# The DMA and the GDPR: Making Sense of Data Accumulation, Cross-Use and Data Sharing Provisions

Muhammed Demircan

► To cite this version:

Muhammed Demircan. The DMA and the GDPR: Making Sense of Data Accumulation, Cross-Use and Data Sharing Provisions. 17th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2022, Virtual, Germany. pp.148-164, 10.1007/978-3-031-31971-6_12. hal-05315955

HAL Id: hal-05315955

https://inria.hal.science/hal-05315955v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# The DMA and the GDPR: Making Sense of Data Accumulation, Cross-Use and Data Sharing Provisions

Muhammed Demircan(✉)

LSTS Research Group, Brussels Privacy Hub, Vrije Universiteit Brussel, Brussels, Belgium
muhammed.demircan@vub.be

**Abstract.** The Digital Markets Act aims to fix the inherited problems of the digital markets by imposing obligations on large online platforms, also known as the gatekeepers. Such obligations involve data accumulation, data cross-use prohibitions and data sharing related obligations that heavily interplay with the data protection rules, hence the GDPR. However, all of these three provisions are highly linked to the data subject consent in the sense of the GDPR. The academic literature heavily criticised consent as the legal basis, especially in the context of the digital markets. This article firstly criticises the legal policy choice of consent to keep the digital markets contested and then analyses the risks arising from the aforementioned provisions for the EU data protection law, especially from the angle of the GDPR principles. It also focuses on the security of data transfers. It then evaluates the possible legal frameworks in order to minimise the risks, such as the data sharing agreements. It finally calls for a sector-specific approach to the general “per se” mentality of the DMA, supported by “core platform service specific” guidelines to be issued in order to minimise the risks for effective data protection in the digital markets.

**Keywords:** Digital Markets Act · General Data Protection Regulation · Data Accumulation · Data Cross-Use · Data Sharing

## 1 Introduction

On 12 October 2022, the final version of the Digital Markets Act (hereafter: “DMA”) was published in the Official Journal of the European Union [27]. Twenty years of underenforcement discussions in the competition law, arising from the neoliberal “laissez-faire” approach, have motivated European regulators to rethink and restructure the law of the digital markets [15]. DMA aims to fix the inherited problems of the digital markets by imposing obligations on large online platforms, also known as the gatekeepers. Such obligations involve data accumulation, data cross-use prohibitions and data sharing related obligations that heavily interplay with the data protection rules, hence the GDPR [26]. Nearly three years before the initial DMA proposal, the former head of the EDPS indicated that competition law and data protection law could no longer afford the
bureaucratic, jurisprudential, and theoretical burdens which stand in the way of efficient collaboration in an age of digital economy [6]. However, due to the hypercomplex nature of digital regulations interplaying with each other, providing efficiency and coherence between different legal instruments remains an enormous challenge, despite the goodwill of authorities.

The DMA intends to regulate the digital markets in an ex-ante methodology with a “per se” approach<fnref n="1" /> [1]. It can be claimed that one of the philosophical backgrounds of the DMA comes from a political attempt to face a legal-market problem that some have called data colonialism, big tech’s extreme concentration of data wealth [9]. Therefore, regulating digital markets in the DMA, which are built on data-consuming business models, including personal data, creates an inevitable overlap between the GDPR and the DMA. Where numerous DMA provisions openly refer to the GDPR, others remain unclear in providing efficiency and coherence. Among other digital legislative initiatives, the DMA focuses solely on the most prominent players in the digital markets. Therefore, it holds a unique place for the protection of personal data.

The DMA openly acknowledges in Recital 12 that it shall not apply with prejudice to the GDPR. Considering that personal data protection is a fundamental right (Article 16 of the Treaty on the Functioning of the European Union and Article 8 of the Charter of Fundamental Rights of the European Union) and that protecting and promoting fundamental rights are both the core and the aims of the EU policies [13], the DMA should be carefully analysed within the scope of its effects on personal data protection since it aims to regulate the market behaviour of enormous data-driven companies. After all, both regulations aim for the healthy functioning of the internal market in the EU [1].

Accordingly, this article comprises three main sections focusing on the synergies and tensions between the GDPR and the DMA. Section 2 aims to analyse the data accumulation, data cross-use prohibitions and data sharing related obligations in the DMA within the scope of the lawfulness of the processing principle in GDPR. Section 3 aims to address the options to ensure maximum compliance with the GDPR principles (including the principle of security of processing (Articles 5 and 32 of the GDPR) [26]) in Article 5. Section 4 explores the ways forward, including a call for sector-specific guidelines regarding data classification and standardisation. Finally, the conclusion sums up the findings of the article by suggesting creating a consent-legality monitoring team in the Commission as well as explaining the need for a sector-specific guidelines approach for obligated business user-gatekeeper data sharing.

## 2 Data Accumulation, Data Cross-Use and Data Sharing in the DMA: Legal Basis and Lessons

The DMA has numerous clauses that interplay with the GDPR. However, within the scope of this article, the focus will be given to a few core provisions of the DMA.

<footnote n="1">¹ “Per se” in Latin means “by itself” or “in itself” and here refers to the DMA’s presumed illegality over some commercial practices.</footnote>
One of the most significant provisions relating to personal data in the DMA is about the data accumulation and cross-use capacities of the gatekeepers<fnref n="2" />. According to Recital 3 of the DMA, gatekeepers are a small number of large undertakings providing core platform services<fnref n="3" /> with considerable economic power. Gatekeepers operate as multi-sided platforms, enabling two or more customer groups to engage with each other on their platforms by acting as a median in which the goods and services are offered to the end users by the business users<fnref n="4" /> [4].

