Not the law itself: Notice

Address https://gelex.eu/eli/EU/notice/oj/C/2016/463/09@2016-12-13/en

Contents

1. Preamble

Processing personal information is indispensable to web-based services. The EU’s Digital Single Market Strategy recognises the potential of data-driven technologies and services as a catalyst for economic growth. Such services over the internet have become dependent on often covert tracking of individuals, who are generally unaware of the nature and extent of that tracking. Dominant companies in these markets may be able to foreclose new entrants from competing on factors which could benefit the rights and interests of individuals, and may impose unfair terms and conditions which abusively exploit consumers. An apparent growing imbalance between web-based service providers and consumers may diminish choice, innovation and the quality of safeguards for privacy. This imbalance may also raise the effective price — in terms of personal data disclosure — far beyond what might be expected in fully competitive markets. In 2014 the EDPS issued a Preliminary Opinion on Privacy and Competitiveness in the Age of Big Data. We observed a tendency, despite obvious synergies like transparency, accountability, choice and general welfare, for EU rules on data protection, consumer protection and antitrust enforcement and merger control to be applied in silos. We therefore launched a debate on how the EU’s objectives and standards might be applied more holistically. This new Opinion argues that the Digital Single Market Strategy presents an opportunity for a coherent approach, and updates the 2014 Preliminary Opinion with some practical recommendations to the EU institutions on how to remedy the situation. It addresses the mounting concern that concentration in digital markets could harm the interests of individuals as data subjects and consumers. The EU institutions and bodies, and national authorities when implementing EU law, are required to uphold the rights and freedoms set out in the Charter of Fundamental Rights of the EU. Several of these provisions, including the rights to privacy and to the protection of personal data, freedom of expression and non-discrimination, are threatened by normative behaviour and standards that now prevail in cyberspace. The EU already has sufficient tools available for addressing market distortions that act against the interests of the individual and society in general. A number of practices in digital markets may infringe two or more applicable legal frameworks, each of which is underpinned by the notion of fairness. Like several studies in recent months, we are calling for more dialogue, lesson-learning and even collaboration between regulators of conduct in the digital environment. We also stress the need for the EU to create conditions online, as well as offline, in which the rights and freedoms of the Charter may thrive. This Opinion therefore recommends establishing a Digital Clearing House for enforcement in the EU digital sector, a voluntary network of regulatory bodies to share information, voluntarily and within the bounds of their respective competences, about possible abuses in the digital ecosystem and the most effective way of tackling them. This should be supplemented by guidance on how regulators could coherently apply rules protecting the individual. We also recommend that the EU institutions with external experts explore the creation of a common area, a space on the web where, in line with the Charter, individuals are able to interact without being tracked. Finally, we recommend updating the rules on how authorities apply merger controls better to protect online privacy, personal information and freedom of expression. OPENING UP THE DEBATE Background and structure of this Opinion Our 2014 Preliminary Opinion on Privacy and Competitiveness in the Age of Big Data (hereafter, the Preliminary Opinion) compared EU legal frameworks for data protection, competition and consumers, and concluded that there were some obvious synergies in the context of digital markets. We made some tentative recommendations for EU institutions that were refined following a workshop hosted by EDPS in June 2014, including:

1. to understand better the value of personal data in digital markets and review approaches to market analysis, in particular for those web-based services promoted as free, with retrospective or ex post analysis of the impact of enforcement decisions;

2. to consider how to foster privacy-enhancing technologies as a competitive advantage;

3. to review EU legislation and relevance for 21st century digital markets;

4. to consider practical steps for cooperation between authorities, including closer dialogue and joint investigations.

CONCLUSION Human rights were conceived as means for individuals to be safeguarded against state interference. Antitrust has its roots in political decisions to disrupt abusive monopoly power for the benefit of society at large. Consumer rights emerged as a bulwark against abusive traders. Big Data opportunities for boosting productivity and connectivity should be accompanied by Big Data Protection safeguards. The EU in recent years has shown great leadership in seeking to stimulate a race-to-the-top on privacy standards in the digital arena. The General Data Protection Regulation provides a benchmark for protecting personal data in the digital economy. For a digital economy and society founded on the EU’s values, the EU can still do more with the tools available to ensure privacy friendly, fundamental-rights-enhancing products and services. Enhanced transparency, fair treatment, effective choice, absence of market foreclosure for non-tracking models are all entirely compatible and complementary goals. The Digital Single Market Strategy is the right opportunity for the EU to work coherently towards these goals. Effective enforcement of EU law existing rules is of paramount importance. We believe our recommendations for a Digital Enforcement Clearing House, together with a more holistic approach to concentration and the promotion of an EU values-based common area, would be important steps forward. At a time when data protection and privacy laws are proliferating around the world, this should be a platform for greater bridge-building to other regions of the world, permitting greater dialogue and cooperation with all countries facing the same digital challenge. This is not the final word on this discussion. The EDPS intends to continue to facilitate discussions and help to break down silos which hinder the protection of the interests and rights of the individual. Done at Brussels, 23 September 2016. Giovanni Buttarelli European Data Protection Supervisor

Versions

1. 2016-12-13