Keywords

1 Introduction

The evolution of fundamental rights has gone through three important phases: first, second, and third-generation rights, which correspond, respectively, to the enshrinement of individual freedoms and economic and social rights, and the rights known as diffuse and collective rights since they do not have a specific addressee but affect the whole of society, such as the right to an ecologically balanced environment. There is also a fourth dimension, which includes democracy, pluralism, and the right to information (Novelino, 2009).

There is also a current argument that defends the existence of a fifth dimension of fundamental rights related to information and communication technologies. Holanda (2007a, 2007b) states that the contemporary world has required legislative frameworks to make progress in seeing how technology has transformed legal relationships. Laws now need to adapt to a virtual reality. In addition to the rights understood as providing services that, to be realized, require positive action by the state through public policies (Gonçalves, 2018a, 2018b), the right to information also involves the actions of private entities.

What matters now is facing the reality that technology and globalisation have brought to society. The absence of normative commands that impose limits on the digital landscape encourages self-regulation on the part of large companies that process data to meet market demands. From this perspective, human rights have created a breeding ground for new laws that set limits on data management. Human rights can reach both businesses and government policies through their universality (Suzor, 2020).

In the age of easy and rapid dissemination of information, the regulation of data traffic brings a scenario of concern Suzor (2020) and an insurgent market with new conceptions of buyers and sellers Frontier Technology Quarterly (2019). In this way, this paper seeks to discuss how “digital constitutionalism” and the concept of the data economy have been creating a new market and regulation scenario for large companies that own information and how regulatory advances have contributed to making the present and future of computerisation legally viable to ensure rights.

The digital revolution has brought about significant changes in contemporary society, particularly in our legal systems and constitutional norms. Current constitutions were developed for a different era and are currently dealing with the difficulties posed by the digital revolution. The constitutional charters provide guidance on safeguarding our physical well-being but do not explicitly address the protection of our digital identity. The utilisation of digital technology has the potential to address imbalances in power among constitutional actors. However, traditional constitutional texts fail to acknowledge these new possibilities. One interesting development in response to this situation is the rise of what can be referred to as “Internet bills of rights.” The documents presented are non-binding declarations that promote constitutional principles for a digital society. Celeste (2023), the successful implementation of digital transformation necessitates the adoption of constitutional standards that safeguard and uphold human rights. Without these standards, the progress of constitutionalism within the realm of digital transformation would be impossible to achieve. One aspect that requires attention is the necessity for a normative definition and regulation of the right to access the Internet European Law Institute (2021).

Most states, establish the right to access the Internet through specific legislation. This approach allows for the implementation of ratified conventions and recommendations from international organisations while also avoiding the need to amend the constitution. However, it is important to consider the incorporation of constitutional ideas, concepts, and doctrines into the “body of the Constitution.” This is because the constitution, being the most powerful legal document, must address the global processes of social and legal modernisation Korniienko et al. (2022).

Concerns such as safeguarding individual privacy, mitigating algorithmic bias, and reconciling the disparity between the right to public access to information and data under the control of a select few have emerged as challenges brought about by the digital age. Protecting digital rights should, therefore, be incorporated into public policies in order to achieve a more equitable equilibrium of interests and rights among various stakeholders Song and Ma (2022). The possibility of protection gaps and evolving values over time indicate that, in the digital age, new fundamental rights must be considered. This exercise in thought provokes an innovative examination of essential rights as opposed to exclusively implementing established rights. This classification of legal concerns novel issues that emerge as a result of the implementation of emerging technologies for which there are presently no established rights. The EU’s right to data protection, the right to be forgotten, and the right to data portability, as defined in the GDPR, are instances of recently introduced rights (Custers, 2022).

From the perspective of businesses and consumers, it is crucial that regulatory frameworks effectively safeguard consumer data, irrespective of technological advancements. To prevent regulatory obsolescence and innovative subversion by businesses, it is essential that legal and protective parameters be formulated with a technology-neutral approach. However, in addition to imposing limitations, we advise regulators to collaborate closely with businesses to ascertain how the proposed regulations are likely to be implemented in practice (Quach et al., 2022). The influence of big data technologies on privacy (and consequently human dignity) covers everything from group privacy and high-tech profiling to data discrimination and automated decision-making. It becomes particularly important when individuals share personal information in the online context at various stages of their lives, with varying levels of awareness.

