I. Introduction

In late spring of 2011, Dutch Parliament debated the transposition of the revised EU Telecoms Package into national law.1 This debate became the centre of public interest after telecom provider KPN proudly explained to its investors that they were ready to start using Deep Packet Inspection (DPI) to see which applications generated data traffic over their wireless network. Marco Visser stated: ‘We will not block services but […] we will price them’.2 Packets in this context are units of data at the network layer level of telecommunications. Each packet consists of control information (containing, among others, the origin and destination of the packet) and user data (the actual data being sent). DPI involves analysing data packets for both their control information and their user data.3

Responding to declining Short Message Service (SMS) revenues, KPN announced the company had the intention to use this DPI technology to charge for the use of instant messaging (IM) applications on smartphones (apps). Use of IM apps (like WhatsApp) substituted consumers’ use of individually priced SMS messages. This dramatically reduced KPN’s profits. DPI would allow KPN to reverse this trend, as it enabled the company to distinguish IM traffic from other traffic, and charge a higher price for the IM services. Consequently, KPN would no longer provide a “neutral” network, which would treat all types of traffic equally, but would be able to distinguish between different origins of traffic (i.e. different apps) and use different policies for the corresponding services. For this purpose, KPN would analyse the user data within packets sent across its network, as well as their control information – hence the name Deep Packet Inspection. This is, to some extent, analogous to the postman reading a letter to see whether it is priority mail, instead of looking at the indication and stamps on the envelope. Although imperfect in many ways, this analogy indicates the privacy implications of DPI.

A. Parliament steps in

KPN’s announcement brought the net neutrality debate to Dutch Parliament. Essentially, net neutrality is about control: are network operators allowed to ‘block […] or prioritise […] certain network traffic or traffic from particular sources’?4 Should KPN be allowed to charge its subscribers a premium for their use of specific applications?

Several non-governing minority parties proposed an amendment to the Bill implementing the revised Telecoms Package, demanding network neutrality from all telecommunications providers and specifically prohibiting the analysis of traffic by content other than for technical reasons (e.g. ensuring network integrity or security). The proposed amendment was meant to secure the possible benefits of a neutral network,5 but also to secure consumers’ privacy. DPI, these parties argued, gave telecommunications providers an unhealthy degree of insight into consumers’ private communications, since it must include analysis of their content.6

Initially, the cabinet minister responsible for the Bill opposed the amendment. In his view, telecoms law already provided safeguards against DPI. For example, it prohibited telecom providers from secretly ‘limiting access to and/or use of services’ as well as secretly using ‘procedures to measure and shape traffic’: providers could use DPI for price discrimination only if they told consumers beforehand.7 If consumers objected to a provider’s use of DPI, they could choose another provider. Imposing net neutrality, he contended, could make the Dutch market less attractive to investors because it would close an avenue of revenue maximisation, left open in the Telecoms Package. He also suggested that BEREC, the European body of regulators,8 was better suited to regulate net neutrality than the national legislator. A specific requirement within the Netherlands might undo the EU efforts at harmonising the internal market for telecom services. In the end however, after some debate, the minister accepted the proposed amendment and Parliament adopted the amendment, thereby including the net neutrality obligation in the Dutch Telecommunications Act.9

B. Consumer participation options for privacy contracts

The network neutrality debate hints at a wider privacy issue: nowadays, consumer contracts for everyday services allow private parties to collect and use large quantities of data. This data identifies individuals, for example by making use of cookies, e-mail addresses, shipping addresses, device identifiers (and other hardware properties), subscriber information, account numbers or unique tokens like loyalty cards. The term “data” can describe the contents of communications but also traffic data or metadata – “data about data”, e.g. timestamps and location identifiers. All this data can reveal much about individuals. If, and to the extent that, such data is about identified or identifiable individuals, it qualifies as personal data as per article 2(a) of the Data Protection Directive, which implies that the processing of the data has to comply with the rules of said directive.10

Usually, these consumer contracts offer benefits to consumers that are unrelated to their personal data. Sometimes, these contracts are unavoidable for the consumer (everybody needs banking, telecommunications and public transport). Sometimes consumers enter into these contracts to obtain a side benefit to another transaction (e.g. using a loyalty program to obtain a rebate from a retailer). Sometimes the exchange of personal data for services is an essential performance of the contract (e.g. when using a social network site) and sometimes the data only has value for the party collecting it, for example when a web site uses tracking cookies to follow the behaviour of every website visitor.

The ubiquity of these contracts is the result of the increased datafication11 of daily life and the increasing sophistication of algorithms for analysis. This has made such data valuable to an increasing number of businesses. Often the aim is to retain data indefinitely in order to create an enduring profile of the individuals, for example to analyse (online) shopping habits to determine whether a consumer is pregnant.12 These and similar developments have spawned the phrase “big data” to indicating the volume, variety and velocity of the data streams.13 Obviously big data can have privacy implications.14

This article uses the term ‘privacy contracts’ for all varieties of such contracts.15 Privacy contracts can take the form of written two-party agreements, but they are usually “agreed upon” by means of non-negotiable terms and conditions or unilateral privacy statements on websites. These contracts often govern services that consumers cannot easily do without (like telecommunications, banking or grocery shopping) or that are increasingly a part of modern life (like being part of a social network or using household appliances like smart TV’s).16

Consumers have reduced opportunities for participation in determining the contents of privacy contracts: they cannot voice their opinion on the contents, the contents are not influenced by their opinions, and not entering into the contract is often not an option. KPN’s announcement to start pricing IM apps by using DPI increased awareness among consumers and legislators that contracts about the use of telecommunication services are indeed privacy contracts, i.e. contracts pertaining to the use of personal data and its privacy implications.

