The Legal Debate on The Commercial Use of Personal Data - A Discussion of The EU GDPR Precedent

Abstract

Although the adoption of the Personal Data Protection Act No. 9 of 2022 in Sri Lanka marked a significant milestone in the commercial use of personal data, the regulation of data use is often debated among international policymakers due to the inherent controversy of the subject. This is especially seen in the European Union (EU) which has a stringent data protection scheme. In light of this legal debate, the discussion in this study centres around the key concern of appropriate regulation and balancing between two competing rights, namely, the freedom to commercially utilise user data in the digital economy, and the protection of the right to privacy and protection from unlawful processing of personal data of the consumer/user. Such an academic conversation is engaged in by deliberating on the legal implications of commercial use of personal data. To this end, the essay will first examine the existing legal systems for commercially processing personal data with specific attention to the EU General Data Protection Regulation (GDPR) of 2016 and the associated case law. Next, the essay will discuss three concerns on the present protectionist trajectory of the law, and its impact on the dual role of the law in the digital economy, i.e. as a facilitator of lawful commercial use of personal data and a guardian of privacy rights of data subjects. Thereafter, the essay will discuss three concerns on the present protectionist trajectory of the law, and its impact on the dual role of the law in the digital economy, i.e., as a facilitator of lawful commercial use of personal data and as a guardian of privacy rights of data subjects. The legal analysis is centralised on the EU personal data protection regime because it is a microcosm of development in general data protection law, which is widely accepted as a global persuasive precedent on the regulation of transnational commercial use of personal data.