B. From Res Extra Commercium to Data Extra Commercium

The Roman law protected multiple types of thing (res) by excluding them from commerce (extra commercium). The commercial inalienability of these things was entrenched in the values and interests that res extra commercium embodied. Accordingly, Roman law prohibited trade in free humans (liberi homines),^{Footnote 4} things of divine interest (res divini iuris),^{Footnote 5} and things of secular public interest (res publicae).^{Footnote 6} Although we no longer use the Roman law doctrine of res extra commercium, these categories evoke some strong parallels with the recent prohibitions regarding human trafficking,^{Footnote 7} trade in human organs,^{Footnote 8} trade in some religious and cultural artifacts,^{Footnote 9} unlicensed commerce in publicly dangerous or invaluable things,^{Footnote 10} and traffic in publicly important things which are either considered common to everyone or that belong to no one.^{Footnote 11}

A purported sale of any of these three categories of thing was first deemed void as legally impossible,^{Footnote 12} except where the purchaser, without fault on his part, was unaware of their real nature.^{Footnote 13} The tendency to protect the buyer is understandable as “it can be difficult to distinguish a free man from a slave”.^{Footnote 14} It is also understandable to have regard to the buyer’s fault, because “even the greenest provincial on his first visit to the mother city could [not] honestly believe that he could take effective possession […] of, say, the Temple of Venus or the Porta Capena or, turning to res publicae, of the Theatre of Pompey or the Via Sacra”.^{Footnote 15}

Eventually, the various rules have been compiled into a specific provision of Justinian’s Institutes (Inst.III.23.5), according to which a person who, in full awareness of the facts, bought a thing in which trade is forbidden, bought in vain and his contract was void. Yet if the purchase was based on the seller’s fraud, deception, or misrepresentation,^{Footnote 16} the law granted the buyer a remedy in damages for mischiefs such as eviction, confiscation, and misapprehension induced by the seller. To the extent that these remedies were conditioned on a breach of contract, the jurists felt that they should not to deem the contract void because otherwise there would be no legal basis for the remedy. This required an exception to be made to the general rule that fraud renders a contract void ab initio.^{Footnote 17}

Recent EU laws and other legal rules also protect certain types of valuable assets by excluding them from commerce. We focus on data. The laws regarding data and digital content seem to exclude some data types from commerce, although somewhat ambiguously, as we will show in Section C. Thus, it effectively looks as if some types of data—due to characteristics of the information they embody—cannot be the subject of a sale contract (extra commercium), similarly to how Roman law prohibited trade in certain types of thing. Yet as we have seen in the introduction, trade in data, unlike trade in material objects, poses some very challenging questions. In particular, it seems that we need to think dynamically about the values and interests that the data represent, and it is unclear what implications this may have for the validity of contracts and the availability of contractual remedies in relation to data extra commercium. Let us investigate these issues in relation to personal data.

The parallels between res extra commercium and our proposed concept of data extra commercium look particularly strong in the case of free humans and personal data. Illicit trade in free humans, unlike trade in things of divine or public interest, was allegedly an increasingly common source of practical trouble in Roman times.^{Footnote 18} An analogy may be drawn with recent illicit handling of personal data by tech giants such as Facebook.^{Footnote 19} Also, in Roman times, free individuals were not “things” in a legal sense, just as data are not considered to be “things” in many modern jurisdictions.^{Footnote 20} Finally, the distinction between a slave and a free individual is epistemically obscure, just as there is no clear line between non-personal and personal data.^{Footnote 21} Both a slave and a free individual are humans, although they embodied different values in Roman law. Both non-personal and personal data are data, although they encapsulate different types of valuable information.