Here, individuals frequently have the ability to present their ideas and findings. It is concerning how easily data miners can access and exploit freely available data from social networks and other sources linked to an IP address for profiling purposes.

There is a significant concern when it comes to big data regarding the potential for re-identification of individuals even after their data has been anonymised. It is possible for this to happen by utilising de-anonymisation technologies that have become more accessible due to the enhanced computational capabilities of modern personal computers. This allows for identifying the original personal data (Da Bormida, 2021).

2 Digital Constitutionalism

It is clear from looking at the global effects of the new General Data Protection Regulation (2018) that the GDPR will have a significant impact in at least three key areas. There are several important aspects to consider in relation to data protection regulations. These include the right to erasure, which is also known as the “right to be forgotten,” as outlined in Article 17 of the GDPR. Additionally, the territorial scope of the regulation, determined by Article 3 of the GDPR, is a crucial factor to take into account. Another significant consideration is the commission’s decisions on the adequacy of data protection in third countries, which are regulated under Article 45 of the GDPR. Lastly, it is worth noting that multinational companies that fail to comply with the regulation may face substantial penalties, as defined in Article 83 of the GDPR (Rubinstein & Petkova, 2018).

The ECJ has consistently upheld strict data protection standards when it comes to tech companies. This means that IT providers offering services within the EU internal market are required to comply with EU data protection laws. As a result, data subjects are given enhanced protection under these laws. In this context, the ECJ has acknowledged a right to be forgotten, which has been subsequently incorporated into the GDPR and adopted by various other courts (Fabbrini & Celeste, 2020). Fundamental rights are the greatest representation of the constitution of a democratic state, guaranteeing the exercise of individual freedoms and respecting the limits of life in society (Carvelli & Scholl, 2011). The first declaratory text to illustrate the birth of fundamental rights was the Declaration of the Rights of Man and of the Citizen, representing the historical moment of the French Revolution, considered to be first-dimension rights, whose holder is the individual without state interference for the exercise of individual freedom (Bonavides, 2009). The second dimension presents state action as one of its facets; from this perspective, the state starts intervening to provide social welfare. Bonavides (2009) adds that the fundamental rights that correspond to this categorisation include social, cultural, economic, and other rights attributed to the community.

For Bobbio (2004), third-dimension rights, which were included in the 1948 Universal Declaration of Human Rights, represent the protection of the rights of humanity, such as the environment and culture. These are inalienable rights that belong to the whole of society. First-generation rights (civil and political rights), which include classic, negative, or formal freedoms, emphasise the principle of freedom and second-generation rights (economic, social, and cultural rights), which are identified with positive, real, or concrete freedoms, emphasise the principle of equality, third-generation rights, which materialise powers of collective ownership attributed generically to all social formations, enshrine the principle of solidarity and constitute an important moment in the process of development, expansion, and recognition of human rights, characterised as unavailable fundamental values by the note of an essential inexhaustibility (Lafer, 1995).

In the context of the fourth dimension of fundamental rights, Bonavides (2009) argues that “political globalisation in the sphere of legal normativity introduces fourth-generation rights, which, incidentally, correspond to the final phase of institutionalisation of the social state. Thus, understood as rights that govern the democratic social order, fourth-generation rights outline the first parameters for regulating information.

Some consider them to be fourth-dimension rights (Novelino, 2009), and others fifth Holanda (2007a, 2007b). At this point, it is worth discussing how digital constitutionalism presents itself as a tool for measuring rights and enabling responsible and ethical use in the virtual environment. The norms that aim to regulate digital (Gill et al., 2015) space must be based on the following premises: substantive content, political community, formal recognition and legitimacy, and degree of scope.