The capacity to process vast amounts of data gives gatekeepers potential advantages in terms of the accumulation of data, thereby raising barriers to entry, according to the Recital 36 of the DMA [27]. Therefore, established firms like Google and Facebook have a significant competitive advantage over rivals thanks to their vast data processing capacities, which also causes high entry costs for possible new entrants [17].

Article 5(2)(b) of the DMA forbids gatekeepers to “combine personal data from the relevant core platform service with personal data from any further core platform services or from any other services provided by the gatekeeper or with personal data from third-party services”. Similarly, Article 5(2)(c) of the DMA prohibits to “cross-use personal data from the relevant core platform service in other services provided separately by the gatekeeper, including other core platform services, and vice-versa”. However, gatekeepers are allowed to combine or cross-use datasets if the end-user grants consent in the meaning of Article 7 of the GDPR.

Another remarkable provision highlighting the importance of data, including personal data, for building a competitive business atmosphere in digital markets is Article 6(10) of the DMA<fnref n="5" />. This article regulates the need of business users to access the data that has been “generated in the context of the use of the relevant core platform services” by the end users. This data sharing provision aims to force the gatekeepers to share data that hold a business value, so that the business users can be better equipped for competition. According to Article 6(10) of the DMA, gatekeepers are obliged to grant

<footnote n="2">² According to Article 2(1) of the DMA and Recital 3 of the DMA indicates that gatekeepers are the biggest provider of online goods and services providing core platform services have emerged with considerable economic power that could qualify them. Similarly, some of those undertakings exercise control over whole platform ecosystems in the digital economy and are structurally extremely difficult to challenge or contest by existing, or new market operators, irrespective of how innovative and efficient those market operators may be.</footnote>

<footnote n="3">³ Core platform services include a variety of services or products that are offered by the gatekeepers, the most common ones being online intermediation services, online search engines, operating systems, web browsers and cloud computing services. A full list can be found in Article 2(2) of the DMA.</footnote>

<footnote n="4">⁴ ‘Business user’ means any natural or legal person acting in a commercial or professional capacity using core platform services for the purpose of or in the course of providing goods or services to end users, according to Article 2(21) of the DMA.</footnote>

<footnote n="5">⁵ Article 6(10) of the DMA creates an obligation on the side of the gatekeeper to provide business users access, free of charge, with effective, high-quality, continuous and real-time access to and use of aggregated and non-aggregated data, including personal data. With regard to personal data, the gatekeeper shall provide for such access to, and use of, personal data only where the data are directly connected with the use effectuated by the end users. This obligation is only triggered after the business users receive consent from the end users for such access.</footnote>
access to those datasets that feature business value for business users. When it comes to the sharing of the datasets that involve personal data, the gatekeepers can only provide data that “are directly connected with the use effectuated by the end users in respect of the products or services offered by the relevant business user through the relevant core platform service” and when the end users opt-in for such sharing by giving their consent.

In order to interpret this article, the multiple layers of data processing in the context of Article 6(10) of the DMA shall be defined. First, the transfer of the datasets constitutes data processing by itself. Since the article brings an obligation for the gatekeepers to share these datasets, this transfer shall be based on the legal obligation legal basis of Article 6 of the GDPR. Second, the processing of these datasets by the business users shall only be based on consent, according to the wording of Article 6(10) of the DMA. Article 6(10) does not make this distinction by itself; however, it is essential to separate multiple layers of data processing since it makes a meaningful difference with regard to the legal basis of different layers.

Although not binding for EU data protection enforcement authorities, ICO's interpretation in its Data Sharing Code of Conduct also follows a similar approach to the above-mentioned interpretation. It is mentioned, with regards to the legal bases for processing and therefore the transfer of personal data, that “there is no need for the controller to seek individuals' consent for the sharing if the law clearly specifies that the sharing can take place without consent” [16]. In a similar context, the EDPS has mentioned that the draft Data Governance Act would not constitute a legal ground for data sharing by itself under the GDPR [12]. However, the DMA and the DGA are different in their aims. The DGA does not oblige any data sharing, whereas the DMA brings obligations to share datasets. Therefore, since Article 6(10) of the DMA constitutes a legal obligation, the initial transfer of the personal datasets shall be based on the legal obligation legal basis of the GDPR.

The first layer of the data processing (transfer of the datasets) in Article 6(10) of the DMA will be analysed in the later stages regarding the responsibility sharing between the gatekeeper and the business user in terms of the security of the processing. For the sake of clarity, the reference to consent in Article 6(10) of the DMA will be only analysed with respect to the second layer of the processing, the processing of the end user data by the business user, after the initial transfer.

These two provisions indicate a legal policy choice by requiring the end user's consent within the sense of the GDPR. The subsection of Sect. 2 will focus on this policy choice and analyse whether and how these provisions may actually achieve their objectives.

## 2.1 The Choice of Consent to Keep Digital Markets Contested: Is It the Right Approach?

The GDPR states various legal bases for personal data processing under Article 6⁶. One should first note that tying the data accumulation, data cross-use prohibitions and

<footnote n="6">⁶ Legal bases for processing personal data in Article 6 of the GDPR are as follows; consent, performance of a contract, legal obligation, vital interests of a natural person, public interest and legitimate interest.</footnote>
data sharing obligations to the end user's consent may be problematic and inefficient in tackling the competition issue in digital markets.

