To address the disorderly state of data transactions, characterized by firms’unauthorized sale of data assets, the general rule of unauthorized disposition from traditional property law can be effectively applied to balance the interests of all parties and regulate the market. However, given the unique characteristics of data, such as its non-exclusivity and indeterminate value, this rule requires specific adaptation. Regarding contract validity, although both transactions that harm the national security and the public interest and those that infringe upon statutory prior rights constitute unauthorized dispositions, contracts of the former type should be deemed invalid, while those of the latter should be considered valid. Concerning bona fide acquisition, it is advisable to treat delivery as the manifestation of rights, to incorporate factors such as the results of registration inquiries, the transaction environment, and transaction prices into the determination of good faith, and to exclude disassociated data assets from the scope of applicability. As for the legal consequences: (1) In cases of an invalid contract, the application of property restitution rules should be excluded in a categorized manner based on overarching legal principles. Where a valid contract constitutes bona fide acquisition, the bona fide acquirer should be granted limited property rights over the data, while the original right holder’s claim for damages must be recognized. (3) For a valid contract that is not subsequently ratified and does not constitute bona fide acquisition, it is necessary to reinterpret the original right holder’s claims for both restitution of the asset and damages, and to clarify the unauthorized disposer’s liability for breach of contract.