These dimensions seek, respectively, to guarantee an environment that promotes individual freedoms and the articulation of rights, political action through directive documents that announce universal principles that should be applied in the use of the Internet, formal expression of documents that have the content of announcing rights and duties, and, finally, the degree of comprehensiveness, with the aim of avoiding empty determinations that only have the scope of establishing criteria that apply to specific situations, since the rules that should govern the digital sphere presuppose universal applicability (Gill et al., 2015). In turn, digital constitutionalism can be categorised as follows: fundamental rights and freedom; general limits on state power; Internet governance and civic participation; privacy and surveillance rights; access and education; openness and stability of networks; economic rights and responsibility (Gill et al., 2015).

There are significant considerations that the authors have broken down within this division with the intention of guiding the process for managing data, acts, and rights within the Internet. Based on this categorisation and subdivisions, the categorisation would be as follows:

  • Basic or Fundamental Rights and Freedoms: This category includes freedom of speech and expression; freedom of information; freedom of (religious) belief; freedom of association and protest; the right to personal security and dignity; protection of children; non-discrimination; and cultural and linguistic diversity.

  • General Limits on State Power: Encompassed here are democracy and the rule of law; the right to due process; and the right to legal remedies.

  • Internet Governance and Civic Participation: This area covers multi-stakeholder and participatory governance; transparency and openness; open data; the right to participation; and digital inclusion.

  • Privacy Rights and Surveillance: Included are privacy rights; data protection; control and self-determination; the right to anonymity; protection from surveillance; the right to use encryption; and the right to be forgotten.

  • Access and Education: This encompasses the right to access; speed and affordability; access and skills in the workplace; user awareness and education; and media and digital literacy.

  • Openness and Stability of Networks: This includes security of the network, net neutrality, open standards, interoperability and non-fragmentation, stability and reliability of the network, free and open source software, and device rights.

  • Economic Rights and Responsibilities: This section contains information on innovation, competition, economic development, intellectual property, intermediary liability, corporate responsibility, and consumer protection (Gill et al., 2015).

Based on these categories, it is possible to understand how digital constitutionalism has established itself as a normative guideline to guide actions within digital spaces as well as to settle any conflicts. It should be noted, in turn, that the guidelines described above are in line with human rights, respecting the individual as a person and as a community. In this way, it is pertinent to make a correlation with the law that is already in force on the European scene, the General Data Protection Regulation (GDPR) (2018), which was systematised using seven principles as a basis, enshrined in Article 5 of the GDPR. These principles guide the normative rules that follow them through guiding values such as limitation and specific purpose of use, as well as responsibility for unauthorised use and measures that seek to prevent harmful conduct. The attempt to regulate intangible space is exemplified by some rules that have sought to regulate permissible and prohibited conduct, such as the Marco Civil da Internet, Brazil (2014, 2018), the General Data Protection Law, Law No. 13,709, was inspired by the General Data Protection Regulation (GDPR) (2018).

From this perspective, human rights formed the basis for the creation of the rules already in force as well as the new laws still under discussion to define the margins of action in the handling of data. Another point that should be considered is the instructive role of this process since human rights can reach businesses, government policies, and the agents who make their information available on the Internet daily through their universality (Suzor, 2020). In addition, Suzor (2020) points out that to change this “status of freedom” on the Internet, it is also necessary for users to understand the responsibility and importance of making efforts to use the digital space democratically. Internet intermediaries enjoy broad discretion to create and enforce their rules in almost any way they see fit. They make decisions based on their own vision of how they want users to behave, their business plans, and commercial interests, as well as in response to their exposure to legal risk and potential bad publicity (Suzor, 2020).

Despite the harmful nuances of technology in terms of computerisation and the ease with which controversial content can be shared, culminating in misinformation and the spread of untrue news Mendes and Fernandes (2021), it is also necessary to recognise the benefits of democratising access to knowledge through digital platforms. According to research by the United Nations, which gave rise to the report Measuring Digital Development: Facts and Figures in 2019, 4.1 billion people have Internet access, corresponding to 53.6% of the world’s population. Although these are significant figures for a connected society, there is another side. There are more than 3.1 billion people who don’t take advantage of what the Internet has to offer.