Before the very dynamic nature of the internet gave birth to very big digital companies in the world, the competition law theory has built on the assumption that every powerful company would be contested by new entrants with high innovation capacities [23]. This phenomenon was called the “creative destruction” of the dominant firms. Such reasoning had some empirical support twenty years ago. In fact, the early years of the internet saw a vibrant, open economy where startups were common, no internet corporation seemed to hold sway for very long, and competition was fierce [15]. It is now the case that some firms got so big that they hold every corner of the business-making process, from innovation to customer reach, from holding the marketplaces to buying prominent but small firms (killer acquisitions) [15]. To put it into an example, we can use the example of DuckDuckGo. Although DuckDuckGo claims to be much more privacy friendly than Google, its market share remains around %1. Therefore, no matter how innovative and customer-friendly DuckDuckGo becomes, it can not beat the data-consuming algorithmic business model of Google.

The EU regulatory choice of relying on the individual's consent may seem to empower citizens by giving them ultimate control over their data. This policy choice is based on an idealistic scenario that individuals are capable and willing to customise their data policy choices. However, it mostly neglects informational asymmetry<fnref n="7" /> [10] and consent fatigue. Consent fatigue refers to the emotional state of mind of the data subjects when a high number of standard form requests, with are full of legal technicalities, are submitted to them [18]. In an age of consent boxes, bundling the hopes of improving digital market competition to weakened individuals might prove wrong.

The consent legal basis has been subject to discussions in the EU data protection literature as well. A main criticism of the central position of consent in data protection is based on the reliance on consent for processing activities that would otherwise constitute a violation of the GDPR (when based on other legal bases of the GDPR, such as legitimate interest) [24]. On top of that, in the context of digital markets, such consents are mostly reduced to a rubber-stamping process, where consent is obtained with a tick, and individuals give their consent to move on to the following web window [5].

The choice of consent as the legal basis within the scope of Article 5(2)(b) and Article 5(2)(c) of the DMA, which focuses on the possibility of accumulating or cross-using personal data by the gatekeepers from various services that it provides or the services that the third parties give on the gatekeeper platform, is highly problematic due to the power imbalances, on top of other reasons such as the consent fatigue. The power imbalance between the gatekeeper, which holds incredible importance in modern daily life, and the end user, whose utilisation of such services is nearly inevitable, prevents consent from being freely given.

Graef [14], who is criticising the consent legal policy choice in the DMA, suggests that the legal ground for the DMA obligations should go beyond the consent and rely

<footnote n="7">⁷ According to Recital 43 of the GDPR, when there is a clear imbalance (of power and therefore information) between the data subject and the controller, consent is unlikely to be legal (See also "Press release: Advocate General's Opinion C-252/21 | Meta Platforms and Others (General terms of use of a social network)" for a similar interpretation)).</footnote>
on stricter grounds such as Article 6(1)(b) GDPR, which states that the processing of personal data is lawful when it is “necessary for the performance of a contract”. Contractual necessity as a legal basis could protect the end users in two ways. Firstly, the combination or cross-use of the datasets would be only possible if it is indispensable for the performance of a contract, such as the provision of a service [14]. Secondly, the end user’s interest would be automatically protected by a necessity test required on this legal basis. In such a policy choice, the end user would not be dealing with an increasing number of consent boxes when browsing through the internet and acquiring services or goods from the gatekeeper. Contractual necessity is only of the legal bases provided in the GDPR and only mentioned here as an alternative to strict consent legal policy choice in the DMA.

Considering all the different possibilities of legal bases in the GDPR, we claim that consent within the scope of the DMA, due to the power imbalance, informational asymmetry and consent fatigue, would always be flawed in the relationship between the gatekeeper and the end-user. A possible end user consent creates the situation that combining or cross-using datasets that are not necessary for a performance of a contract would be legal in the context of the DMA. However, such processing would be illegal within the contractual necessity legal basis due to the result of the necessity test that has to be conducted.

However, in line with the concerns shared by academics and civil society [3] in relation to issues of consent, Article 5(2) of the DMA has been added to the final text of the DMA. This subparagraph of Article 5 regulates that “where the consent given (...) has been refused or withdrawn by the end user, the gatekeeper shall not repeat its request for consent for the same purpose more than once within a period of one year”. The time limit is linked to the frequency of the consent requests. Hence, this provision only addresses the issue of consent fatigue rather than focusing on the core issues such as power imbalance and informational asymmetry, by ignoring the theoretical validity conditions of the consent in the sense of the GDPR.

Article 5(2)(3) of the DMA openly states that the combination or cross-use of personal datasets by the gatekeeper can also be performed based on Article 6(1)(c), Article 6(1)(d), Article 6(1)(e) of the GDPR, respectively, the legal obligation, vital interest and the public interest legal bases. Nevertheless, the situations in that these legal bases would apply are very limited in number. Plus, such extra grounds were not foreseen for business users within the scope of Article 6(10) of the DMA. The reason for adding these additional legal bases only to Article 5(2)(3) can be that these are only intended to force gatekeepers to share information where it is deemed necessary by authorities. Since consent is openly referred to as the main gate for combining or cross-using personal datasets within the legislative text itself, we understand that the legal obligation clause can only be triggered when the Commission gives a related decision ordering such conduct to combine or cross-use datasets.

On top of all the issues linked to the notion of consent, business users are already in a disadvantaged position in the DMA. They have to receive consent in the gatekeepers' core platform service interface based on the DMA provisions. A privacy-sensitive end user will likely refuse such requests, although it would enable a more competitive digital market since the request for consent is asked at the gatekeeper platform.
As mentioned in the last paragraphs of Sect. 2, a similar methodology to Article 5(2)(3) of the DMA could have also been accepted for Article 6(10). If Article 6(10) would not refer only to the consent legal basis but would state that the business users can process the data based on any legal basis stated in the Article 6 of the GDPR, the aim of the DMA, which is to increase competition in the digital markets by sharing the power of gatekeepers with the business users would be achieved.