The Dutch Parliamentary net neutrality debate compared two large-scale decision-making processes that could decide on the terms of privacy contracts: the market will and the political process. Komesar calls these large-scale processes institutions; he distinguishes the market, the political process and the courts.17 Seen from this perspective, the case of DPI is an example of institutional choice. This can be illustrated by the subsequent (and partly hypothetical) stages in the net neutrality discussion:

  • First stage: after intense lobbying by interest groups including the telecoms industry,18 the aforementioned revised Telecoms package explicitly left net neutrality decisions to the market. If too many consumers refuse to enter into a contract with KPN, another provider will offer a better deal or KPN will change their offering.
  • Second stage: In the Netherlands, a number of interest groups and Parliament felt that users could be forced or misled to agree to DPI contracts. For them, DPI was equal to permanent unwarranted eavesdropping on private communications.19 They claimed these decisions should be made in the political process. The permissible terms of all privacy contracts between subscribers and telecoms providers were changed as a result.20
  • Third (hypothetical) stage: Had both the market and the political process failed to sufficiently protect consumer privacy, a consumer would be entitled to involve the national courts. Article 8 of the European Convention of Human Rights (ECHR) guarantees the right to respect for one’s ‘private and family life, his home and (…) correspondence’. Article 13 of the Convention requires an effective remedy before a national court for violations of this right. However, a verdict from a court would typically affect only the contracts to which the litigants are a party.

Different institutions might offer different outcomes. Evidently, the market, the political process and the courts all offer different opportunities for effective consumer participation: the market allows for negotiations on particular contract terms; consumers can elect legislators and authorise them to impose rules to govern all contracts; courts settle disputes between consumers and their contract partners.

Participation opportunities for consumers are of interest to privacy contracts because participation is one of three traditional legitimacy requirements, together with transparency and accountability, for an act that affects a fundamental right.21 A society, such as a State or the European Union, can deliberately choose which institution decides on privacy contracts. Not deciding on how to offer participation opportunities or how to meet legitimacy requirements could unnecessarily impede efficient decision-making.

C. Consumer participation as a question of Institutional Choice

Consumer participation takes different forms in different institutions: they act as citizens, voters, litigants and participants in consumer interest groups. They are the holders of specific protections in the Charter of Fundamental Rights of the European Union (the Charter).22 The term “consumers” is used throughout this article, to easily distinguish them from their contract partners, indicated as “producers”. Producers are providers of goods and services and the controllers and processors of personal data within the market,23 whilst in other institutions they can operate as lobbyists or litigants.

Certain participation possibilities may be more desirable than others, depending on the policy objectives a society wants to achieve, and the level of privacy protection it wishes to offer. In this context, the following question becomes relevant:

When deciding on privacy contracts in the age of big data, how does institutional choice affect consumer participation opportunities and how does it affect the feasibility of policy objectives in the European multilevel jurisdiction?

The question will be addressed by answering the following sub-questions:

  1. Why does institutional choice matter for privacy protection?
  2. How do the possibilities of participation for consumers and producers qualitatively compare between institutions, if decisions on consumer privacy were to be left to the market, the political process or the courts, respectively?
  3. What does the analysis imply for different policy objectives concerning the impact of big data on ­society?

For practical reasons the scope of this article is restricted to privacy contracts in which one party qualifies as a consumer.24 This implies that criminal or national security investigations, employment relationships and torts are not covered. Further, since the comparison of the effectiveness of institutions is not directly dependent on substantive law, aspects of substantive law are not addressed. Moreover, as data protection and privacy protection are not always easily distinguished and sometimes used interchangeably, this article distinguishes between both concepts only when this is required for the subject at hand.25

D. Comparative Institutional Analysis – Methodological notes

This article answers the questions set out above by performing a comparative institutional analysis between the political process, the market and the courts at both national and European Union levels. The comparison focuses on each institution’s possibilities for providing effective participation opportunities to ­ consumers.

Comparison between institutions is possible if the same individuals participate in all compared institutions. In the case of big data and privacy contracts, we assume that buyers and sellers, or consumers and producers, or litigants before the courts and voters and lobbyists are indeed members of the same mass of people. Comparison is useful, even though no single institution can be expected to perform perfectly. Institutional performance deteriorates when the number and complexity of the required decisions increase. In these cases, ‘institutions tend to move together’.26 Even the best available institutional option may leave much to be desired.

In the model offered by Komesar, the essence of institutional comparison lies in comparing the incentives that drive the actions of the mass of participants in these institutions (consumers, producers, litigants, voters, lobbyists). He calls this the dynamics of participation. These dynamics are determined by a simple comparison of costs and benefits.27

  • The benefits of participation are dependent on the distribution of stakes at play for the participants. This distribution is determined by the average per capita stakes within the population and by the extent to which the stakes vary within the population.
  • The costs of participation are the costs of information and the costs of organising collective action. Depending on the institution, participation costs are known as transaction costs, litigation costs or political participation costs. In the model of regulatory capture offered by Levine and Forrence, they can also include monitoring costs.28

E. Structure of this article

The relevance and the specifics of the application of comparative institutional analysis to the research question are addressed in section II. Section III contains the actual analysis. Section IV then applies the outcome of this analysis to a number of possible policy objectives. The final section contains some concluding remarks.

II. How institutions matter for consumer privacy

To effectively make use of a legal right, it must be reasonably achievable. If two parties’ interests are not fully aligned and a decision is required, a rule of substantive law usually cannot fully provide its’ intended protection because decisions always have a cost. Coase’s theory of transaction costs suggests that some parties will not seek a decision if the cost of getting that decision outweighs its benefits.29

The level of legal protection offered by substantive law can therefore be expected to be lower if transaction costs are higher.30 Transaction costs vary within institutions, and they may vary from State to State, causing different levels of legal protection. To prevent these differences from becoming excessive, both the European Union and the ECHR set minimum standards for the effectiveness of legal decision-making processes, at least before the courts.31

Transaction costs will rise in every institution if numbers and complexity increase. Therefore, it is of particular relevance that, as a result of datafication, both the number and the complexity of decisions on privacy contracts have increased substantially. The number of decisions is related to the rising number of privacy contracts and the number of transactions generating personal data, as indicated earlier. The complexity of privacy contracts is also increasing, particularly in terms of (a) the technology used for executing them, and (b) the number of parties involved. Technology has increased the complexity of privacy contracts: the fact that technological aspects need not be disclosed to consumers32 makes it difficult to determine whether a particular use of personal data remains within the boundaries set in the contract, or even to determine those boundaries themselves. The increasing number of parties involved increases complexity, because data will be collected from multiple sources and shared with multiple users. This may result in multilateral exchanges of personal data based on bilateral contracts.

