Re-formulating the public-private divide in light of the emergence of data dependent utilities under article 6 of the GDPR

This thesis argues that the public sphere should not be confined to states and that data dependent utilities (DDUs) belong in the public sphere. DDUs are essential utilities for social and political engagement which are inherently and fully dependent on processing personal data. In this respect, the thesis challenges the traditional state-centric public-private divide (namely the consideration of the public as the governmental sphere and the private as the non-governmental sphere) in legal frameworks, specifically under article 6 of the General Data Protection Regulation (GDPR) which lays down the lawfulness grounds for personal data processing and is thus the foundation of each personal data processing activity. It argues that this state-centric approach does not respond to the versatile powers of DDUs and instead exacerbates concerns by considering DDUs as private entities and allowing them to arbitrarily apply article 6 in detriment to individuals’ autonomy and democratic values. In this regard, relying on the res publica example from the Roman Republic era, this thesis offers a novel formula on the constituents of the public sphere which are referred as public features and formulated as: (i) public matters, (ii) public utilities, and (iii) power, as a barrier before the governance and the use of these utilities. The thesis then claims that DDUs share these features, hence they belong in the public sphere; and it argues that once we place them in the public sphere we could only then address the externalities that land both on the individuals and society at large. It then offers a normative account on how the grounds in article 6 of the GDPR – specifically consent, necessity of a performance of a contract, legitimate interest, and public interest grounds should be applied to DDUs considering their public features. As such, the thesis aims to transform these currently toothless lawfulness grounds into functioning ones upon adopting a DDU-targeted approach, thus diminishing DDUs’ exploitative business model.