Alternatively, the DMA could avoid openly referring to the consent of the end-user (by stating that any legal basis in the GDPR would be possible) in both Articles 5 and 6 of the DMA, and it could focus more on the GDPR principles such as data minimisation and purpose limitation as well as security measures when it comes to data sharing under a different legal ground. Although data minimisation seems to be in conflict with the sharing of data among business users and gatekeepers, limiting the data points to be shared to an absolute minimum by a more clear legal framework on which data points shall be absolutely necessary to ensure more competition in the digital markets could help to achieve DMA's goals. A suggestion relating to this is made in the following sections and especially in Sect. 4 of this article.

Since the policy choice has been concluded by requiring consent for such activities, in order to fix the flaws of the DMA and ensure that the data protection law is not negatively affected in digital markets, extra scrutiny for GDPR principles in the interpretation and enforcement of the DMA is vital. The following section will address the effective interpretation of GDPR principles in the context of related articles.

## 3 Data Accumulation, Cross-Use and Data Sharing in the DMA: Detecting Risks by the GDPR Principles

The European legislators are aware of the risks of the DMA. That is why there are many references to the protection of personal data and full compliance with the GDPR (and other relevant regulations) in the DMA. Recital 12 openly acknowledges that the DMA “should also apply without prejudice to the rules resulting from other acts of Union (...) in particular Regulation (EU) 2016/6791 (GDPR)”. Recital 35 even claims that one of the reasons why the DMA was necessary was to “protect privacy”. Similarly, Recital 72 indicates that “the data protection and privacy interests of end users are relevant to any assessment of potential negative effects of the observed practice of gatekeepers”.

This section will address the risks arising mainly from the data sharing obligation (Article 6(10)) of the DMA, as well as noting the concerns about the data accumulation and cross-use prohibition, Article 5(2) of the DMA, in the light of the GDPR principles. Such an analysis will help the DMA to be interpreted in a way to achieve one of its aims, protect personal data and ensure that such obligations do not provide legal uncertainty that the subjects of the DMA can abuse. This is especially crucial in an age when business models of online giants tend to circumvent the laws through fluid commercial structures and liability models [22].
## 3.1 The Principle of “Purpose Limitation” in the Context of Article 5(2) and Article 6(10) of the DMA

According to Article 5(1)(b) of the GDPR, controllers must only use data for “specified, explicit, and legitimate purposes”. The purpose limitation principle remains one of the core principles of the GDPR for a strong and coherent data protection framework in the EU, according to Recital 7 of the GDPR [26]. Purpose limitation also has a crucial role in the context of the DMA since the DMA regulates commercial behaviour linking to online advertising, which relies on the multi-layered processing of personal data.

One of the most significant critiques of the DMA concerns Articles 5(2)(a) and 5(2)(2) of the DMA<fnref n="8" />. The wording of the second paragraph of Article 5(2) has been criticised by a group of well-known European scholars and EU ex-officials since the wording “suggests advertising is a single data processing purpose, whereas there are plenty of data processing activities behind displaying an ad” [3]. However, the text remained the same in the final version. In their response to the concerns, the EU Parliament members have stated that the GDPR already contains the provisions that consent must be presented for each individual processing purpose, and it is unnecessary to reiterate the reference to “each processing purpose” in the DMA [14].

Purpose limitation also plays a vital role in the data sharing between the gatekeeper and the business user. According to Article 6(10) of the DMA, the gatekeeper should share with the business users only the personal data that are directly connected to the end user's use of the products or services offered by the relevant business user when the end users give their consent.

One of the criticisms of this provision was that the gatekeeper would not be in a position to show that the data sharing would be compatible with the initial processing purposes since the business users may process personal data unrelated to the first processing purposes [8]. However, this criticism seems inaccurate. First of all, Article 6(10) requires business users to request consent for their processing activities, and such consent should be specific for the purposes of such processing. Therefore, the gatekeeper would not be responsible after the data subject consents to such sharing. Even if the gatekeeper might be in a position to worry about the effects of data sharing on its own compliance with the GDPR, weaponising data protection rules in order to deny access to business users is openly forbidden in Recital 60 of the DMA. Recital 60 forbids the gatekeepers from using “any contractual or other restrictions to prevent business users from accessing relevant data”.

On top of this, Article 6(4) of the GDPR openly acknowledges that new consent with new approvals on additional or different processing purposes overrules the compatibility assessment that should be conducted if the initial purpose for collecting and processing data is not in line with a new processing activity. Therefore, complying with the purpose limitation principle remains under the sole responsibility of the business user in

<footnote n="8">⁸ Article 5(2)(a) of the DMA: “The gatekeeper shall not do any of the following: (a) process, for the purpose of providing online advertising services, personal data of end users using services of third parties that make use of core platform services of the gatekeeper; (...).” Article 5(2)(2) of the DMA: “Where the consent given for the purposes of the first subparagraph has been refused or withdrawn by the end user, the gatekeeper shall not repeat its request for consent for the same purpose more than once within a period of one year.”.</footnote>
the context of Article 6(10) of the DMA. This point also has links to the responsibilities of gatekeepers and business users in terms of the specific obligated data transfers. Responsibility sharing between them is discussed under the “Security of the Processing” subsection of Sect. 3.

