Data protection

The main rule: ownership no, protection yes

We cannot speak of the ownership of data or information. According to the law the concept of ownership may only be applied ‘to physical objects susceptible to human control’. You cannot actually hold data. As such, it is not a physical object so there can be no ownership of data.

For this reason, specific laws have been made to ensure that immaterial objects can be protected. The laws on copyright, patent and trademarks focus on this but also privacy legislation, database law and the law protecting trade secrecy, for instance.

Copyright protection

Under Dutch case law a work must have an original character, be the result of creative choices and bear the personal stamp of the creator. In addition, the form may not be borrowed from other works. Data may therefore be eligible for copyright protection if the data has a sufficiently original character and bears the personal stamp of the creator.

Primary data will not easily qualify as such because the criteria “original” and “personal stamp” do not apply to observed or measured data. Bare facts are therefore not subject to copyright.

Secondary data may qualify if the specific appearance of the data demonstrates the creator’s own original character and the creator’s personal stamp. In order to determine who holds the rights, copyright regulations, any agreements and relevant legislation and regulations (e.g. collective labour agreements) are followed in these cases. 

Protection by database right

Data may also be indirectly protected by database right. A database is a collection of works, data or other independent elements which are systematically or methodically arranged and separately accessible by electronic means or otherwise and the obtaining, verification or presentation of which is evidence of substantial investment, evaluated qualitatively or quantitatively, in terms of the content.

If the database act can be invoked, the right holder has the exclusive right to (re)use the whole or a substantial part of the contents of the database. This protection is free and is valid for 15 years after production.

A substantial investment in the acquisition, control or presentation of the content is an important condition to qualify for this form of protection. This is both in terms of quality and quantity. The investment concerned only covers the search, collection, control and presentation of existing data and not the methods used to create the data that together make up the database. Exactly when we speak of a ‘substantial investment’, is difficult to define in practice.

As a logical consequence of the substantial investment criterion, the database right holder is the party who bears the investment risk. Moreover, individual data in the database may also be protected by copyright. For instance, because there is copyright on the texts or photographs included in the database.

Data protection as a trade secret

Data could be classified as a trade secret. The acquisition, use or disclosure of a trade secret is unlawful. This type of protection is relatively new and has only existed since 2018 (the Trade Secret Protection Act).

The law stipulates requirements for data to be granted the status of a trade secret. There must be no generally known or accessible data, the data must have commercial value and the right holder must have taken reasonable steps to keep his data secret.

Data that is not protected by database law because it has, for instance, been created by conducting research might possibly be protected by classifying it as a trade secret.

It is important that proper agreements are made between all parties involved on how to deal with trade secrets (via confidentiality agreements or non-disclosure agreements).

Protection of personal data

If data, alone or combined with other data, could result in the identification of an individual then this relates to personal data. The provisions of the General Data Protection Regulation (GDPR) apply to this. The GDPR stipulates that processing personal data must be handled with utmost care. The individual whose data is stored has far-reaching rights to control this data. Also see the Quick reference guide on the GDPR.

Questions? get in touch with your Copyright Information Point (AIP)

Do you have further questions about this quick reference guide? Please contact one of the members of staff at the Copyright Information Point (AIP) of your institution.