Case Studies

Farm corporation F buys a ‘smart’ tractor which has been manufactured by manufacturer M and which provides various precision farming services, including weather forecasts, soil analyses and targeted recommendations concerning the use of particular fertilizers and insecticides. M also uses the soil and weather data collected by the tractor to create a database that could be sold to potential buyers of farmland, providing extensive details about the land in order to enable them to make a more-informed choice on the price they would be willing to pay for farmland. When F learns about this database, F immediately requests M to stop using F’s data for this purpose.

Business S supplies an online video game and holds a broad range of personal data from users playing that game, much of which is protected under data privacy regimes such as the California Consumer Privacy Act (CCPA) or the General Data Protection Regulation (GDPR). S ‘sells’ the data of 20,000 users to data analytics business B, which, let us assume, is in conformity with the relevant data privacy regimes (because those users have given consent or failed to click the ‘Do not sell my data’ button). Shortly after the data was transferred to B, 5,000 users from the EU withdraw their consent to the processing of the data. As a reaction, B demands a return of 25% of the price paid to S, arguing that B was unaware of users having a right to withdraw their consent, and that B did not receive what it paid for under the contract. The agreement between S and B is silent on this matter.