From this angle, according to the list of rights outlined above, in addition to providing a regulated space, digital constitutionalism is also linked to the promotion of rights, which is to enable more people to be inserted into the Internet and exercise their rights to access information, education, privacy, and transparent, lawful, and responsible use of the data made available. In this vein, Boaventura states that regulation, through the tools available to the law, is an indicator for resolving social tensions and includes political measures. The author also states that it is one of the ways of protecting universal rights so that parameters and criteria that cannot be delegitimised can be established, even if they are applied in different contexts. Based on this logic, the rise of regulation in the digital landscape aims to ensure the uniform application of the limits imposed and the rights in order to provide the security and legal viability necessary for the expansion of this segment.

An interesting aspect of the GDPR is its capacity to extend its jurisdiction to international organisations that may not be based in the EU. With the implementation of the GDPR guidelines, this ruling has the potential to significantly impact global tech companies by mandating compliance for non-EU data controllers and processors who target individuals in the EU. It is worth noting that although there has been an increase in the number of large international companies being fined for violations, the majority of these fines in the past two years have been imposed on companies based in the EU, providing solely to European clients. Consequently, smaller companies have generally faced more substantial fines during the time period under examination. When analysing the percentage of annual revenue, it is observed that smaller fines imposed on national companies tend to be relatively higher, even when considering the outlier fines exceeding €1 million. While the largest fines may seem immense, they still fall short of reaching the maximum limit. On the other hand, the smaller fines come much closer to hitting the maximum limit, which is either 2 or 4% of the annual turnover amount. It is evident that the GDPR poses a greater risk to smaller national European companies compared to large international tech companies with significant global influence and higher web traffic (Wolff & Atallah, 2021).

3 Data Economy

The globalisation of the economy has brought new contours to the performance of activities in the digital sphere. What differentiates transactions involving data from other economic activities is basically established on two pillars: there is no express definition between the agents involved in the relationship as buyers, sellers, or consumers, and, on the other hand, the price does not follow the law of supply and demand (Frontier Technology Quarterly, 2019). The data economy has significant implications for distribution matters, which are heavily influenced by legal arrangements and entitlements. This phenomenon has various consequences, including increased commercialisation and government monitoring, the concentration of market power in monopolistic companies, negative environmental impacts, the transformation of labour into temporary and outsourced forms, the exacerbation of existing racial and social inequalities, and the widening gap between developed and developing nations. Technological advancements and network effects further amplify these distributive effects. The global data economy is regulated by international laws that promote trade liberalisation, often favouring technology corporations primarily located in the Global North. Algorithmic decision-making is now being used by international organisations and domestic welfare agencies to determine eligibility for welfare and humanitarian assistance (Vatanparast, 2021).

The data economy was organised around a “digital curtain” that obscured its practices from lawmakers and the general public for the majority of its existence. Even though the data originated from the private activities of customers, it was regarded as company property and a proprietary secret (Rahnama & Pentland, 2022). The heterogeneity of consumer privacy concerns can impact the effectiveness of the social planner’s data regulation policy. The optimal amount of data changes depending on the relationship between consumer privacy concerns and consumer type in different scenarios. This relationship can be positively correlated, negatively correlated, or uncorrelated. There can be significant variations in different scenarios, indicating the need for policy intervention by the social planner in certain cases while being ineffective in others (Wang et al., 2022). The diversity of consumer privacy concerns has an impact on the firm’s data collection practices, which consequently influences the effectiveness of data regulation policies (Wang et al., 2022). The data economy is governed by guidelines that conventional economic theories cannot yet explain. Unlike any product in circulation today, data, as a new member of the production chain, presents a challenge to legislation and economic regulation. Furthermore, the pricing of data depends on the context in which it is inserted and how it is intended to be used.

One aspect that sets informational capitalism apart is its impact on legal institutions and the granting of quasi-legal entitlements. Additionally, it is reshaping markets in unprecedented ways. The use of data for governance has the potential to supplant traditional methods such as law and markets for organising society. Given that the nature of data is not competitive, technology firms often claim quasi-property rights and charge for data access (Vatanparast, 2021). Existing literature reveals three main consensuses in the field of big data-driven management innovation. Firstly, the utilisation of big data has become a valuable asset for companies in the digital economy, enhancing their ability to adapt and thrive.

