PERSONAL DATA AS AN ECONOMIC ASSET

LEGAL LIMITS AND PROTECTION OF FUNDAMENTAL RIGHTS

Abstract

Digital business models operating in the online environment are largely based on the systematic processing of personal data as a key economic asset. Models conceived in this way raise a number of fundamental legal issues in practice, particularly with regard to the alignment of the economic objectives of digital service providers with the requirements of protecting the fundamental rights and freedoms of individuals. The intensive use of personal data—characterized by automation, profiling, and cross-border data transfers—increases the risk of nontransparent and disproportionate interference with the right to privacy and the protection of personal data as guaranteed under European Union law. This paper focuses on identifying and analysing the main practical challenges associated with the use of personal data within online business models, such as personalized advertising, platform services, and data-driven business. Particular attention is devoted to the issue of determining the lawful legal basis and purpose of personal data processing under the General Data Protection Regulation (GDPR), especially the distinction between the data subject’s consent and processing based on a contract for digital content or services. The paper also reflects on the issue of conditioning access to online services on the granting of consent and the so-called “take it or leave it” approaches, which in practice raise doubts about the freely given and informed nature of consent. The aim of the paper is not only to systematize existing practical problems related to the processing of personal data in the online environment, but also to identify the limits of the legitimate use of personal data for commercial purposes and to highlight situations in which the economic interests of service providers disproportionately interfere with the fundamental rights of data subjects. At the same time, it seeks to formulate interpretative and application-oriented guidelines that may contribute to greater legal certainty in practice, strengthen the effective protection of individual rights, and support the search for a balanced model of coexistence between personal data protection and the functioning of the digital economy in line with the principles of the rule of law.