Common Data Privacy regulation tends to neglect the fact that personal data are nowadays, in a social media society, usually given away voluntarily and upon contractual agreement (we could refer to such data as new data). When using Google, Amazon, Facebook and others we all agree with these companies´ terms and conditions. So Data Privacy should not only consider mere Data Protection but also contractual principles. And one of the oldest and most fundamental contractual principles is “do ut des” which is Latin and goes back to ancient Roman Law meaning that there is or should be a certain balance between what you give and what you get in return. That would explain why companies like Google or Facebook for whose services the customer does not pay should basically have the right to use his personal data (that would be the balance: data for service). But this is only a first approach. Applied to modern data environment the balance has also to be struck in relation to other relevant parameters when it comes to contractual aspects of data privacy:

• since data is a contract matter we have to consider what kind of personal data we are dealing with (especially sensitive and non-sensitive data has to be distinguished and treated differently)

• and since contracts are concluded by mutual consent the extent of such consent also has to be taken into account (has it to be declared explicitly or is accepting terms of use sufficient)

So what I am suggesting is that these three parameters should be balanced. I tried to do so by putting them into a set of privacy rules considering American standards (like the FIP – Fair Information Practices), European standards (Directives and recent draft of Data Protection Act) and International Standards (like OECD Privacy Principles):

Companies in compliance with international data privacy standards commit to

(1) complying with national data protection or privacy law, national contract law and other legal requirements or regulations referring to data privacy

(2) complying with current security standards to protect stored personal data from illegitimate access

(3) implementing an easily perceptible, accessible and comprehensible privacy policy with information on why and which personal data is collected, how this data is used, who will receive this data, how long this data is stored, whether and which data will be deleted upon request 

(4) not using or divulging any customer data (except for statistical analysis and when the customer’s identity remains anonymous) unless the company is obliged to do so by law or the customer agrees to such use or circulation 

(5) in case of a contract between the company and the costumer committing the costumer to pay for services or goods:

- informing the costumer individually and as soon as reasonably possible in case of data breaches with regard to personal data

- informing the customer upon request about which specific data of this costumer is stored and deleting such data upon request unless applicable laws or regulations require the company to continue storing such data

- not using or divulging content-related personal data

- not using or divulging any other personal data without the costumer´s explicit, separate and individual consent

(6) in the absence of a contract between the company and the costumer committing the costumer to pay for services or goods:

- informing the costumer as soon as reasonably possible in case of data breaches with regard to sensitive data (referring to, e.g., sexual, financial, medical, political or ethnic issues)

- informing the customer upon request what type of sensitive data of this costumer is stored and deleting such data upon request when such data is outdated unless applicable laws or regulations require the company to continue storing such data

- not using or divulging sensitive data without the costumer´s explicit, separate and individual consent

The author, Wolfgang Zankl (zankl@e-center.eu), is a Law Professor at the University of Vienna, Founder/Director of the European Center for E-commerce and Internet Law (www.e-center.eu)