Furthermore, the utilisation of big data resources enhances companies’ learning capabilities. For instance, by utilising big data analysis and processing, companies can enhance their capacity for exploratory and applied organisational learning. Furthermore, the process of creating value from big data necessitates that companies adapt, adjust, and update their key structures and capabilities. Companies must navigate the resistance of their established procedures and business models in order to maximise the benefits of big data analysis in decision-making (Xu, 2021).

Data is increasingly a critical factor in production, complementing labour and physical capital. But unlike capital or labour, data is non-depletable. The use of data by many does not diminish its quantity or value. On the contrary, the use of the data by many may increase its value. At the same time, data can become less relevant and less valuable over time. The value of data, unlike physical capital, also depends on its unique characteristics. An individual data point can carry little value, but its value can multiply manifold when aggregated and analysed with other relevant data Frontier Technology Quarterly (2019).

The companies at the top of the data economy pyramid are Google, Facebook, Uber, Airbnb, Netflix, Amazon, Apple, Microsoft, and others, also known as “data companies.” The giants of the market, Apple, Amazon, Facebook, Google, and Microsoft, had a turnover of more than 3 trillion dollars in 2018. Another impasse that arises is the monopoly exercised by these companies in the market. The report states: “The net effect on the economy can be negative, depressing overall employment, investment, and aggregate demand” Frontier Technology Quarterly (2019). Through the analysis of consumer portraits, consumer content, and consumer behaviour prediction, customised suggestions are provided for goods and services, enabling consumers to develop a stronger affinity for products. Consumer preference is often overlooked in the traditional approach to defining the relevant market by substitution (Frontier Technology Quarterly, 2019).

In addition to the economic clashes, Mendes and Fernandes (2021) draw attention to the ideological influence and intentional production of information that these companies have: instead of being merely passive agents in the intermediation of content produced by third parties, companies like Facebook, Google, and Amazon are able to interfere in the flow of information by filtering, blocking, or mass reproducing content produced by their users. This interference in the flow of information is also characterised by the intensive use of algorithms and big data tools that allow platforms to manipulate and control the way in which private content is propagated in a non-transparent way (Mendes & Fernandes, 2021).

The great contradiction experienced by this “new economy” is the accessibility and volume of data provided daily on websites, and the questions that arise are many: who is actually benefiting? How can users of online platforms protect themselves from possible illegal conduct? What is the responsibility of the owners of the information if it is used incorrectly or in a different way than what was agreed upon? In response to these questions, Mendes and Fernandes (2021) infer that the realisation of information and privacy rights is shifting from the public to the private sphere. In order to keep up with the fast-paced growth of the Internet and digital economy, it is crucial to enhance the standards used to evaluate the relevant market. The operational model of Internet platform operators poses challenges in accurately determining market share using traditional sales-based calculations. When examining this case, it may be worth exploring the possibility of incorporating additional factors to determine the relevant market. These factors could include the size of the user base, the scale of data, the impact of network effects, and the level of control over key facilities.

On the one hand, the data economy is radically transforming many economic activities and creating new levels of prosperity. On the other hand, it presents the possibility of a perilous dystopia, where participants in the data economy can face chronic trust deficits and insecurity (Frontier Technology Quarterly, 2019). Privacy-enhancing technologies (PETs) provide a promising solution to the ongoing conflict between privacy and the data economy. Some examples of PETs are differential privacy, federated learning, on-device computation, zero-knowledge proof, and secure multi-party computation Johnson (2022).

The performance of data on the Internet is used as a tool to induce society’s way of thinking and acting, directly influencing the decisions made (Suzor, 2020). The network itself is organised to serve people anywhere in the world, transmitting information immediately (Lévy, 1999). In this area, companies have played a discretionary role in disseminating information and using data to meet their own needs and the interests of the market. In short, digital constitutionalism requires us to develop new ways of limiting abuses of power in a complex system that includes many different governments, businesses, and civil society organisations. The difficult task of digital constitutionalism is to build consensus about how power over the Internet should be shared and limited, how those limits may be imposed, and by whom (Suzor, 2020).

In order to curb this discretionary process, Suzor (2020) advocates the creation of laws that provide a substantial structure so that these relationships can be conducted in the public interest and within the moral limits of society. Faced with the challenges posed by this new system, the author points out that this is the time to discuss the creation of new ways of regulating activities in the digital sphere. Internet governance is, therefore, an indispensable issue. For Kurbalija (2016), governance outlines a reference framework with the aim of enabling communication between agents and decision-making. The current era of Internet governance is closely linked to the concept of digital constitutionalism.

