A recent ruling by the Netherlands Commercial Court (NCC) has made it clear that, under Dutch law, data is not considered ‘goods’ and therefore cannot be subject to ownership.
The ruling means that under Dutch law a property right cannot be created on documents and data situated in the Netherlands. The court clarified that ownership can only be vested in “corporeal objects that are subject to human control” under the Dutch civil code. Digital data therefore does not qualify as ‘goods’ that are subject to ownership.
Legal experts said that businesses, particularly those who outsource research projects or clinical trials to entities located in the Netherlands, will have to rely on good contract drafting skills to ensure their control and possession of data that is generated in the course of the services that they procure.
The decision was made by the NCC on a claim for revindication of clinical trials documents and data between US-based sponsor Diamedica Therapeutics Inc and its contracted research provider PRA, which is located in the Netherlands. According to the agreement entered into by both parties, a wide range of documents and data relating to the clinical trial “will be” DiaMedica’s property, although the court said that the use of the future tense in this provision does not indicate that ownership requires actual delivery in the future.
The court found that under New York state law, the definition of “data” includes the raw data generated during the clinical trials as well as PRA’s investigator file. Under Dutch law, by operation of the contract, there was instant transferral of ‘ownership’ to DiaMedica. However, DiaMedica could not claim actual ownership, as the data did not qualify as ‘goods’ under Dutch law.
“Although the outcome is not spectacular, it is relevant as the myth that data can be claimed as someone's property is persistent. Business should be aware that their control and possession of data that is generated in the course of services they procure very much depends on what they contractually agree,” said data law expert Wouter Seinen of Pinsent Masons.
The decision, however, does not clarify the position of certain digital assets, particularly non-fungible tokens (NFTs), under the Dutch law, as the cryptocurrency market grows rapidly.
“It is a pity that the court did not discuss potential exceptions on this general rule, as certain digital assets pretty much have the same function as tangible goods. But that's probably too nuanced or distracting to cover in this case, because there are other decisions that do suggest that such exemptions exist,” said Seinen.
He explained that the Dutch criminal courts have confirmed that digital assets can be subject to "theft" and the civil courts have authorised the seizure of bitcoins.
The ruling is also significant to global businesses due to its General Data Protection Regulation (GDPR) implications. It underlines GDPR as another potential hurdle for foreign sponsors to control and possess data generated by research projects in the EU.
The NCC’s decision confirmed that the personal data of the clinical trials’ participants should remain within the EU. Some of the documents and data generated in the course of the trials contains personal data, including health data of the participants, and surrendering these documents to DiaMedica would qualify as a data transfer between joint data controllers under the GDPR.
The GDPR prohibits a transfer of personal data to a third country, in this case the US, unless the European Commission has decided that the third country in question ensures an adequate level of protection or where the controller or processor has provided appropriate safeguards. There is no current adequacy decision by the Commission regarding transfer of personal data to the US and the NCC is not satisfied that protection of the participants’ health data can be guaranteed by providing safeguards.
Relevant personal data generated from the trials must therefore remain within the EU for the time being. In addition, the court ordered DiaMedica to designate a representative within the EU where documents containing the participants’ personal and health data are to be sent.
Contact an adviser
