Abstract: Data brokerage decouples the constraints imposed by vertical data relationships on horizontal data relationships, giving rise to a novel type of derivative harm. Such harm is characterized by intangibility, latency, and cumulativeness. It cannot be adequately addressed solely by strengthening personal information protection, nor can it be easily subsumed under traditional tort liability frameworks, thus necessitating separate and ex-ante regulation. While data protection impact assessments (DPIAs) and fair data brokerage practices hold potential for materializing abstract risks into tangible harm, their effectiveness depends on incorporating substantive criteria for evaluating derivative harm. From an ex-ante prevention perspective, data integration analysis—considering the level of anonymization, data sensitivity, data collective volume, and the proportion of inferred data—should be embedded into DPIAs. Similarly, data integration analysis that accounts for the degree of subject overlap, embedded attribute overlap, processing purpose overlap, and temporal overlap should be integrated into fair data brokerage practices. The substantive degree of derivative harm must be comprehensively assessed based on the number of potential victims, the probability of harm occurrence, and the severity of harm. From an ex-post liability attribution perspective, responsibility allocation should be scientifically delineated according to the causal contribution of data brokerage activities and primary infringing acts to the harm.

Key Words: Data Brokerage; Derivative Harm; Data Relationships; Substantive Harm; Data Integration Analysis

 

Author: Tang Linyao, Ph.D. in Law, Associate Researcher of the Institute of Law, Chinese Academy of Social Sciences, Associate Professor of the University of Chinese Academy of Social Sciences.

Source: 2 (2026) The Jurist.