences of the respective data subjects.The second part of the book examines the resources available under current data protection law and general private law to address these challenges. The analysis of data protection law shows that data-based business models, but also the development of the Internet of Things, are subject to significant limits under data protection law, in particular due to the tying prohibition under the GDPR. However, these limits could in principle be overcome by valid contractual agreements, or by the voluntary offer of a data-safe option by the respective providers. These paths to legality, in turn, put the contractual design of the exchange relationships in the limelight. In this, the methodological focus rests on the applicability of Member State private law in parallel to the GDPR rules. The book integrates the declaration of consent under data protection law into the doctrine of the German Civil Code (BGB) and examines in detail limits of contractual validity resulting from the ‘regulatory part’ of the BGB.From an overarching perspective, however, the enabling structures under data protection and civil law reveal considerable shortcomings, in both legal and factual terms. In concrete decision-making situations, the vast majority of users do not sufficiently consider data protection issues to make a conscious and informed decision in this respect. Hence, the third part of the book shows that users need to be supported in a twofold way to cope with the three regulatory risks mentioned: technically, by increasingly autonomous data protection assistants; and, in terms of regulation, by a right to a data-safe option. Automated data collection and analysis must be answered with automated communication and enforcement of heterogeneous privacy preferences; informed consent must be replaced by technological consent. Only in this way can an autonomous design of exchange processes in highly networked environments be realized, at least in a restricted form mediated by machines. This also implies that emerging, data-processing technologies should notonly be seen as a risk, but also as an opportunity for self-determination and data protection.