In the market, increasing numbers and complexity can lead to the use of form contracts, eliminating party bargaining options. In the political process, increasing numbers and complexity make any law less likely to be well suited to the majority of transactions. The courts have limited capacity to efficiently provide every market party with the decisions they need. Institutional choice when deciding on privacy contracts is a matter of choosing among ‘imperfect alternatives’.33

A. Everything has a price: privacy analysis by cost and benefit

Coase’s theory of transaction costs dictates that if an institution decides on privacy contracts, the value of these contracts plays an important part in the dynamics of participation. This presents a problem for two reasons. Firstly, privacy – as a fundamental right and an aspect of human dignity – may be considered not to have a monetary value, or even not suitable to be bought and sold.34 Secondly, many privacy contracts do not specifically put a monetary value on the personal data portion of the performance. This incompatibility manifests itself at the level of individual transactions (the microeconomic level) and at the level of privacy as a factor promoting or hindering societal prosperity or wealth (the macroeconomic level).

To facilitate decision-making, law and economic theory attach economic value to privacy in an indirect way. The law solves the microeconomic part of the problem by separating decisions on the legitimate processing of personal data from decisions on privacy. The latter lacks a precise definition. Evaluating conformity with article 8 requires judicial decisions, which are difficult to achieve, low in volume and come with high transaction costs. The Data Protection Directive simplifies this process by allowing a high volume of decisions at a low cost. It does this both by making compliance easier for producers (by setting relatively simple standards for the processing of personal data) and by authorising consumers to enter into agreements (art. 7(a-b), Data Protection Directive). This, by the way, makes the Directive an example of institutional choice.

Requiring consumers’ agreement enables them to exchange their personal data for services without money changing hands. The business model of Google is a good example. Google provides its users with an e-mail service, online document collaboration, photo and video sharing services, a searchable map of the world and a search engine to the World Wide Web. for free. Google also generates and populates databases for and from all these activities. Taken together, these are Google’s costs. The company then monetises the users’ personal data by offering targeted advertising options within its’ services to third parties (an example of a two-sided market).35 The revenues of this operation exceeded the costs by approximately a billion dollars per month in the third quarter of 2013.36 For consumers, Google’s “free” services apparently offer good value. The price they pay is the risk of losing some personal privacy. Many consumers (implicitly) decide that this is a good deal, whether or not they are aware of all the privacy implications of their contracts.

Economic theory, on the other hand, provides a concept for comparing costs and benefits at the macroeconomic level. Loss of privacy for individuals or groups can be considered a form of social cost.37 This cost does not manifest itself in individual transactions and is therefore not suitable for analysing participation in the market. It can, however, be taken into account in the political process or the courts, for example when considering admissibility of terms, taxation, bona fides or the common good.

B. All created unequal: the catalogue of comparisons

This article compares markets, the political process and courts at the levels of Member States and the European Union. Institutions at the level of the Council of Europe (CoE) are excluded. They are not open to the same mass of participants – there is no common market in the CoE, and neither its political process nor the European Court of Human Rights (ECtHR) is accessible to consumers or producers participating at the EU or national levels. The ECtHR only handles cases against a State or between States.38 The officials taking part in the political process of the CoE are not appointed after general elections. The verdicts of the ECtHR do not bind the institutions of the EU, although the EU accepts the ECtHR’s interpretation of human rights as its own (article 6, TEU).

Other comparisons that can be eliminated are:

  • National courts cannot be compared to the European Court of Justice. As far as disputes over privacy contracts between consumers and producers are concerned, the latter court is inaccessible to litigants. If litigants reside in the same State, national courts have jurisdiction. If litigants reside in different Member States, the so-called Brussels I regulation decides which national court has jurisdiction.39 In all other cases, domestic law decides whether the national courts have jurisdiction. If a dispute before a national court requires a uniform interpretation of EU law, the highest national court is required to put the matter before the CJEU (art. 267, TFEU). However, this is only to interpret EU law, not to decide the case.
  • Comparing the European internal market to other markets is impossible because there is no equivalent institution at the national level. Where markets still have a strong national focus (e.g. telecommunications, where the ITU still allows for price differentiation based on traffic crossing national borders),40 comparison will effectively be limited to the national level.

Therefore, this article only compares:

  • At the national level: the internal market, the political process and the courts;
  • At the EU level: the internal market and the political process;
  • Between the national and the EU levels: the market and the political process.

III. National and European institutions compared

The following comparisons assume that privacy contracts do not specify the processing of personal data for monetary compensation as the primary performance of one of the parties. This is probably a safe assumption given permission for collection of personal data is usually part of a contract with a wider scope. Many of these contracts do not involve payment, e.g. the terms of use of social networks or other web services. In those contracts that do involve monetary exchange (telephone contracts, bank accounts), the privacy aspect is usually not the main consideration.

A. Privacy contracts at the national level

1. In the market

The terms and conditions of a privacy contract are usually not negotiable. As a result, the decision of the market is effectively the decision of the party who drafts the contract. In a transaction between a consumer and a producer, this will be the producer.

The dynamics of participation in this decision making process can be described as follows. As for the benefits in terms of monetary exchange, the stakes per contract are roughly equivalent for consumers and producers. The stakes per contract are supposedly symmetrical. Competition in the market will presumably cause the price the consumer pays to be near cost, so the price for the services will only be marginally different between producers for an equivalent level of service. If no money is changing hands, the “price” one consumer pays is close to the marginal cost of operating the service for one more consumer. If the number of consumers is large enough the same is probably true for the increase in profits that a producer can obtain by making the personal data of one more consumer available for personalised advertising services.

The large number of contracts for producers makes their per capita stakes much higher than consumers’. Producers have the combined value of all their privacy contracts at stake. The earlier example of Google’s 2013 quarterly profits indicates that these stakes can indeed be considerable.41

In this article the distribution of stakes over consumers and producers as a group is assumed to be close to homogenous. For consumers, this assumption is based on the idea that consumers as a group have roughly the same need for these services. For the scope of this article, this seems a safe assumption given there is no discernible group of consumers that has a lot more depending on a phone contract, a loyalty card or a Facebook account, than the average of all consumers combined.42 For producers engaging in privacy contracts, distribution of stakes is assumed to be homogenous as a starting assumption in the absence of sufficient data. Producers’ stakes are not easily determined, with some enterprises standing to gain more from privacy contracts than others; depending on their size, their business case and whether they wield specific market power. Determining the per capita stakes and distribution of stakes for producers is further complicated by the recent tendency of actors in traditionally one-sided markets, to make their market two-sided.43 To keep the comparison manageable, this subject is not explored further in this article.