Given that the distinction between a free individual and a slave is no longer legally significant, we could instead seek to draw an analogy with trade in human organs. Although organs are different from data—and, generally, from intangible goods—legal protection of human organs has been widely compared with legal protection of personal data.^{Footnote 22} This is perhaps due to the central role of personal data in constructing personal identity and to the inherently personal nature of both organs and data as components of the moral and physical integrity of human beings.^{Footnote 23} Accordingly, if the human body and its components are capable of being considered res extra commercium, one might be tempted to conclude that personal data—that is data that already relate to an identifiable human, just like organs pertain to an individual—are likewise inalienable in the European digital market.

Indeed, the rationales for excluding trade in human organs can partly translate to commerce in personal data—as we will see in the next two sections of this Article—but arguments about tradability of data must take a very different form. This is so because non-personal data can become personal, and vice versa. The difficulty with all data, not just personal data, is that one must always first compute the information that data embody in order to find out the legal status of such data. Data as objects of digital transactions can therefore never be excluded from commerce ex ante, because they can be ex post linked with values and interests that would be compromised by sale.

The dynamic nature of data is unparalleled in the physical world. The closest we could perhaps get is the example of 3D-printed organs.^{Footnote 24} Unlike organs extracted from a human, organs printed on a 3D printer are a tradable commodity. In the physical world, it is relatively easy to understand why the law prohibits trade in human organs but not trade in 3D-printed organs. The rationale for this protection seems to be based on moral and ethical considerations, grounded on human dignity in terms of moral and physical integrity.^{Footnote 25} For the same reasons, one could argue that it would be illicit to trade 3D-printed organs that have already been successfully implanted in a human body. While this looks like a dynamic change in the nature of those 3D-printed organs, however, it is important to highlight that this is a one-off change. In contrast, the nature of data may change repeatedly.

A further complication is that a data subject—that is a human to whom the personal data relate—may ex post withdraw her consent with processing of personal data for a specific purpose. Again, in the physical world, it would be hard to imagine that a producer of 3D-printed organs would terminate a contract and withdraw their organs from the human body. In the infosphere, however, a data subject can demand her data back, which causes some headaches for the contracts involving those data and attendant remedies.^{Footnote 26} We will get to these issues in Sections C, D and E.

For now, it suffices to highlight that these dynamic ex post changes in the nature of data are a new phenomenon that might lead to exclusion of data from trade. This issue seems to have slipped the attention of lawmakers as well as many scholars, although it presents a distinct problem for the data economy. As, for instance, Basedow argues, “[i]t should be clarified to what extent personal data are res extra commercium and what this means for contracts covering such data”.^{Footnote 27} The uncertainty over when the law excludes data from commerce is further magnified by the fact that there are no clearly defined rationales for treating certain data as res extra commercium such as is the Roman law triad of reasons—an interest in liberty of free humans; a divine interest; and a public interest. Further, in cases of hidden data commodification and when data are provided instead of a monetary price for the provision of digital content, there is always an implicit danger that contracts involving such data would be invalidated ex post.

Thus, it seems worth attempting to map the concept of data extra commercium onto the moral and public policy reasons found in Roman law or a similar set of reasons, so as to clarify the constraints on trading data which are implicitly baked in our laws and provide a higher degree of certainty for the data economy. Due to the number of parallels and the reasons given, we will use personal data as a vehicle for our argument, although we aspire to make more general claims about limits on trade in data.

In this regard, Margaret Radin’s work in which she challenges the idea of “paternalism” as a basis for market inalienability is particularly relevant.^{Footnote 28} By criticizing Calabresi and Melamed’s famous view on inalienability,^{Footnote 29} Radin argues that the real justification of trade limitations should not be based on traditional liberalism or economics but on a conception of personhood and human flourishing. According to Radin, the reason why we do not trade children or human bodies is thus our interest in human flourishing. Human flourishing, a key concept in virtue ethics,^{Footnote 30} means the development and fulfilment of one’s own personality, based on positive freedom (life, health, thought), negative freedom, and autonomy. Allowing individuals to trade their body parts or entire bodies, for instance, would impair the foundation of individuals’ freedom, because it would be detrimental to personhood itself. Accordingly, inalienability should not be justified through paternalism but, on the contrary, through human freedom.

