I hope this is the right place to ask. I thought that a forum about open data would probably attract people who know about how open data is (or NOT is) :)

we are a company that (among other things) hosts a lot of data from different companies in the same business.Those are 100% pure commercial activities. For examples sake, let's say our clients are all cardealers.

Each client has his/her's own database. Those databases reside on our servers. We create applications that help them manage their sales. We know exactly what each of the cardealers is doing; how many red cars that dealer sold, how many blue cars that dealer sold, how many sportscars, average price, what town, extra safety-measures sold..... You get my drift.

We are thinking about aggregating that data, creating new data:

  • Town X loves red cars but hates sportscars
  • Town Y loves red sportscars and loves sportscars
  • Town Z spends noticably more on extra safety-measures

If that data is aggregated, anonimised in such a way that it is no longer possible to determine who sold which car to whom, could we consider that data our own? Can we do with that data as we please?

Would we be allowed to:

  • make that data available commercially? (sell it to car manufacturers)
  • make that data available non-commercially? (make it publicly available)
  • make that data available for explicit non-profit organisations? (give it to organisations dedicated to making our streets safer)

After all, we feel we create new data that did not exist if it were not for us. Therefore, we should be allowed to do with it what suits us. But is that so? Who can tell me what rules, morals, ethics or laws apply?

Thanks for thinking with me! Henro

  • Henry, in which country are you based? This might have an impact on what you can and can't do.
    – magdmartin
    Commented Sep 17, 2013 at 14:06
  • @magdmartin The Netherlands. I suppose things like this are governed by laws but I have no idea where to look for them
    – Henrov
    Commented Sep 17, 2013 at 14:14
  • There's a suggestion to retitle this question ... but it might narrow the scope ('Can I release ...'). I personally think the question goes back to who is considered to 'own' the new / reduced information (and thus what their rights are)
    – Joe
    Commented Sep 18, 2013 at 15:59

2 Answers 2


I think you should check first if the agreement you have with your customers allow you to reuse and mix their data and in so in which conditions.

You can also look at the standard and guideline promoted by of the Dutch DPA or the European Data Protection Supervisor in term of privacy.

  • Well, there are a lot of words dedicated to the way we store their data, the specific datacenter even (very convenient when the whole worlds seems to take flight and aim for the clouds). There is a passage about us being responsible for the confidentiality of their data. But nothing gearing towards: "thou shalt not be a smartass with my data" or "thou shalt not help others with non-traceable data"
    – Henrov
    Commented Sep 17, 2013 at 14:19

If you're responsible for confidentiality of the data, releasing aggregated data would be bad if there turns out to be a way to get identifying information back out.

You might want to consider what are the risks of this exposing you to a lawsuit, criminal proceedings, or just simply loss of customers (current or future). This means it's both a regional question -- both in terms of laws and cultural norms.

It might be that you can get around this by sharing with your customers what things you might be able to generate using their data, and get their permission to make it available to others. (and possibly release their claims to it, so that you're free to do other things with it)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.