On the costs side, consumers face higher costs of participation than producers do. The costs of information, for example of reading the terms of a privacy contract, can be significant.44 These terms will tell a consumer whether he will incur an extra cost for using IM apps on his smartphone, or what liberties a service provider reserves for himself in sharing and using personal data. Every consumer incurs this cost for every contract he or she considers entering into. He or she is a one-shotter every time because the terms are different for every contract. A producer on the other hand only has to draft the contract once. The cost of information can thereby be spread out over a large number of contracts, resulting in a very low cost of information per transaction. A producer is the repeat player in the market.45

The cost of organisation is also lower for producers.46 A producer of even moderate size can organise collective bargaining force by forming alliances with only a few other producers to combine the interests of a relatively large portion of the market, for example in a trade association (presuming this is possible without violating article 101 TFEU). Although it is true that consumers can – and do – organise themselves into consumer rights associations, the large number, the low per capita stakes, and the homogenous nature of the mass of consumers, means that even these associations usually have to divide their attention between many subjects. Consumer associations focusing on privacy concerns are regularly struggling for money, indicating that resource pooling does not always raise sufficient funds.47

All in all, when bargaining for a privacy contract in the market, consumers can be said to be at a disadvantage when compared to producers. They have only small stakes per contract and the presumed homogenous distribution of stakes makes it more difficult to organise buying power to negotiate better terms. They also tend to qualify as one-shotters, with little opportunities to gain significant experience. Producers on the other hand, have the opportunity to benefit from repeat-player status by using the same contract repeatedly. The value of all privacy contracts combined raise their stakes and costs of organisation are low because of their low numbers. This encourages them to invest larger amounts of resources into the contents of privacy contracts.

2. In the political process

In the political process, the per capita stakes for producers are still determined by the value of all their privacy contracts combined. However, for consumers acting as a society with the ability to affect the contents of all privacy contracts at once by means of elected representatives, per capita stakes can also increase. Combining the value of all voters, the stakes are increased from the value of one privacy contract per transaction, to the social cost of privacy.48 These increased stakes encourage resource pooling for voters, which helps in levelling the playing field on the benefit side when compared to the market. Participants also take on different roles, consumers generally acting as voters and producers active as – or via – lobbyists.

Although votes usually have identical weight for all voters, the distribution of stakes in the political process is possibly less homogenous than in the market. For example, if a political party does not consider privacy contracts an issue for the past or coming elections platform, voters and legislators for this party can be said to have lower stakes in privacy contracts. Producers with large stakes in a certain outcome (or status quo) can exploit differences between political parties by concentrating their lobbying efforts, or donations, to benefit parties with favourable viewpoints. Unevenly distributed stakes will have a positive effect on the formation of pressure groups or political action committees.

Consumers may not stand to profit too much from this change in dynamics. It is not easy to attach a monetary value to privacy as a social cost. Therefore the increased stakes do not easily translate to voters’ increased willingness to spend money on participation. Producers do not have to deal with this uncertainty to determine how much they want to spend.

The costs of participating in the political process are usually the cost of gathering information, popular campaigning and influencing legislators. These processes are used to organise and spread information among voters to promote public awareness, to gather support among voters and to bring specific viewpoints across to legislators, to influence their political activities (e.g. by hiring lobbyists). These costs can be high, which – at least in theory – again works in favour of producers, who have higher per capita stakes and correspondingly larger resources at their disposal.

When compared to the market, the cost of participation in the political process for consumers is either lower or higher, depending on a number of circumstances. Their costs of organisation can be reduced if groups of voters are pre-organised in political parties or interest groups by reducing sunk costs. This lowers the cost of activities for subsequent issues.49 In the DPI/net neutrality example, the involvement of existing political parties and interest groups made all the difference, even if the parties pushing for the amendment did not form a majority in Parliament. On the other hand, if none of the political parties see privacy contracts as an important issue, the low per-capita stakes for voters work to their disadvantage as they do in the market. Producers can use this as an opportunity to lobby all parties in parliament, increasing the costs of organisation for consumers. In those cases, pressure groups or political action committees have to find another way to influence legislators, increasing the cost of organisation. Seeking press coverage is one possible way to reduce these costs. As was seen in the DPI/net neutrality example, press coverage (triggered by statements of interest groups) was the second important factor in influencing politicians. It increased awareness among legislators for privacy aspects of DPI and probably alerted a large number of voters who were unaware of KPN’s plans. This added to the effectiveness of organised lobbying from consumers’ action committees.

Press coverage can reduce the opportunities for legislators to vote against their constituents’ interests: it reduces their slack.50 Legislators may use their slack to align their political activity to lobbying efforts of producers in return for money, career opportunities or other benefits. Assuming that fundamental rights in a business context remain relevant to the press establishment, engaging the press can significantly lower monitoring costs. As a result, the outcome of the political process is less likely to be a producers’ interest-group policy.51 Interest-group policy (or regulatory capture) is an example of minoritarian bias: decision making dominated by the influence of the concentrated interests of any high-stakes minority, such as the producers in the market for privacy contracts.52

All in all, the dynamics of participation in the national political process are more favourable to consumers than they are in the market, due to reduced sunk costs and monitoring costs. However, producers can also have considerable clout in the legislative process, mainly as a result of their high per capita stakes.

3. In the national courts

Before a court, the dynamics of participation change once again. On the benefit side, the stakes for a producer can be significant, if the verdict can affect a large number of contracts. On the consumer side, the stakes depend on whether the case is a matter of collective redress, or a dispute over a single contract. Collective redress allows for resource pooling among plaintiffs acting as one single litigator, increasing the per capita stakes by rolling many capita into one. However, collective redress is not always available.53 Furthermore, seeking collective redress may eliminate any advantages that domestic procedural law would grant individual consumers. In an individual action, the stakes for the consumer are once more no higher than the value of the contract, putting him at a disadvantage when compared to a high stakes producer.