Radin was one of the first to discuss personal information in the context of the inalienability of human beings.^{Footnote 31} Indeed, she affirms that personal information—“attributes” and “characteristics”—is what makes personhood unique and, thus, it cannot be separated from persons themselves.^{Footnote 32} Following this line of argument, we can infer that if humans are inalienable, their personal data should likewise be inalienable, because only objects separate from the self are suitable for alienation. For example, the French national advisory Committee for Ethics, when interpreting Article 16-10 of the French Civil Code, considered the technology of genetic fingerprints (empreintes génétiques) as res extra commercium ^{Footnote 33} because fingerprints are inseparably liked to an individual.

In other words, we think Radin’s work identifies a strong rationale for what we call data extra commercium: Inalienability of personal information justified through arguments concerned with human flourishing. Interestingly, privacy scholars have recently affirmed that the right to human flourishing might be the general justification, or even the raison d’être, for the right to privacy as protected under Article 8 of the European Convention on Human Rights.^{Footnote 34} Overall, it seems that inalienability of personal data could be justified on a moral basis, just like Roman law advanced moral reasons when prohibiting trade in free humans, because the morally-laden values and information that personal data embody would be compromised by sale. So, while the nature of data dynamically changes, the rationales for excluding some data from trade can remain unaltered. What dynamically changes is whether data encapsulate values and interests that would be detrimentally affected by trade, not whether we want to protect those values and interests. Building on the existing literature, we submit that human flourishing is regarded as one such fundamental value that can justify inalienability of personal data.

C. When the Law Limits Trade in Data?

The law is, however, not bound to follow such abstract moral arguments. It may build on them to provide a principled legal ground for excluding data from commerce, but it could just as easily disregard those rationales. Accordingly, the aim of this section is to explore whether, and under what conditions, there are already some forms of data extra commercium in EU law or in national legislation.

Before we begin, we stress that several leading commentators consider data to be intra commercium by default.^{Footnote 35} Indeed, Article 2(11) of the Directive on Consumer Rights seems to protect the commercial use of data in sales law by explicitly addressing production and supply of digital content.^{Footnote 36} The Regulation on a Framework for the Free Flow of Non-Personal Data^{Footnote 37} and the Digital Content and Digital Services Directive^{Footnote 38} support the same conclusion, as they consider data tradable goods. The Regulation, for instance, explicitly declares the objective of “removing obstacles to trade”.Footnote ³⁹ The Digital Content and Digital Services Directive, then, defines “digital content” as “data which are produced and supplied in digital forms”^{Footnote 40} and allows for data—even personal data—as an alternative payment for the supply of digital content and services.^{Footnote 41} Although the proposal for this directive has been severely criticized from the perspective of personal data protection,^{Footnote 42} the debate about data (in)alienability is still underdeveloped.^{Footnote 43} Below, we advance this debate.

II. Trading Personal Data under the GDPR: Conditions and Uncertainty

In order to understand the conditions under which the GDPR allows trade in personal data, we should first clarify what “trading data” means and then differentiate amongst relevant scenarios. We accept here that trading data means obtaining personal data in exchange for money or for other valuable assets such as digital services or valuable information. Two different scenarios should be addressed here: Primary data trade where the data controller obtains personal data from the data subject, and secondary data trade where the data controller exchanges personal data with a third recipient, such as a business that can thus become a second data controller.

In both primary and secondary data trade, the trader(s) need to consider two variables: (1) The nature of data—are they personal or non-personal data? If they are personal data, are they sensitive or non-sensitive data?; (2) The legal basis for trading data—what is the legal basis and when does it change? We will discuss these variables in the following two sections of this Article.