## 3.2 The Principle of “Data Minimisation” in the Context of Article 6(10) of the DMA

Article 5(1)(c) of the GDPR states that personal data must be adequate, relevant, and limited to what is necessary concerning the purposes for which it is processed. Data minimisation has great importance in the context of business users' access to the datasets that are generated on the gatekeeper platform. Article 6(10) obliges gatekeepers to share “personal data only where the data are directly connected with the use effectuated by the end users (...)$^{9}$. This wording implicitly refers to the data minimisation principle by limiting the shared data to those only directly connected with end users' use. However, how to define which data points would be directly connected with the use of the core platform service remains unclear.

The DMA covers core platform services from various sectors, from operating systems to online intermediation services, from cloud computing services to web browsers, according to Article 2(2) of the DMA. All these sectors have different dynamics with unique characteristics when it comes to the types of data points that are collected. Especially, defining what is directly connected with the use of the end user remains to be in the hand of the gatekeepers since they are the ones who will be implicitly deciding which data points to share by starting the process of data sharing. Considering that the DMA openly states that it will be without prejudice to the GDPR, it is highly likely that the gatekeepers would try to limit the shared data points to the minimum.

For instance, a navigation software application, which is a business user in the context of the DMA, that runs on an “operating system”<fnref n="9" /> of a gatekeeper, can request access to the location data of the end user using the service. If this service is granted in a commercial context such as Uber or similar platforms, the location data inherently links to the driver’s route as well [8]. The risks arising from such access, especially considering that the access is real-time, may also evolve into security risks. Sharing such data points reveals the activity of the driver, which can even bring the risk that the navigation apps can profile the drivers. Nevertheless, the DMA only allows the end user data to be shared with the business user. The gatekeepers may refuse to grant access to those datasets on the grounds of the impossibility of separating driver location data from passenger data.

Similar tensions arising from the obligated data sharing provision and the data protection standards may also occur in the context of other core platform services. Likely, the gatekeepers would also limit the shared data in the context of online intermediation services by blocking specific data points on the grounds of data minimisation. This might be the case primarily if the business user competes with the gatekeeper for that specific service.

<footnote n="9">⁹ Based on Article 2(10) of the DMA, an operating system means a system software that controls the basic functions of the hardware or software and enables software applications to run on it.</footnote>
For instance, the exact timing of a book sale, through which computer model and which browser may seem to be non-personal data. However, these data points can be important for the business users' marketing operations. Business users can also request access to those data points under Article 6(10). However, linking those data points in a large volume increases the risks of re-identification [20]. More information leads to indirect violation of the data minimisation principle. Mixed datasets that involve personal and non-personal data points, even where data is anonymised, are very unlikely to comply with the data minimisation principle of the GDPR since all combined can lead to new observed datasets [12]. The risks arise even more considering that the gatekeepers also process data relating to vulnerable individuals.

Another challenge to complying with the data minimisation principle is when a data point directly connected to the end user's use does not happen to have a meaningful business value for the business user. For example, the computer model used by the end user on which the transaction on the gatekeeper platform happens may not have any competitive advantage for the business user if the business user is selling a distinct product such as construction materials. However, the data point gets created with the direct use of the end user and therefore falls into the scope of Article 6(10). Under Article 6(10) of the DMA, such a data point must be shared with the business user. Therefore, the wording of the article contradicts the data minimisation principle of the GDPR.

The DMA, by nature, is a sector-specific law about competition, with secondary goals such as data protection and fairness in digital markets [19]. However, it differs from general competition law proceedings because the DMA does not integrate a case-by-case basis but incorporates general “per se” rules in digital markets [19]. This results in vagueness and legal uncertainty, the related data sharing provision in the DMA applies to an extensive range of business users from different sectors and to any kind of data directly connected to the end user’s use.

Such vagueness raises risks for weak and unclear enforcement of the DMA. Underenforcement or misapplication of the DMA also implies dangers for effective data protection. The possible ways to prevent it from happening will be discussed in Sect. 4.

## 3.3 The Principles of “Transparency, Accountability, Storage Limitation” and the Security of the Processing in the Context of Article 6(10) of the DMA

### Transparency

Individuals must be informed about the use and processing of their data when it is collected directly from them or when it is received from other sources, according to GDPR Article 5(1)(a) and Articles 13 and 14. The EDPB/EDPS emphasise in their opinion on the DGA that each receiver in the data processing chain must give people access to transparent information about their data processing activity [12]. This would also apply in the context of the DMA.

Gatekeepers would need to inform the end users about their processing activities, including data sharing with the business users [8]. However, the data points to be shared would differentiate based on the use of the end user and the type of commercial activity of the business user (depending on which sector the business user is active in and what are
data points to be shared in that regard). Therefore, it is likely that the information notice
relating to data transfers should also be given based during the specific data sharing.

Gatekeepers may not know which data points would be shared with the business
users since they would not know which goods or services the end user would acquire in
the first place. Similarly, the business users would also need to provide such information
to the end users. For business users, it would be easier to comply with the transparency
obligation since they would be in a position to know what data points they would be
getting.

## 3.4 Security of the Processing

According to Article 32 of the GDPR, organisations must take the proper organisational
and technical steps to provide a level of security, commensurate with the risk. The GDPR
acknowledges that organisations that are separately accountable for the protection and
security of the data must work together to ensure adequate data protection and security.
In the context of the DMA, the requirement to maintain an adequate level of security is
still completely applicable.

