In today's data driven economy, data transfers, especially those involving personal data are inevitable and are even rather essential for many businesses. In many sectors such as marketing and advertising holding a vast amount of personal data may be considered profitable. Even in sectors which do not primarily rely on the use or sharing of personal data there is value and opportunity based on how such data is utilized.
It is a fact that many business transactions such as mergers and acquisitions, brand partnerships and various types of collaborations frequently involve the transfer of vast amounts of data which may also include personal data. In this respect the most important question is how businesses and business owners may minimize the legal risks associated with engaging in these types of transactions and what are the key considerations.
Understanding the database protection under IP laws
Databases are subject to two types of protection under both the Turkish and EU IP laws. The first type of protection is quite familiar, its simply "copyright protection" provided for databases which have been created with a "personal touch" meaning that the databases created by selecting and arranging data and materials according to a specific purpose and plan will benefit from copyright protection. It is important to note that copyright protection does not extend to the contents of the database and therefore, does not grant the author of the database an authorship over the materials contained in the database.
The second type of protection is the sui generis protection which means "of its own kind" in Latin. Sui generis protection for databases deviates from copyright protection as the subject of this protection is the investment. Here, the investment may be of any kind, including, without being limited to being technical, financial or including resources such as time, effort and energy. The investment is put into the database by the maker of the database.
Since the rules under the Turkish legislation regarding databases have been mainly adopted from the EU legislation, the EU legislation includes the above-mentioned rules for database protection as well. However, EU legislation provides for more detail especially in terms of lawful use of databases which the author or the database maker may not interfere with and the obligations of lawful users.
Back to reality
You might be wondering how the two types of protection affect day to day business transactions or high value-added asset transfer operations. Well, the answer is simple, it is all about what you are allowed and not allowed to do with a database. Depending on the type of protection, the author or the database maker controls what can and cannot be done by third parties on the database.
If a database is subject to copyright protection, then unless the relevant act falls under any copyright exemptions, copying a database will result in copyright infringement without a license or assignment of rights from the author. Similarly, under Turkish law a database maker who has invested substantially in the creation, verification, or presentation of the content of a database in terms of quality and quantity shall also be entitled to authorize or prohibit the use of a substantial part or all of the content of the database in the following ways:
- Transferring to another medium, permanently, or temporarily, by any means whatsoever,
- Distribution, sale, renting or communication to the public by any means.
Therefore, both authors of databases and database makers have the right to license or assign their rights over databases. These rules might come in handy in deals involving transfer of databases and in situations where a third party tries to unlawfully copy, distribute or publish a database your company may have invested in the creation of.
The interplay between intellectual property and data protection rules
We must remember that the protection provided for databases under IP law does not prejudice the rules relating to personal data protection. Turkish data protection legislation provides for certain restrictions and conditions for the lawful transfer, including cross-border transfers, and use of personal data.
A practical example for the interplay between intellectual property and data protection is currently subject to an ongoing proceeding for a preliminary ruling before the Court of Justice of the European Union (CJEU) ( Case C-693/22). In said proceedings the District Court of Warsaw asked the CJEU to decide whether a database that contains personal data, belonging to a debtor may be sold by enforcement officers in order to pay off the creditor where the debtor has no other assets of value.
While the CJEU has yet to provide its opinion on the case, the Advocate General had provided his opinion on the matter and stated that both Polish law and the EU legislation regarding databases allow for the sale of a database in enforcement proceedings however, whether such a sale would violate applicable data protection rules must be assessed. Once more, this shows us the coexistence of data protection rights and database rights in practice.
In his assessment, the Advocate General analyses whether this sale could take place without seeking the consent of the persons whose personal data are included in the relevant database by way of basing this transaction on the legal basis of ''the performance of a task carried out in the public interest or in the exercise of official authority''. It then reaches the conclusion that this sale could take place without seeking consent provided that the compliance of the buyer to data protection regulations for further use of such a database is guaranteed under a provision in Polish law. The Advocate General further explains that an example to this could be a rule under Polish law, requiring the court enforcement officer to include in the terms drawn up for the purposes of an auction, a clause requiring the third-party purchaser to comply with data protection legislation.
Conclusion
Companies process significant amounts of personal data in their transactions and they use databases within the scope of their commercial activities which is inevitable as an organizational tool. Therefore, it is with no surprise in most of the situations where such an organizational tool becomes the main element of a legal transaction, together with the personal data it contains. In these cases, be aware of the following before passing on your asset; databases are protected through different regimes, but the scopes of these regimes only extend to the databases themselves but not is induvial content. Personal data protection, on the other hand, relates only to the personal data in the relevant database. Therefore, while it is possible to transfer databases within the scope of IP legislation, the rules regarding the transfer of personal data within such databases require a separate evaluation in terms of personal data protection law as well. Since these rules coexist, simultaneous consideration of the elements is crucial in transactions involving database transfers.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.