1. The First Variable for Limited Alienability of Data: The Dynamic and Uncertain Nature of Data

Regarding the nature of data, Article 4(1) GDPR clarifies that “personal data” means any information relating to an identified or identifiable natural person. Interestingly, recital 26 of the GDPR explains that when determining whether a natural person is identifiable, “account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly”. To ascertain whether some means are reasonably likely to be used to identify the natural person—the recital continues—“account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments”. If, considering reasonable efforts, it is not possible to link the information to a natural person, the information shall be considered anonymous.^{Footnote 57}

As discussed in Section B, it appears clear that the nature of data is relative. Several variables, such as reasonable costs, time, or available technology, significantly affect our realistic capacity to single out individuals.^{Footnote 58} The CJEU in Breyer v. Germany recently clarified that data are anonymous not just if it is technically unfeasible to identify the natural person to whom they are related, but also if it is legally unfeasible.^{Footnote 59} In particular, if there are no legal channels for obtaining the “identifiers” that would turn those “anonymous” data into “personal” data, personal data shall be considered anonymous.^{Footnote 60} Owing to a broad interpretation of the CJEU’s statement, it is sometimes thought that pseudonymous data (personal data separated from identifiers)^{Footnote 61} could also be considered anonymous data for a third party that cannot technically or legally access the identifiers.^{Footnote 62}

It is noteworthy that the nature of data also varies across time. For example, advancements in technology could make it easier to reidentify some originally anonymous data, or a party processing anonymous data could ex post obtain the identifiers in a lawful way. Thus, it should be accepted as a given that the nature of data is not only uncertain for traders at the moment of the trade, for example when it is not clear whether some data are really anonymous or relatable to an identifiable person, but also dynamically uncertain in the future, as anonymous data might become personal data.

Once it has been verified that traded data are personal data under the GDPR, another test should be performed to find out whether those data are of a sensitive nature. This extra categorization is necessary in the context of trading data because Article 9(1) provides for stricter rules for processing sensitive data. Accordingly, sensitive data are based on a more limited alienability rule than personal data generally.

For the reasons given above, the border between sensitive and non-sensitive data is uncertain, relative, and dynamic.^{Footnote 63} In particular, it has been affirmed that in the age of Big Data, machine learning, and data mining, it becomes increasingly easier to infer sensitive information from apparently non-sensitive data.^{Footnote 64} All personal data have a certain degree of intrinsic sensitiveness and an inversely proportional computational distance from sensitive information.^{Footnote 65} How this distance can be covered depends on advancements in technology, but also on the collection of further data. For example, our health conditions can be statistically predicted even from our daily location data. Accordingly, data traders should not only consider the uncertain and dynamic nature of data, but also the uncertainty and dynamism of the subcategory of sensitive data, which have implications for the legal bases for trading data.

2. The Second Variable: Legal Bases for Primary Data Trade

Insofar as data qualify as personal data or even sensitive data, data traders need a legal basis for the commercial exchange of such data. Legal bases for processing personal data are listed in Article 6 GDPR. For sensitive data there is an additional and more demanding list of conditions in Article 9 GDPR.^{Footnote 66}

Let us consider personal data first. We will focus on consent, a contract, and a legitimate interest as the potential bases for trading data lawfully (Article 6(1)(a), (b), (f) GDPR).^{Footnote 67} As mentioned above, consent, can serve as a legal basis for collecting data for monetization purposes.^{Footnote 68} However, according to Article 7, this consent must be unambiguous, fully informed, including being informed of the commercial purpose of the data processing, and it must be revocable and free, meaning not conditional on the provision of services with no other genuinely equivalent alternatives. Accordingly, businesses who trade personal data must ascertain that consent has been provided unambiguously, that it was informed, free, and that it remains valid. The consent remains valid if it has not been withdrawn by the data subject.

Another legal basis for monetizing personal data could then theoretically be a contract, but commentators have dismissed this possibility.^{Footnote 69} Even Art 29 WP has clarified that the provision of Article 6(1)(b) GDPR, stating that processing is lawful if it is “necessary for the performance of a contract to which the data subject is party”, “must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller”.^{Footnote 70} Art 29 WP thus effectively excluded the use of contract as a legal basis for processing data for monetization purposes, including marketing purposes.^{Footnote 71} We agree with Art 29 WP’s view.