Within the context of Article 6(10) of the DMA, there are two aspects to consider regarding the security of the processing. The first one is to clearly define the nature of the relationship between the gatekeeper and the business user with regard to the transfer of the end user datasets. In order to define the relationship, the GDPR mechanisms relating to data controllership and joint controllership shall be analysed.

The second one is to focus on the business user's responsibilities with regard to the
accessed datasets. However, this is subject to a different research project in the future.

## The Responsibility Sharing Between the Gatekeeper and the Business User in the Context of Article 6(10) of the DMA

As stated in Sect. 2, Article 6(10) of the DMA incorporates multiple data processing lay-
ers. The first one is the obligated transfer of the end user datasets to the business user by
the gatekeeper. Without clearly splitting the responsibilities of gatekeepers and business
users in terms of this specific data sharing scheme, the gatekeepers may weaponise data
protection in order not to comply with the obligations and, therefore, indirectly leverage
their market power. Similarly, examples have shown the weaponisation of privacy stan-
dards as a tool to block access to certain services or products, which hinders competition
in a specific market [7]. It remains unclear to which scope the gatekeeper can claim that
data-sharing may end up violating their GDPR obligations since the business user can
not guarantee the safety of the personal data that are transferred to the business user [8].

Gatekeepers are surely classified as data controllers with regard to their relationship
with the end users. On the other hand, business users also operate independently from
the gatekeepers when defining the purposes and means of processing personal datasets in
terms of Article 6(10) of the DMA. Therefore, they would not be classified as data pro-
cessors according to Article 2(8) of the GDPR but rather as independent data controllers
[26]. Although the GDPR regulates the joint controllership in Article 26, the relationship
arising from Article 6(10) of the DMA may not constitute a joint controllership since
the gatekeeper does not have a say in how and why the business user would process
the end user data [11]. Following this speculative but not yet definitive interpretation,
the transfer of datasets between the gatekeepers and the business users would constitute controller-to-controller data sharing [8]. The EDPB has not yet defined the responsibility sharing attached to this relationship.

However, important lessons can be taken from the responsibility sharing based on the data portability right in the GDPR. The GDPR regulates the data portability right for the data subjects in Article 20. The DMA also brings out data portability right for the end users in Article 6(9). The difference between Article 6(9) and Article 6(10) of the DMA is that Article 6(10) is triggered through the request of the business user, whereas the right to data portability in Article 6(9) and Article 20 of the GDPR is triggered upon the request of the data subject or the end user in the context of the DMA. Therefore, the Article 29 Working Party (“Article 29 WP”) guidelines on the right to data portability can be handy in interpreting the responsibility sharing in the context of the DMA [2]. The guideline states that when data portability takes place, “the data controller is not responsible for compliance of the receiving data controller with data protection law, considering that it is not the sending data controller that chooses the recipient” [2]. Therefore, the gatekeeper’s responsibility should end when the dataset is transferred to the business user. Such an interpretation would prevent gatekeepers not to share data with the business user based on concerns over the safety of the transfer.

Such an interpretation relating to the nature of the relationship between the gatekeeper and the business user would also be in line with the comments in Sect. 2, relating to the legal obligation and legal basis of the transfer, in the context of Article 6(10) of the DMA. Since the duty to share datasets is regulated as an obligation, the gatekeepers shall not have a say about the capacity of the business users in terms of the safety of the personal datasets that are shared with them. However, it shall be noted that business users are also subject to the GDPR as independent data controllers.

Relevant research suggestions in this regard include that the DMA guidelines shall include the appropriate security measures and obligations both for the gatekeeper and the business user in respect to the data sharing if needed, comprehensive and transparent security due diligence before the share of the data or clear guidelines for data sharing agreements within the scope of the DMA [8]. These will be analysed in Sect. 4.

## 4 The Way Forward

The European Data Strategy, published by the European Commission, aims to make the EU a leader in the data-driven society [25]. However, such an ambitious project holds risks for privacy and data protection rules. The Commission acknowledges such risks. The single market for the data will be built upon full compliance with the privacy and data protection rules [25]. The DMA, on the other hand, as explained above, despite its narrow focus on gatekeepers, will have a crucial place for the data protection standards in the EU since the gatekeepers are the most extensive data holders in the digital markets.

Section 2 has criticised the policy of consent both within the context of Article 5(2) and Article 6(10) of the DMA. However, this section will concentrate on making the best out of the final DMA text by suggesting the following steps to be taken.

Within the context of Article 5(2) of the DMA, the data accumulation and cross-use prohibitions, it will be imperative to closely monitor the quality of the consent by the end
users. As stated, the consent legal basis has been heavily criticised regarding its inherited problems in the digital markets context. Therefore, we suggest that the Commission builds a team that will only focus on the consent requests arising from the DMA. Such a team may closely monitor the consent requests' quality, validity, transparency, fairness and clarity. This team would also follow up on the duties of the gatekeepers when the consent request is rejected, whether they would be providing the same quality of service to end users reject to grant consent within the meaning of Article 5(2) of the DMA, or whether the gatekeepers still accumulate or cross use datasets no matter the consent is positive or negative. Such dedication of the sources would be justified both by the inherited issues relating to consent and the unique dynamics of digital markets, which hurts the quality of consent even more than the traditional markets<fnref n="10" />.

This would already be in line with the Commission's approach to the enforcement of the DMA. The commissioner for the internal market, Thierry Breton, has stated that the DMA will be enforced mainly by the DG CONNECT, a non-competition DG within the European Commission [28]. We welcome this approach by the Commission since the DMA is not a pure competition law but also focuses on important aspects of data-related business conduct, including personal datasets. The commissioner has also stated that the dedicated teams within the DG CONNECT will be organised around thematic domains, such as societal aspects, technical aspects and economic aspects [28]. One of the societal teams can be assigned to monitor and analyse the quality of the consent.