Costs of participation in the courts are not fixed. Both parties are free to spend as much as they want on information or organisation. Rational litigants will not spend more than the stakes of the case as spending more will result in a net loss, even if the case is won. Under this assumption, producers will generally be prepared to spend more as a result of their higher per capita stakes. The party with more willingness to spend can usually rally more influential allies and produce more expert opinions.54 Information produced by one party may still increase both parties’ costs, even if it is available to the opposing party at no extra cost. For example, if judges act as ‘passive umpires’, they may regard information that is not countered as being undisputed by the opposing party.55 In such a case, producing excessive amounts of information can exhaust the means of the lower-stakes litigant.

The costs of organisation are also in the hands of the litigants, apart from the minimum costs associated with court fees and counsel. Once more, the party with the most resources at its disposal (e.g. more lawyers) could exhaust the resources of other parties and force them to give up, by using every available legal avenue and by complicating or lengthening proceedings to the maximum extent possible. The level of proficiency in the task at hand also determines the costs of organisation.56 By this metric, repeat players are at an advantage because they can use their experience in organising their work more efficiently. Producers are more likely to be repeat players because of the large number of contracts they engage in.

All this puts consumers at a clear disadvantage before the courts. To quote Prof. Giesen on Dutch law: ‘Private law […] does not deal in affirmative action for the weaker party (rather the opposite, really)’.57 The difference in per capita stakes makes it unlikely that an individual consumer can effectively challenge a privacy contract if there is no clear-cut legislation on which the Court can easily decide the case. The individual consumer is more likely to be a one-shotter. Compared to a producer with high stakes, the consumer also qualifies as a have-not.58 Producers are more likely to be repeat players in the court system. Given their increased stakes and proportionally larger resources, they qualify as the haves in this context.

Collective redress opportunities may compensate this disadvantage: it may increase the stakes, allow for resource pooling and reduce the costs of information. In high-profile test cases, publicizing fundraising efforts may lower the cost of organisation and engage experts that will regard increased publicity as a form of compensation, thus lowering the costs of information. However, this reintroduces some of the factors we already saw working against consumers in the market. Both test cases and collective redress rely on contributions from a large class of consumers. In a large class, the benefits of participation may again be low because of the evenly distributed stakes.

Substantive and procedural law offer another way to reduce consumers’ disadvantages. For example, Dutch consumers are usually entitled to a procedure before a court that does not require legal ­representation – a measure aimed specifically at reducing their costs of organisation.59 European consumers may profit from ex officio application of EU consumer protection law. As a side effect, the cost of information may be reduced in some cases.60 The effectiveness of these measures is not explored further in this article, as it goes beyond the scope of comparative institutional analysis.

It seems unlikely that these measures are able to compensate consumers’ disadvantage completely because producers’ per capita stakes remain much higher than consumers’. Galanter’s observation still rings true: before the courts, the haves come out ahead.61

4. Comparison at the national level

When seeking decisions on the contents of privacy contracts at the national level, participation opportunities for consumers compare unfavourably to those of producers in the market and the courts, and probably in the political process as well.

Consumer disadvantage is smallest when participating in the political process. Earlier organisational efforts lower the cost of organisation for consumers on new issues, even if these parties organise only a tiny fraction of the mass of consumers. The cost of participation can also turn out lower if privacy contracts continue to be of interest to the press. The macroeconomic aspect of the political process helps raise the stakes, from the value of a single contract to the value of privacy as a social cost of big data. The raised stakes help increase the resources available by encouraging resource pooling.

This smaller disadvantage is no guarantee for consumer success in the political process. Per-capita stakes for producers are high. The political process is therefore not immune to the lobbying force of concentrated minority interests. The results of the political process may still have a minoritarian bias.

For producers, the courts and the market are very efficient institutions to achieve their objectives. In the market, they enjoy low costs of information and organisation and the benefits of repeat player status. They are also motivated by high per capita stakes as a result of the large number of contracts.62 In court, where the stakes per decision may be higher than in the market, this difference is enhanced even further. In the political process, this advantage is reduced.

B. The market vs. the political process at the EU level

The dynamics of participation at the EU level differ from those at the national level for two reasons. Firstly the institutions themselves are different, and secondly the scope of the EU is much larger. Comparing different institutions at the EU level is therefore not easily separated from comparing their similar institutions between both levels. As a result, this section addresses both comparisons simultaneously. This subsection offers conclusions for the comparison on the EU level. Subsection C briefly summarises the comparison between institutions at the national and the EU-levels.

1. In the market

For consumers, the dynamics of participation on the European level are partially similar to those on the national level. The effects of being a one-shot player with stakes not exceeding the value of a single contract are the same.

Consumers’ benefits of participation are lower in the internal market. The larger number of individuals makes the distribution of stakes even more uniform.63 This again means there probably is no substantial subgroup of consumers for which the benefits of participation are significantly higher. This lowers the incentives for consumers to organise themselves. The stakes for a single consumer still don’t exceed the value of a privacy contract.

Consumers also face higher costs of participation at the European level. A penalty on participation in the market at the European level exists if cross-border transactions bear higher costs than domestic transactions, as is the case with telephone or wireless Internet contracts.64 For most consumers, the cost of information rises if this involves acquiring information in a foreign language that needs translation. This applies both to the contents of the contract and to the law of the land. Translation costs may similarly increase the cost of organisation for consumers, for example if they want to organise across these barriers. Incentives for compensating these increased costs are low because of the low per capita stakes.

Consumers are not alone in thinking (and actually experiencing) that cross-border participation is expensive. The European Commission has undertaken specific efforts to reduce the costs translating the law of sales by proposing a Common European Sales Law.65 Furthermore, the Commission subsidises consumer organisations, as can be seen in the financial statements of BEUC (Bureau Européen des Unions de Consommateurs). Even though national consumer associations contribute the greatest share of the expenses, the European Commission provided 41% of BEUC’s revenues in 2013, indicating that voluntary resource pooling alone cannot cover the increased costs.66

Conversely, for producers the dynamics of participation on the internal market are working in their favour. The potential number of contracts a producer can enter into is increased, raising the per-capita stakes. This is the same for all producers engaging in privacy contracts. Therefore, producers can still be seen as a small, more-or-less uniform group with high per-capita stakes.