The last variant is a legitimate interest as a basis for lawful processing of personal data. Pursuant to Article 6(1)(f) GDPR, this could be where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject”. This legal basis thus requires us to take account of several tests, including the necessity test; the legitimacy test; and the balancing test, considering the counter-interests of the data subject.^{Footnote 72}

The use of “legitimate interest” as a legal basis for monetization purposes is problematic,^{Footnote 73} especially with regard to the necessity test. Art 29 WP has indeed clarified that data controllers should “consider whether there are other less invasive means to reach the identified purpose of the processing and serve the legitimate interest of the data controller”.^{Footnote 74} In data trade, the identified purpose might be an economic profit from personal data, but such a purpose would probably be considered insufficiently specific to meet the necessity test.^{Footnote 75} In addition, one could always argue that the desired economic profit could be achieved through less invasive means, such as when the content providers would provide some premium services upon a payment.

The legitimacy test allows for more freedom and can be interpreted expansively.^{Footnote 76} Still, the interest must always be lawful, sufficiently clear, and represent a real and present interest.^{Footnote 77} Finally, the balancing test^{Footnote 78} should take into account the controller’s legitimate interest, impact on the data subjects such as intrusiveness of profiling, provisional balance, and additional safeguards applied by the controller to prevent any undue impact on the data subjects—transparency, ease of exercising the right to object, et cetera.^{Footnote 79}

All these considerations make it extremely difficult to use the category of legitimate interest as a legal basis for trading personal data. It will be necessary to evaluate on a case-by-case basis whether a specific data transaction involves intrusive profiling, unclear information about purposes or commercial implications, alongside other legal requirements. And even though “[t]he processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”, as is confirmed in recital 47 of the GDPR, the data subject has the right to object at any time to such processing (Articles 21(2) and 21(3) GDPR). Accordingly, the legal basis for data transactions could be invalidated ex post, which seems to be very similar to the right to withdraw consent in case of processing based on consent.

In addition, if the traded data are not only personal, but also sensitive (Article 9(1) GDPR), they can never be processed merely for legitimate interest purposes, because under Article 9 GDPR there is no reference to legitimate interest as a legal basis for processing. In that case, just two legal bases might in principle be adequate for the processing of sensitive data for monetization purposes: (1) When the data subject has given “explicit consent for one or more specified purposes” (Article 9(2)(a) GDPR), given that the consent is free, informed and revocable (Article 7 GDPR); or (2) when processing relates to “[sensitive] data which are manifestly made public by the data subject” (Article 9(2)(e) GDPR). In this second case, however, we observe that if personal data are already made public, this might lower their commercial value for data traders because they would not need to buy these data, they just would need a technology to collect them. Still, even in this second case, it is worth remembering that for processing sensitive data, controllers need a legal basis under both Articles 9 and 6 GDPR, because sensitive data also count for personal data.^{Footnote 80} Therefore, in the case of processing sensitive data which were manifestly made public by the subject, the data controller should either seek the consent of the subject under Article 6(1)(a) or prove that there is necessity for a legitimate interest under Article 6(1)(f). The route of a legitimate interest then poses multiple hurdles, namely the legitimacy test, the necessity test, and especially the balancing test when trading sensitive data for merely commercial reasons.^{Footnote 81}

Overall, we submit that this second variable is also uncertain and dynamic. In cases of consent, even when the data traders pass the freedom of consent test, consent could be withdrawn in the future.^{Footnote 82} In cases of legitimate interests, even when the data controllers pass the necessity, legitimacy and balancing tests, the data subject could easily object to data processing and thereby delegitimize it. With regard to the secondary data trade, that is a commercial exchange of data between two data controllers such as a service provider and an advertising company, the same conditions apply. In addition, it might be necessary to obtain a separate consent for exchanging data with a third party: Art 29 WP clarified that in order to respect the principle of “granularity”, the data controller that processes data for her own purposes must ask for a separate consent to communicate the data to a third party.^{Footnote 83}

3. Dynamically Limited Alienability Rule for Personal Data under the GDPR

Given the evidence in the legal sources and literature set out above, we conclude that personal data are not based on an inalienability rule and are, therefore, not res extra commercium. Nonetheless, we also conclude that strict conditions apply to the commercial flow of personal data, and so we can talk about a dynamically limited alienability rule in relation to personal data.