On the other hand, the DMA brings new “per se” rules for a wide variety of sectors, as explained in Sect. 3. This is particularly important with regard to the data sharing between the gatekeepers and the business users, Article 6(10) of the DMA. Consequently, these sectors have different realities regarding what constitutes data that will boost the competition by providing access to business users. It is crucial for the DMA to work to define which data points are relevant for which sectors clearly. Section 3 has explained the risks arising from the absence of a sector-specific approach in relation to the GDPR principles. Legal instruments to provide clarity in terms of the classification of datasets in different sectors, which amounts to possessing business value (so that the data minimisation principle is respected) are various.

The most prominent way to build a legal framework with respect to data sharing between businesses is the data sharing agreements. A broad typology of agreements and papers between two or more organisations or various divisions of an organisation are frequently referred to as “data sharing agreements” in the literature. The European Commission recently determined that it was unsuitable to take horizontal legislative action with regard to private sector data sharing after engaging in extensive stakeholder consultation and dialogue. However, civil society has discussed using the data sharing agreements within the context of the DMA [8].

Within the context of the DMA, data sharing agreements are highly flawed. This is caused due to information asymmetry and asymmetrical contractual dependency between the gatekeepers and the business users [21]. In digital markets, contracts are rarely negotiated, and standard contractual clauses are applied and dictated by the big players [21]. Consequently, data sharing agreements between the gatekeepers, and

<footnote n="10">¹⁰ Please see Sect. 2, “The Choice of Consent to Keep Digital Markets Contested” for the reasons why digital markets are particularly risky for consent requests.</footnote>
remarkably smaller companies, such as business users, end up being a largely unilateral contractual regime rather than being fair tools arising from legal negotiations [21]. The European Commission has taken a similar approach in its call for application relating to the business-to-business data sharing contracts expert group<fnref n="11" />. The expert group is entitled to develop a set of contractual clauses on model data sharing agreements in order to help the SMEs. However, it is stated in the call that the expert group will not deliver model contractual terms within the context of the DMA.

Similar thinking can be applied to any kind of legal instrument that will be subject to so-called negotiations between the gatekeepers and the business users. Therefore, to provide full efficiency and protect the interests of the business users, the European regulators should take charge by providing sector-specific guidelines in the context of data sharing obligations in the DMA.

Article 47 of the DMA grants the Commission authority to adopt guidelines on any aspects of the DMA to facilitate its effective enforcement. The Commission, therefore, shall issue guidelines based on a sector-specific (and/or core platform specific) guidelines, with the goals of;

- Defining which data points hold a business value for the specific core platform service so that only the necessary data points are transferred to the business user (data minimisation principle within the context of Article 6(10) of the DMA),

- Defining the obligations of the gatekeepers and the business users with regard to the transparency principle of the GDPR by providing guidelines on the limits of the gatekeeper's duties for informing the end users about possible data sharing in the future.

The Commission should also provide guidance on the non-sector-specific matters, with the goals of;

- Defining the responsibility sharing between the gatekeepers and the business users in terms of security of the data transfers, if appropriate, acknowledging the same thinking of the responsibility sharing relating to the GDPR data portability right guidelines,

- Making sure also that the business users have the capacity to keep the shared datasets secure and in line with the GDPR principles, such as the storage limitation principle of the GDPR.

The DMA, in Article 40, establishes a high-level group for the DMA. This high-level group includes both the EDPS and the EDPB. Therefore, such sector-specific guidelines can be developed in a hybrid way, both incorporating data protection principles and securing the aims of the DMA.

# 5 Conclusion

The rise of the internet and giant technology companies in the last decades has led to the saga relating to the interplay of the competition law and the data protection law.

<footnote n="11">¹¹ Please see the “Call for applications / Sub-group - stakeholders to Expert Group on B2B data sharing and cloud computing contracts” call of the European Commission.</footnote>
Although several cooperation forums have been established, little has improved in the last years, both with respect to the competition and the data protection standards in the digital markets. That is why the DMA came with a novel approach, accepting general “per se” rules on top of the traditional competition law toolbox. Such a general approach will aim to fix the inherited and established problems of the digital markets.

As stated in the introduction, this article has aimed firstly to analyse the outcomes of the choice of consent as a legal policy in the context of data accumulation, data cross-use prohibitions (for gatekeepers) and data sharing scheme between the gatekeepers and the business users. Secondly, it has focused on detecting the risks arising from the vagueness of the beforementioned articles in relation to the GDPR principles.

The consent legal basis has been chosen to keep the digital markets contested, especially in relation to Article 5(2) and Article 6(10) of the DMA. Therefore Sect. 2 has mainly focused on the results of such a legal policy choice, explaining the inherited problems of the consent legal basis in the GDPR, and connecting it to the specific dynamics of the digital markets, such as informational asymmetry and power imbalances. Relating to this, Sect. 4 has advocated for a specialised consent task force to be created to provide maximum efficiency and coherence in the context of the DMA.

Since consent legal basis is likely to bring new issues, Sect. 3 has addressed the issues arising from the data sharing obligations between the gatekeepers and the business users, Article 6(10) of the DMA, in their relation to the GDPR principles. However, the DMA’s general “per se” approach does not fit with the sector-specific nature of core platform services. In order to provide maximum efficiency and to protect the interests of the business users and the end users, a sector-specific approach to the enforcement of Article 6(10) shall be applied. Section 4, consequently, has advocated for sector-specific and/or core platform specific guidelines in the context of Article 6(10) of the DMA.

