The platform economy has enjoyed almost incomparable growth in recent years, and digital platforms are still expected to have considerable growth and innovation potential in the future. Not least due to the specific economic characteristics of digital platforms, which enable them to collect and process their users' data to a particularly high extent, the profitable use and exploitation of data regularly form the basis for a successful platform-based business model. Consequently, ensuring that business models in the platform economy comply with data protection regulations often involves a significant commitment in terms of financial as well as human resources available to platform operators. Particularly the fundamental principles (e.g. transparency, data minimization, integrity), the numerous data subject rights (e.g. right to be informed, right to erasure, right to data portability) as well as the extensive accountability and documentation obligations of data controllers, as enshrined in the General Data Protection Regulation (GDPR), which has been directly applicable since May 2018, result in considerable implementation efforts. In addition, these implementation efforts are accompanied by the understandable fear of high sanctions in the event of infringements. While larger platform operators usually have the necessary resources to ensure legal compliance, privacy-friendly data-driven business models are difficult to implement for SMEs or start-ups with less capital. Innovative, smaller providers therefore face a market barrier that often threatens to keep them out of the market.

This is where the research project PERISCOPE (Privatsphärenfreundliche Geschäftsmodelle für die Plattformökonomie) came in: To ensure that the measures taken by companies that rely on data-driven platform business models to protect the personal data of their users are in line with the high European standards, transparency over and control of personal data need to be increased for both the data subject and the platform operator. In order to accomplish this, two main objectives were pursued as part of the PERISCOPE project. First – on a technical level – a user-friendly, efficient and GDPR-compliant personal rights management (PRM) system was developed to assist both data subjects and platform operators in handling the exercise of and the response to data subjects rights. And second – from an economic point of view – an analysis of potential design options for privacy-friendly business models in the platform economy was carried out. The business models identified in this context were integrated into a navigator for privacy-friendly business models, which is intended to support interested companies in identifying suitable business models, taking into account influencing factors such as databases already held by the companies.

The Chair for Public Law, IT Law and Environmental Law (Prof. Dr. Gerrit Hornung, LL.M.) at the University of Kassel was in charge of handling the legal issues that arose during the course of the project. Among other things, the tasks involved included identifying legal challenges for data-driven business models, specifying data protection and IT security law requirements using design-oriented legal methods, and ensuring that the technical and economic solutions developed together with the project partners comply with data protection law.

Besides the University of Kassel, other partners involved in the realization of the project were: The Fraunhofer Institute for Industrial Engineering IAO as project coordinator, the Chair of Information Systems and Information Management at the Goethe University Frankfurt, the Institute of Human Factors and Technology Management IAT at the University of Stuttgart, the IT service provider WidasConcepts GmbH as well as the SaaS-platform gohobi UG.

Further information can be found on the website of the Federal Ministry of Education and Research and on the website of the project.

Funding:
Federal Ministry of Education and Research

Duration:
July 2021 - October 2024

Project leader:
Prof. Dr. Gerrit Hornung, LL.M.

Staff:
Lars Pfeiffer