Figure 1. (see below) visualizes how this complex rule might look. Accordingly, the GDPR arguably forbids trade in data when:

1. 1. Data are personal data from the outset or become personal data subsequently AND there is:

   1. a. No free consent of the data subject under Articles 6(1)(a) and 7 GDPR; or

   2. b. No necessity for a legitimate interest under the conditions of Article 6(1)(f) GDPR for processing those data;

Figure 1.

Dynamically Limited Alienability Rule derived from the GDPR and explaining conditions under which personal data can be traded.

OR

1. 2. Personal data are also sensitive data according to Article 9(1) GDPR from the outset or become sensitive data subsequently, AND:

   1. a. There is no free consent of the data subject under Article 9(2)(a) and Article 7 GDPR; or

   2. b. Those data are not manifestly made public by the data subject or, even if made public, there is no necessity for a “legitimate interest” under the conditions of Article 6(1)(f) GDPR for processing those data;

OR

1. 3. The legal basis is subsequently lost, for example:

   1. a. Consent is withdrawn or loses its required qualities (Article 7 GDPR); or

   2. b. In case of legitimate interest basis, the data subject objects to the processing of personal data (Article 21 GDPR).

D. The Two-Stage Data Extra Commercium Test

While Roman law provided a clear and principled test that helped indicate when contracting parties should be held responsible for illicit transactions in res extra commercium, and consequently when the parties’ commercial interests are to be protected by legal remedies,^{Footnote 84} current law does not feature any similar test in relation to data. The Digital Content and Digital Services Directive provides consumers with some contractual remedies and deals with some aspects of onward data transfers to third parties,^{Footnote 85} but it is does not address these issues in a complex and principled way that would be useful also for business-to-business contracts. This section fills this gap and proposes a test that is specifically designed for transactions in data extra commercium. We suggest that this test be thought of as a reasonable proxy on the basis of which national contract laws can be interpreted in accord with EU law limits on trade in personal data.

We already know that the Roman law res extra commercium test struggles to identify data that cannot be traded. To this extent, we suggest replacing the test with the dynamically limited alienability rule. As far as the legal implications of there being data extra commercium, however, the Roman law doctrine can play an important role. We can make a connection between the doctrine of res extra commercium and data extra commercium by focusing on the principles that underpin the Roman law test for inalienability of things. It is safe to assume that the test was underpinned by the following set of abstract principles that are based on the authority of reason: (1) If a contracting party—for instance an innocent buyer—is not responsible for the forbidden trade, it would not be unjust to provide that party with a remedy for the spoiled commercial transaction; (2) if the other party—for instance a fraudulent seller—is responsible for the mischief, the law could grant the innocent party a remedy against the defaulter; (3) otherwise, the contract is void and the law protects only the noncorrelative interests vested in the object of trade. The parties are responsible for the void transaction if they knew, or should have known, that the object was extra commercium. Let us translate these principles into the context of data.

The dynamic nature of data implies that all contracting parties can, in full awareness of the factual circumstances of their transaction, foresee that the relevant data may eventually be excluded from commerce on the basis of the reasons outlined in Section B and as demonstrated for trade in personal data in Section C. It could thus be argued that all parties should have known this potential status of the data and, accordingly, would all be responsible for the void or ineffective contract and its consequences. This line of thought would result in legal protection of data extra commercium only. No party would be entitled to a remedy.

