Autonomia privata e dati personali: dal consenso al contratto per il trattamento

The research analyzes the powers of private autonomy operating within the personal data processing framework and their applications in the emerging personal data market sector. After reconstructing personal data as informational signs that are the subject of the right to personal data protection, understood as a right with a primarily existential nature, the paper examines the main institutes of Reg. (EU) 679/2016 where it notes the data subject's power of decision with respect to the processing of personal data concerning him or her (consent to processing, right to object, contract for which personal data is necessary) and frames them within the general category of private autonomy. Even though the Euro-Union framework has strengthened the principle of free movement of personal data and the hypotheses of heterodetermination of the processing of personal data, an examination of the institutions demonstrates the presence of heterogeneous powers of autonomy in the hands of the data subject with which the freedom of the data controller is confronted. Recourse to the category of private autonomy makes it possible, first, to envisage the application of disciplines posed for other acts of private autonomy also with respect to the processing of personal data, where the special institutes examined have gaps and are compatible with the former; second, to assess whether personal data can also configure objects of contractual relations and, consequently, whether it is possible to discuss contractual autonomy over personal data as well. Regarding the latter, an examination of current business models and recent regulatory interventions (Dir. UE 770/2019, Reg. UE 868/2022) points to the existence of a market value even of personal data directed toward commercial use or reprocessing and, therefore, the suitability of personal data as the subject of a contract. From a legal point of view, the need to comply with the requirement of freedom of consent, understood as the absence of negative consequences for the data subject, if it does not prevent the economic-legal transactions in question from being qualified in terms of correspondence, suggests framing the making available of personal data within a subjective legal situation that is not coercible, i.e., resorting to the figure of burden.