The opportunity to spread the costs of doing business over a larger number of contracts will encourage producers to participate in the market on the EU level. Trading in the internal market potentially lowers costs of participation per contract for producers, making one more contract more profitable. The internal market is one of the largest economic areas in the world, offering a large potential for additional contracts.67 As a side effect, this may enhance the benefits of repeat player status.

The free movement of personal data, guaranteed by the Data Protection Directive, lowers compliance costs associated with data processing. Compliance with data protection legislation in one Member State guarantees free movement of these data to other Member States.68 As a result, large telecom providers and most social network websites tend to work in several Member States simultaneously. This, in turn, helps reduce costs even further, for example by consolidation of processing equipment and administrative functions. Many producers engaging in privacy contracts formally rely on a single point of presence in the EU. For example, LinkedIn and Facebook provide an address in the Republic of Ireland for correspondence on data protection matters.69

2. The political process

For consumers, the political process at the EU level compares unfavourably to its equivalent at the national level. On the benefit side, the distribution of stakes for voters is strongly homogenised by the combination of national seats from 28 countries into 7 larger parties in the European Parliament. This is reflected in voter turnout. Average turnout in all Member States in 2014 was 42,54%, trailing far behind typical voter turnouts in national general elections.70

The per capita stakes at the EU level are larger than on the national level. EU decisions affect a much larger number of citizens and businesses, increasing their impact on privacy as a social cost. They also affect legislation in many countries, eliminating opportunities for consumers to find a better legal arrangement in another Member State. The stakes may however appear smaller to voters, because the European Parliament’s powers are less pronounced than those of national parliaments. The EP can pass a motion of censure on the entire Commission only with a two-thirds majority whereas national parliaments can usually do so with a simple majority and for single Ministers.71 Compared to national parliaments, the EP is elected for a longer period of time and it cannot be dissolved to enable voter participation in unresolved disputes between the EP, the Council and the Commission.72 Instead, the resolution of conflicts between these bodies is referred to a conciliation committee without any possibility of voter input.73 This makes voting less attractive.

Consumers face higher costs of organisation in the EU than on the national level. A very simple example is the increased physical distance, with most voters needing to travel abroad, to Brussels or Strasbourg, if they want to interact with legislators directly. Another aspect is the large number of legislators and the large number of venues where participation may be required: Commissioners, MEP’s and their staff for primary law, and the Commission, agencies and comitology for secondary law.74 Representatives in the European Parliament are under pressure not only from their political party on the national level, but also from the European parties on the EP level. Furthermore, no single national delegation can dominate a party in the EP. This decreases the possible benefits of “piggybacking” on previous organisation efforts. European Parliament proceedings usually receive far less coverage in the national press, increasing the costs of information and monitoring costs for consumers. This gives legislators more possibilities to decide against voters’ interests.75

The higher costs and the decreased benefits of participation at the EU level leave consumer interest groups short of money. Participation in the political process by consumer organisations requires external funding from the European Commission.76 BEUC and the national consumer associations are appointed as members of the European Consumer Consultative Group and in this capacity they are eligible for subsidies.77 The Commission decision establishing the group states that it is tasked with consumer interests in general, which means that it needs to spread itself thin over all consumer issues. BEUC is thus not a special interest privacy group. Such groups do exist, but even a group like European Digital Rights also had to rely on a grant from the European Commission of approximately 25% of their annual budget in 2013.78 Like in the market, resource pooling in the political process at the European level apparently does not sufficiently offset the higher costs of organisation at the EU level.

For producers, the benefits are quite large. The European political process is a high-stakes game because it regulates the internal market. This makes the distribution of stakes almost uniform, but at a very high level. Producers have a strong incentive to organise, even if the costs of organisation are high.

Like consumers, producers face higher costs of information and organisation in Brussels – but in accordance with their increased stakes, this appears to present no extra problems. Producers are the haves in this institution. They are able to pool and spend considerable resources and do not need EC subsidies. If lobbying efforts in the United States are any indication, spending several million on influencing legislation is an acceptable proposition to many individual companies.79 Producers have formed their own lobbying groups dedicated to data protection and privacy issues.80 Like consumers at the national level, producers can also benefit from earlier organisation efforts. Many industries that engage in privacy contracts have already formed interest groups for their core business, like the European Competitive Telecommunications Association, Digital Europe and the Euro Banking Association. When lobbying for privacy contracts legislation, this helps them avoid sunk costs.

It is therefore no surprise that high-stakes players are better represented than consumers in the Brussels lobbying circuit. In 2007, commercial and professional interests made up 63% of all permanent representations in Brussels, whilst consumer and human rights interests accounted for 13%.81 Their apparent abundance of funding puts them at an advantage over consumer special interest groups like EDRi, whilst general-interest groups like BEUC are probably already stretched thin because of their wide scope. These differences express themselves in increased opportunities to interact with officials in the EP, the Commission and comitology.

Legislators’ large amounts of slack, taken together with their larger exposure to producers than to consumers, increase the odds of special-interest policies being adopted in the EP. The costs and benefits of participation in the political process on the EU level are almost ideal for regulatory capture.82

3. Comparison of the market and the political process at the EU level

Producers are at an advantage both in the market and in the political process at the EU level. This is mainly due to the large cost of participation, combined with the large stakes for producers, giving them a bigger incentive to participate.

For consumers, participating in the market on the European level does not increase their per capita stakes but it does increase their costs. In the political process, the stakes for consumers are actually higher, but the costs of participation are raised even more: lobbying on the EU level is a very expensive undertaking. The comparatively low perceived stakes are an insufficient incentive to achieve sufficient resource pooling on this level. As a result, consumers on the EU level need financial aid to organise effectively in the market as well as in the political process.