The difficulty is that such a strategy does not take into account the legitimate interests and reasonable expectations of the parties. For example, it seems unreasonable to expect that a data subject will be able successfully to claim her interests and withdraw her consent in relation to fully anonymized data or to personal data that are collected and processed in the public interest.^{Footnote 86} Similarly, it would be unreasonable to assume that data regarding levels of humidity around the globe would be eventually analyzed as personal data. In theory, it is possible, but seems as unlikely as the authors of this Article being tenured next year. You would hopefully struggle to say we are responsible for not being tenured next year. By the same token, it is unreasonable to assume that parties can have limitless responsibility for data extra commercium. Given the dynamic nature of data, it is also unreasonable to assume that the parties’ limited responsibility is fixed at the time of the conclusion of a contract or another key event in the digital trade. According to this line of thought, the parties’ limited responsibility should be dynamic, too.

In response to these issues, we propose to translate the corrective element of reasonableness^{Footnote 87} into the following two-stage test. Stage 1: A party is responsible for trade in data extra commercium if and when, given the current state of knowledge and technology that is normally available to a person in a similar position, it is reasonably likely that the relevant data could reveal personal or other restricted information. Stage 2: If those conditions are met, the party cannot successfully escape responsibility for infringing on the values and interests in which trade is, or should be, legally prohibited. The party will be responsible for the mischief, unless that party demonstrates a special justifying reason, such as the data subject’s free consent with processing of personal data or a compelling legitimate interest of the controller, that serves as a defense to that party’s liability for consequences caused by transactions concerning data extra commercium.

Stage 1 of the test protects reasonable expectations and legitimate interests in that the basic rule is that data are in commerce and the validity and enforceability of the contract should remain untouched, provided that there is no reasonably likely interpretation which would reveal that the relevant data embody values and interests that would be compromised by sale (as explained in Section B of this Article). Of course, the parties cannot prove negative facts, which is why the Stage 1 test must take a positive form as set out in the preceding paragraph. This positive test helps indicate whether the parties knew, or should have known, that any data in question are excluded from commerce. The “current state of knowledge” requirement allows us to consider the so far speedy developments in the field of data science. The requirement of “technology that is normally available to a person in a similar position” is designed to objectively indicate whether and when the relevant party could have discovered that the data qualify as extra commercium, and therefore whether and when that party has responsibility for trade in that data. This requirement is also justified by recital 26 of the GDPR.^{Footnote 88}

Stage 2 further limits the parties’ responsibility in that it provides the parties with relevant excuses from responsibility and, consequently, defenses to liability. A party that becomes responsible at Stage 1 should prove that they have a relevant excuse that allows them to trade data that would otherwise be extra commercium. This could be freely given consent by the data subject or a compelling legitimate interest of the data controller winning the three tests—the legitimacy, necessity, and balancing tests—under Article 6(1)(f) GDPR. In the case of sensitive data, this could additionally be either explicit consent or demonstration that data were made public by the subject, or any other exemption provided by the law at the time when the party faces Stage 2. In this sense, Stage 2 reasonably limits responsibility for data extra commercium but does not deny it.^{Footnote 89}

If we now reconnect the two-stage test with its Roman law roots, we can see why the reasonable basic position of the law should be to protect only data extra commercium and the valuable information they embody. We can also see why it would often be the case that those who are in control of powerful analytic algorithms would be more likely to be responsible for data extra commercium than those to whom such tools are not available, typically consumers and data subjects. The question of specific legal sanctions and remedies is an important matter which we do not have space to open here. The key point is that the test could potentially be deployed in any type of data transaction and could be seen as a test that enforces requirements that are reasonable, principled, and in this sense non-arbitrary.

