Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Digital Markets Act

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)l

(2021/C 147/04)

On 15 December 2020, the Commission published a Proposal for a Regulation of the European Parliament and of the Council on contestable and fair markets in the digital sector (Digital Markets Act). The Proposal follows the Communication Shaping Europe’s Digital Future, which indicated that additional rules may be needed to ensure contestability, fairness and innovation and the possibility of market entry, as well as public interests that go beyond competition or economic considerations. The Proposal establishes ex ante rules to ensure that markets characterised by large platforms with significant network effects (‘gatekeepers’), remain fair and contestable.

In doing so, the Proposal sets out provisions concerning the designation of gatekeepers which takes into account the data driven advantage related among others to the provider’s access to and collection of personal data; obligations and prohibitions to which the gatekeepers are subject; rules for carrying out market investigations; provisions concerning the implementation and enforcement of the Proposal.

In this Opinion the EDPS welcomes the Proposal, as it seeks to promote fair and open markets and the fair processing of personal data. Already in 2014, the EDPS pointed out how competition, consumer protection and data protection law are three inextricably linked policy areas in the context of the online platform economy. The EDPS considers that the relationship between these three areas should be a relationship of complementarity, not a relationship where one area replaces or enters into friction with another.

The EDPS highlights in this Opinion those provisions of the Proposal which produce the effect of mutually reinforcing contestability of the market and ultimately also control by the person concerned on her or his personal data. This is the case for instance of Article 5(f), prohibiting the mandatory subscription by the end-users to other core platforms services offered by the gatekeeper; Article 6(1)(b), allowing the end-user to un-install pre-installed software applications on the core platform service; Article 6(1)(e), prohibiting the gatekeeper from restricting the ability of end-users to switch between different software applications and services; and Article 13, laying down the obligation for the gatekeeper to submit to the Commission an independently audited description of any techniques for profiling of consumers that the gatekeeper applies to or across its core platform services.

At the same time, the EDPS provides specific recommendations to help ensure that the Proposal complements the GDPR effectively, increasing protection for the fundamental rights and freedoms of the persons concerned, and avoiding frictions with current data protection rules. In this regard, the EDPS recommends in particular specifying in Article 5(a) of the Proposal that the gatekeeper shall provide end-users with a solution of easy and prompt accessibility for consent management; clarifying the scope of the data portability envisaged in Article 6(1)(h) of the Proposal; and rewording Article 6(1)(i) of the Proposal to ensure full consistency with the GDPR; and raising the attention on the need for effective anonymisation and re-identification tests when sharing query, click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper.

Moreover, the EDPS invites the co-legislators to consider introducing minimum interoperability requirements for gatekeepers and to promote the development of technical standards at European level, in accordance with the applicable Union legislation on European standardisation.

Finally, building among others on the experience of the Digital Clearinghouse, the EDPS recommends specifying under Article 32(1) that the Digital Markets Advisory Committee shall include representatives of the EDPB, and calls, more broadly, for an institutionalised and structured cooperation between the relevant competent oversight authorities, including data protection authorities. This cooperation should ensure in particular that all relevant information can be exchanged with the relevant authorities so they can fulfil their complementary role, while acting in accordance with their respective institutional mandates.

1.   INTRODUCTION AND BACKGROUND

2.   CONCLUSIONS

In light of the above, the EDPS makes the following recommendations:

(1)  COM(2020) 842 final.

(2)  COM(2020) 67 final.

(3)  COM(2020) 842 final p. 1.

(4)  COM(2020) 842 final p. 2.