The internal market reduces producers’ operation and compliance costs. Therefore, the EU political process is capable of decision-making that affects their profitability significantly. For many producers, concluding privacy contracts is not their core activity, but a side effect of other activities already being lobbied for in Brussels. As a result, they qualify as repeat players in the political process when compared to single-issue consumer groups dedicated to privacy issues. Their high stakes, resulting in abundant funding, gives them an advantage over general consumer interest groups that are stretched too thin over many issues. This increases the possibility that EU regulations cater to special interests contrary to the interests of consumers. This risk of regulatory capture is not imaginary, with the effectiveness of producer lobbying in telecom issues already documented.83

C. Comparison between the national and EU levels

1. The market

At the national level, the market favours producers of privacy contracts – at the European level, the market favours them even more. The free movement of services, capital and personal data within the internal market can lower the cost of information and organisation significantly. These lowered costs together with the high per-capita stakes provide producers with a powerful incentive for participating in the market on the European level. These benefits offset any extra costs for organisation and information.

Consumers, on the other hand, reap no such benefits at the European level. The increased costs of participation are such that contracts in their home country are significantly more attractive, and consumer organisations need EU subsidies to participate efficiently. Their per capita stakes in privacy contracts are not raised when participating in the European market. Increased costs of information – for example, the costs of translation – make it even less attractive to look for a better privacy contract in another EU Member State.

2. The political process

Both for producers and consumers, shifting the political process to the European level increases costs of participation significantly. However, consumers may falsely tend to think of the EU political process as having lower stakes than their national process, because the European Parliament has less pronounced powers than the national parliaments and press coverage of other institutions and decisions is relatively scarce. Yet consumers’ stakes in the EU political process may actually be higher. A decision at the EU level decreases consumers’ opportunities to obtain a better agreement in another Member State. However, lower perceived stakes decrease active voter participation in the political process. Consumer lobbying groups need grants from the European Commission as a result.

Judging by the resources spent on lobbying efforts, producers are very well aware that the stakes in Brussels are higher than in national Parliaments. Their higher stakes, their low numbers and the homogenous nature of producers form an effective incentive to organise.

D. Summary of institutional comparisons

Based on the dynamics of participation, the circumstances for consumer participation aimed at influencing the contents of privacy contracts are least unfavourable in the political process at the national level. The costs of information and participation are lowest here, mainly as a result of previous organisation efforts. They are also lower than in the internal market. This doesn’t automatically imply that conditions are favourable as consumers’ low per capita stakes weaken their opportunities in all institutions. Consumers really have to choose between imperfect alternatives.84

The effectiveness of consumer participation at the national level is further reduced or limited due to the fact that data protection legislation is mainly decided in Brussels. A concerted effort on behalf of all consumers at the European level could theoretically be more effective, but the lower perceived stakes and the significantly increased costs of participation in Brussels might make this an unattainable goal for the foreseeable future.

Producers seeking to influence the contents of privacy contracts can effectively achieve their goals in the market, in the national courts or in the European political process. Their advantage is arguably most pronounced in the political process at the EU level, where their stakes are highest. The high costs of participation for consumers in this forum increase the opportunities for legislators to decide against consumers’ interests, increasing the risk of regulatory capture.

IV. Institutional choice and policy objectives

Comparative institutional analysis in itself provides no guidance on which institution is best charged with deciding on privacy contracts. The goals a society wishes to achieve are equally important; not every institutional difference is equally relevant to every policy choice. This chapter explores the margins inside which national or European policy choices must remain. Subsequently it broadly categorizes two possible policy objectives and proposes matches between institutions and these objectives.

A. Two sets of European margins

Both EU law and the European Convention on Human Rights limit the adverse effects of privacy contracts for consumers. They show significant differences, in both their scope and their available enforcement mechanisms.

The Convention requires Member States to respect private and family life.85 This makes safeguarding consumer privacy primarily a matter for the Member States, even if data protection law is mostly EU law and the EU accepts the rights guaranteed in the Convention as general principles of EU law.86 After all, the EU Charter of Fundamental Rights is only binding upon the institutions of the EU. Some issues governing privacy contracts – like the interpretation of bona fides – are beyond the scope of EU legislation.

EU law itself provides another set of minimum requirements. The principle of sincere cooperation requires Member States to make EU law effective.87 The Data Protection Directive (with its provisions for free movement of data) prevents national requirements to privacy contracts from becoming too strict. Several further consumer protection directives prevent Member States from giving producers too much free rein. Examples of EU legislation limiting the contents of privacy contracts are the Unfair Terms directive and the Unfair Commercial Practices Directive.88

These limits are not enforced equally. EU law has to be applied ex officio in the courts of all Member States and the Commission can employ enforcement mechanisms to guarantee compliance.89 The ECtHR cannot enforce the convention, since it has no authority to alter decisions by a State. It can only award ‘just ­satisfaction’, usually monetary compensation, if a State allows only partial reparation after a violation.90 Article 8 is stated in broad terms and the ECtHR interprets it on a case-by-case basis. This limits Member States’ abilities to predict whether legal acts are a breach of the Convention, especially in the light of new technological developments like big data.

The ECtHR will allow Member States considerable leeway when judging cases involving privacy contracts, due to the fact that a privacy contract is a matter between private parties. Traditionally, the right to respect for one’s private and family life primarily means that the State should refrain from undue privacy breaches (a negative obligation). If no government body is a party to a privacy contract, any duty of the State will be interpreted as a positive obligation.91 States may trigger a positive obligation under article 8 by inaction, by insufficient action and by not taking control when privacy breaches are getting out of hand. On the other hand, Member States are afforded a margin of appreciation that is wider than in cases concerning negative obligations. For example, the needs and the resources of the community may be taken into account.92

A wider margin of appreciation is relevant in the case of privacy contracts and big data has large possible benefits. A State is allowed to weigh these benefits against the loss of privacy that these contracts can entail. Societal gains are important, and gains in expensive policy areas, such as healthcare and education, may under certain circumstances outweigh an effective loss of privacy caused by a private contract. A State may consider economic growth, jobs or investments essential for its general welfare. Even private gains may outweigh privacy, if a State counts the right to returns on investments as a property right safeguarded by article 1 of the Protocol to the Convention. All this remains speculative, since the ECtHR until now hasn’t given any verdicts on privacy contracts.