E. The Unique Benefits of the Data Extra Commercium Test

The two-stage test helps attribute responsibility for trade in data extra commercium, and thus also for the consequences of purporting such trade, in relation to both problematic scenarios set out in the introduction and Section B, that is in relation to ex post analytic exclusion of data from commerce and ex post withdrawal of consent. The same applies to the specific conditions of trade in personal data as discussed in Section C. These are undoubtedly unique and significant benefits that already justify why we should adopt the two-stage test in our thinking about data transactions in European contract law.

Here we want to highlight two practical benefits of the two-stage test. The first benefit relates to enforcement of the limited alienability rule in technologically advanced data trading and data processing systems where human end users are virtually out of the loop. Think, for instance, of “smart” environments and the Internet of Things. In order to deliver their functions, smart devices and their data processing algorithms often automatedly, and sometimes even autonomously, connect to other devices in order to transfer or process data. This can happen without the end user having any knowledge about such activity or the character of the data traded. Still, legal obligations can arise even in such autonomous environments and, likewise, the reasons for excluding some data from commerce apply there too.^{Footnote 90}

How then, if the human end users—who are traditionally considered the relevant contracting agents—are out of the loop, can we enforce the limited alienability rule? Consider, for instance, how difficult it would be to apply principles relating to defects of consent—mistake, fraud, threat, or undue influence—and misrepresentation in scenarios where the human user is out of the loop. Similarly, consider how difficult it would be to establish that the dynamic change of the nature of data amounts to an unforeseeable change of circumstances.^{Footnote 91} These issues demonstrate the obstacles relating to enforcement of the limited alienability rule when it comes to automated trading of data between autonomous agents. The existing European contract law tools are simply not designed for the infosphere where our traditional notions of time, space, and identity of objects start breaking down in relation to data and their informational properties.

This is where the two-stage test is likely to help. The law is well positioned to provide a legal, that is not technological tool to open black-boxed algorithmic trading systems, and thereby to protect the values and interests that certain types of data embody. The two-stage test could steer these challenges at the technological level by incentivizing development and implementation of suitable algorithms that would be designed to protect data extra commercium. Such protection by design could result in various auditing algorithmic protocols which would enforce the compliance with the law by computer code^{Footnote 92} that would flag up potential issues in the black box. Stage 1 of the test explains why it would be reasonable for stakeholders to use such auditing technologies and responsibly to develop the necessary technical standards.^{Footnote 93}

The second benefit relates to Stage 2 in that it demands development of adequate legal and technical standards for ex post authorization of processing of autonomously derived or inferred data. From a traditional European contract law perspective, trade in these derived or inferred data would be permitted if they were derived or inferred from data in commercio. The traditional contract law approach—we may call it a pre-Big Data or pre-infosphere paradigm—looks at data as a merely accidental form of goods, rather than as primary objects of transactions.^{Footnote 94} If the primary good is excluded from commerce, data are too; if not, data are in commercio. We already know, however, that the relationship between data and the information they embody is not this straightforward and that, once the human user is out of the loop, we could lose sight of trading data that should be excluded from commerce. In other words, even derived and inferred data might eventually infringe upon non-tradable values and interests as set out in Section B.

Again, this is where the two-stage test might help. The current European law addresses issues of ex post withdrawal of consent and, relatedly, the legal implications of this ex post exclusion of data from the relevant transactions, including some implications for onward transfers of such data extra commercium to third parties. By contrast, the two-stage test incentivizes development of reasonable legal and technical standards that would allow not only for exclusion of data from commerce but also for ex post authorization of such data and, accordingly, ex post inclusion of derived or inferred data in commerce. This second benefit is, again, characteristically significant for enforcement of the limited alienability rule in the era of Big Data and the infosphere and demands us to adopt some new contract law rules for attributing responsibility for data extra commercium. What shape these rules will take in national legal systems, or whether there will be pan-European standard terms or implied terms for business-to-business and business-to-consumer contracts, are questions ripe for further consideration that exceeds this Article.^{Footnote 95} Overall, the two-stage test could incentivize more efficient legal and technical standards for detecting and protecting data extra commercium even in fully automated and autonomous trading systems.