Although the DMA has the potential to ensure a fairer, more robust and open digital market within the EU, there are two very important challenges to focus upon: The legality of consent by end users shall be closely monitored by a specific team and the Commission shall provide sector-specific and/or core platform specific guidelines for data sharing between business users and gatekeepers in order to provide more certainty for business users to compete with the gatekeepers.

## References

1. Akman, P.: Regulating Competition in Digital Platform Markets: A Critical Assessment of the Framework and Approach of the EU DMA, pp. 2–18 (2021). https://papers.ssrn.com/abstract=3978625. https://doi.org/10.2139/ssrn.3978625

2. Article 29 Data Protection Working Party: Guidelines on the right to data portability, p. 6 (2016)

3. Bertuzzi, L.: DMA: EU legislators resist pressure to change data provisions in the final text (2022). https://www.euractiv.com/section/digital/news/dma-eu-legislators-resist-pressure-to-change-data-provisions-in-the-final-text/

4. Brokaw, L.: How to Win With a Multisided Platform Business Model. https://sloanreview.mit.edu/article/how-to-win-with-a-multisided-platform-business-model/. Accessed 08 Aug 2022

5. Brownsword, R.: The cult of consent: fixation and fallacy. King’s Law J. 15(2), 223–251 (2004). https://doi.org/10.1080/09615768.2004.11427572
6. Buttarelli, G.: Youth and Leaders Summit - Opening Speech (2019). https://edps.europa.eu/sites/edp/files/publication/19-01-21_speech_youth_and_leaders_en.pdf

7. Chee, F.Y.: EU's Vestager warns Apple against using privacy, security to limit competition (2021). https://www.reuters.com/technology/exclusive-eus-vestager-warns-apple-aga-inst-using-privacy-security-limit-2021-07-02/

8. CPIL: Bridging the DMA and the GDPR - Comments by the Centre for Information Policy Leadership on the Data Protection Implications of the Draft DMA, pp. 7–19. Centre for Information Policy Leadership (2021)

9. Decraene, D.: “Data Colonialism” and the ubiquitous appropriation of human life. https://www.law.kuleuven.be/citip/blog/data-colonialism-and-the-ubiquitous-appropriation-of-human-life/. Accessed 05 Aug 2022

10. Directorate for Competition Committee: Consumer Data Rights and Competition - Background note, p. 23. OECD (2020)

11. EDPB: Guidelines 07/2020 on the concepts of controller and processor in the GDPR Version 1.0, p. 48 (2020)

12. EDPB-EDPS: EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Version 1.1. EDPS, pp. 47–49 (2021)

13. European Parliament. Directorate General for Parliamentary Research Services.: Fundamental rights in the European Union: the role of the Charter after the Lisbon Treaty: in depth analysis, p. 24. Publications Office, LU (2015)

14. Graef, I.: Why End-User Consent Cannot Keep Markets Contestable. https://verfassungsblog.de/power-dsa-dma-08/. Accessed 30 July 2022

15. Höppner, T.: From Creative Destruction to Destruction of the Creatives: Innovation in Walled-Off Ecosystems, pp. 9–15. SSRN Journal (2022). https://doi.org/10.2139/ssrn.4145216

16. ICO: Data sharing: a code of practice: Lawfulness. https://ico.org.uk/for-organisations/guide-to-data-protection/ico-codes-of-practice/data-sharing-a-code-of-practice/lawfulness/. Accessed 30 July 2022

17. Javeed, U.: Data and Competition Law: Introducing Data As Non-Monetary Consideration and Competition Concerns in Data-Driven Online Platforms (2021). https://papers.ssrn.com/abstract=3788178. https://doi.org/10.2139/ssrn.3788178

18. Matthan, R.: Beyond Consent: A New Paradigm for Data Protection, p. 3 (2017). https://taksha.shila.org.in/research/discussion-document-beyond-consent-new-paradigm-data-protection

19. Petit, N.: The Proposed DMA (DMA): A Legal and Policy Review, p. 2 (2021). https://papers.ssrn.com/abstract=3843497. https://doi.org/10.2139/ssrn.3843497

20. Rocher, L., et al.: Estimating the success of re-identifications in incomplete datasets using generative models. Nat. Commun. **10**(1), 3069 (2019). https://doi.org/10.1038/s41467-019-10933-3

21. Rutgers, J., Sauter, W.: Fair private governance for the platform economy: EU competition and contract law applied to standard terms, pp. 1–3 (2021)

22. Schrepel, T.: What to make of “business models eat law”. https://www.networklawreview.org/business-models-eat-law/. Accessed 28 July 2022

23. Schumpeter, J.A., Swedberg, R.: Capitalism, socialism, and democracy, pp. 84–87. Routledge, London; New York (2014)

24. Zanfir-Fortuna, G.: Forgetting About Consent: Why the Focus Should Be on “Suitable Safeguards” in Data Protection Law, p. 9 (2013). https://papers.ssrn.com/abstract=2261973. https://doi.org/10.2139/ssrn.2261973

25. European Data Strategy. https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/european-data-strategy_en. Accessed 10 Aug 2022
26. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2016)

27. Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (DMA) (Text with EEA relevance) (2022)

28. Sneak peek: how the Commission will enforce the DSA & DMA. https://ec.europa.eu/commission/presscorner/detail/en/STATEMENT_22_4327. Accessed 10 Aug 2022