The aim of digital constitutionalism is to reconsider how the exercise of power should be constrained and justified in the era of digital technology (De Gregorio & Radu, 2022). This governance model explores the decentralisation of state sovereignty, focusing on the traditional criterion of jurisdiction. The creation and implementation of legal norms are shifting away from the traditional focus on the United States and towards non-governmental entities. The transnational nature of network governance necessitates that constitutional courts consider the various ways in which international actors interact in the regulation of the Internet when assessing the constitutionality of domestic laws (Mendes & Fernandes, 2021). Since the data economy is in the present, it is undeniable that this situation is already showing signs that it will develop and reach more and more people in the present and the future. Thus, with a view to structuring paradigms that consider development, security, and human rights, in 2017, the United Nations Development Group proposed guidelines for handling data in the coming years, such as through UN Global Pulse, ensuring the production of reports that contribute to monitoring the use of data (Frontier Technology Quarterly, 2019).

In addition, the United Nation (2014) introduced actions such as monitoring and supervising how private entities are handling data in order to prevent possible abusive conduct. The UN World Data Forum in 2018 addressed statistical migrations allied to the objectives of the 2030 Agenda for Sustainable Development, and the 2017 Forum dealt with policies to improve the programmes used in government action (Frontier Technology Quarterly, 2019). Following this path, the European Law Institute (ELI), in partnership with the American Law Institute (ALI) in 2021, outlined potential principles that can be applied to transactions involving data. The document constitutes initial steps towards the implementation of general rules involving transactions with data, including in the draft document some clauses that could be present in contracts, such as the designation of the intellectual property of data, privacy and limitation, and determination of the use of the information collected. Another important mechanism that is being studied with the possibility of use is economic participation in the profits arising from the use derived from the data. Since the scope and multiplicity of the management of the information made available generate revenue, this should be shared.

Although not formalised before the international community, the discussion of this document and the observations made throughout the text demonstrate the willingness to draw the lines that will define how contracts involving data and information will be regulated and economically treated. Between laws, contracts, clauses, companies, and users, the data economy presents itself in a scenario, despite many uncertainties and obstacles, that is promising for the growth of the economy and the expansion of information technologies, which if well-managed, will contribute to the development of society by expanding access and making human rights effective in their various dimensions.

4 Conclusion

This research paper sought to discuss the roots, trends, innovations, and dilemmas of regulation in the context of digital constitutionalism linked to human rights. In light of the research carried out, which is a field that is in the process of being refined, it can be seen that the main normative guidelines have served as the basis for legislation in various countries, which demonstrates the commitment of nations to demarcating the boundaries of this new business space. On the other hand, despite the advances made so far, these are still insufficient in the face of the magnitude that computerisation and data sharing have become in the globalised era. There are still regulatory gaps governing financial transactions involving data. As a result, this creates instability both for those who use data as their main raw material and for users and consumers, who, in many cases, do not have the opportunity to know how their personal data is collected, used, and stored.

In terms of legal and economic regulation, the data economy is an imminent and unavoidable reality, which means that regulatory guidelines and the market need to define the extent to which activities that handle data can be established for fear of becoming a convenient scenario for illegal activities. On the other hand, the expansion of these businesses is led by information fronts that have a differentiated technological structure, which creates a less competitive environment for the resources these companies use. In view of the above, small and medium-sized companies are not able to be on an equal footing in terms of enabling the application of data processing in accordance with current legislation, which dismantles the market, leaving the same economic circle of organisations holding the financial opportunities provided by this ubiquitous asset of data handling.

The challenges begin as we come to understand the reality that needs to be addressed. We cannot treat the data economy as a future issue requiring greater legal rigidity and economic regulation. It is an urgent matter that must be managed now to ensure that all agents involved in the production cycle can utilize its benefits in compliance with the law. This will help make the data economy an economically viable activity across all proposed levels: legislative, financial, organizational, transparency, and parity with the consuming public.