B. Making a match

A society might want to choose to protect privacy or to promote societal or economic benefits. The analysis performed in section III indicates that institutional choices show different levels of compatibility with these objectives. In choosing institutions for privacy contracts, it is assumed that consumers have a better chance for strong privacy protection if their participation opportunities are better.

1. Maximizing privacy protection

Considering the comparatively unfavourable circumstances in other institutions, the national political process offers consumers the best opportunities for achieving strong privacy protection in privacy contracts.

An important benefit of the national political process lies in the fact that national Parliaments are not subject to the scope limitations of EU institutions. The scope of EU decisions is limited by the principles of conferral, proportionality and subsidiarity.93 EU data protection law therefore cannot capture the complete scope of the right to privacy as protected in article 8 of the Convention. For example, it does not address reasonable expectations of privacy or the interpretation of contracts.

2. Maximizing social or economic benefits

It seems reasonable to expect that the supposedly large economic benefits of the big data revolution94 will arrive more slowly if restrictions on privacy contracts are stronger. Legal restrictions increase compliance costs and the risk of noncompliance.

The EU political process will probably offer the best opportunities for maximizing the economic and societal benefits of big data. The increased scope of the internal market, when compared to the political process at the national levels, will reduce compliance costs and increase legal certainty for producers active in several Member States. This institution also offers the most benefits of participation to producers, improving the odds of the resulting legislation and not hampering their objectives. This however comes at a cost: the influence of consumers is greatly reduced.

Regulating privacy contracts at the European level, regardless of the outcome, has added significance for the interpretation of article 8 ECHR. A decision at the EU level indicates that Member States agree on the necessary degree of privacy protection. Even if consumers in the EU have limited participation opportunities, any decision on the contents of privacy contracts counts as an indication of common ground between Member States. For the ECtHR, this is a factor in deciding whether a Member State has fulfilled its positive obligation within the margin of appreciation.95 For the CJEU, allowing producers to retain and use personal data under private contracts is much more likely to be acceptable than the Data Retention Directive.96 This directive enabled governments to use personal data collected under privacy contracts and it has met significant opposition in the courts.97

Of course, common ground between Member States is not in itself a guarantee for compliance with article 8 ECHR. The fact that voters cannot easily hold legislators and regulators to account creates a significant risk of regulatory capture and special interest legislation. The legitimacy of EU legislation may also be significantly reduced if many consumers consider their opportunities for participation insufficient.

V. Concluding remarks

Privacy contracts authorise a deep insight into the personal lives of consumers. Therefore, they require sufficient legitimacy. This article has focused specifically on the participation aspect of the legitimacy requirement (transparency and accountability aspects were excluded). It has examined consumers’ participation options in decision-making processes concerning privacy contracts. Particularly, it has compared the dynamics of participation for consumers and producers in the political process and the market on the national and European levels, and before the national courts, by performing comparative institutional analysis.

Although an important factor, maximizing consumer participation opportunities will not guarantee adequate privacy protection by itself. Choosing between institutions requires both awareness of the strengths and weaknesses of each option and a clear view of the goals that a society wants to achieve. The choice is not an easy one. Optimal privacy protections for consumers may impede important societal or economic benefits, whilst maximizing these benefits may sooner or later trigger positive obligations under article 8 ECHR.

The political process at the national level offers consumers the best opportunities for participation in the decision-making process on privacy contracts. In the market, the national courts and the political processes at the EU level, opportunities for consumer participation are greatly reduced. As a result, decisions from these institutions are more likely the result of capture or minoritarian bias. The legitimacy of such decisions is possibly insufficient.

This tentatively points towards the EU Directive as the better option for regulating privacy contracts, as it leaves Member States the choice of form and methods to implement them.98 Transposing directives into national law will allow Member States to debate those aspects of privacy contracts left open due to the limited scope of EU decisions. This will enable, for example, the setting of standards for reasonable expectations of privacy, reasonable interpretation of contracts and unfair terms, within the limits imposed by EU law and the Convention.

However, the next step in EU data protection legislation will almost certainly be a regulation, directly applicable in all Member States.99 In that case, options for national political debate are limited. On the EU level consumers already have few participation opportunities. Adopting a regulation calls on the members of the European Parliament to honour their duty to their constituents. At the same time, MEP’s large amount of slack gives them an opportunity to decide against consumers’ interests without suffering any consequences.

If national or EU law insufficiently protect consumer privacy, national courts will eventually be called upon to apply article 8 ECHR to privacy contracts. This could take many years. The transaction costs for consumers before the courts are so high and individual stakes are so low, that consumers are unlikely to prevail before the courts against a large producer with high stakes. This result would be undesirable. It could effectively allow for permanent observation of every consumer in a new kind of panopticon, possibly with far-reaching effects on consumers’ personal autonomy. Such a result could very well be within the limits of data protection legislation, but it will almost certainly be a breach of article 8 of the Convention.

The low per capita stakes for consumers will likely continue to impede effective consumer participation. Altering the dynamics of participation in the market or the political process might seem an easy solution, but this requires careful consideration. For example, subsidizing organisation or lobbying efforts may introduce new monitoring costs. Consumer representatives would enjoy an amount of slack similar to members of the European Parliament. It could also distort the stakes for representatives. If subsidies are much higher than the contributions of consumers, the subsidies could effectively become the stakes. Such an arrangement does not necessarily offer more guarantees for effective consumer participation, nor does it necessarily reduce the risk for regulatory capture or special-interest legislation. Innovative new contract types may be a better choice to improve the legitimacy of big data applications. Wauters et al. have already researched a number of possible improvements.100 Other solutions may lie in optimizing transparency and accountability.

It is not yet clear whether big data will call for merely incremental adaptations to data protection law, or rather a fundamental redesign of privacy law. In any case, legal developments in response to big data need to coherently address privacy contracts, non-contractual relations, the reasonable expectation of privacy and the possible effects of datafication on human autonomy – in other words, an integrated framework for consumer privacy in the age of big data. The limits on EU decisions imposed by the principles of conferral, proportionality and subsidiarity may stand in the way of developing such a framework at the EU level.

The law has to keep up with technology to effectively continue safeguarding consumer privacy in the coming age of big data. The pace of technological developments shows no signs of slowing down. The law had better be ready.