Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Digital Markets Act

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)l

(2021/C 147/04)

On 15 December 2020, the Commission published a Proposal for a Regulation of the European Parliament and of the Council on contestable and fair markets in the digital sector (Digital Markets Act). The Proposal follows the Communication Shaping Europe’s Digital Future, which indicated that additional rules may be needed to ensure contestability, fairness and innovation and the possibility of market entry, as well as public interests that go beyond competition or economic considerations. The Proposal establishes ex ante rules to ensure that markets characterised by large platforms with significant network effects (‘gatekeepers’), remain fair and contestable.

In doing so, the Proposal sets out provisions concerning the designation of gatekeepers which takes into account the data driven advantage related among others to the provider’s access to and collection of personal data; obligations and prohibitions to which the gatekeepers are subject; rules for carrying out market investigations; provisions concerning the implementation and enforcement of the Proposal.

In this Opinion the EDPS welcomes the Proposal, as it seeks to promote fair and open markets and the fair processing of personal data. Already in 2014, the EDPS pointed out how competition, consumer protection and data protection law are three inextricably linked policy areas in the context of the online platform economy. The EDPS considers that the relationship between these three areas should be a relationship of complementarity, not a relationship where one area replaces or enters into friction with another.

The EDPS highlights in this Opinion those provisions of the Proposal which produce the effect of mutually reinforcing contestability of the market and ultimately also control by the person concerned on her or his personal data. This is the case for instance of Article 5(f), prohibiting the mandatory subscription by the end-users to other core platforms services offered by the gatekeeper; Article 6(1)(b), allowing the end-user to un-install pre-installed software applications on the core platform service; Article 6(1)(e), prohibiting the gatekeeper from restricting the ability of end-users to switch between different software applications and services; and Article 13, laying down the obligation for the gatekeeper to submit to the Commission an independently audited description of any techniques for profiling of consumers that the gatekeeper applies to or across its core platform services.

At the same time, the EDPS provides specific recommendations to help ensure that the Proposal complements the GDPR effectively, increasing protection for the fundamental rights and freedoms of the persons concerned, and avoiding frictions with current data protection rules. In this regard, the EDPS recommends in particular specifying in Article 5(a) of the Proposal that the gatekeeper shall provide end-users with a solution of easy and prompt accessibility for consent management; clarifying the scope of the data portability envisaged in Article 6(1)(h) of the Proposal; and rewording Article 6(1)(i) of the Proposal to ensure full consistency with the GDPR; and raising the attention on the need for effective anonymisation and re-identification tests when sharing query, click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper.

Moreover, the EDPS invites the co-legislators to consider introducing minimum interoperability requirements for gatekeepers and to promote the development of technical standards at European level, in accordance with the applicable Union legislation on European standardisation.

Finally, building among others on the experience of the Digital Clearinghouse, the EDPS recommends specifying under Article 32(1) that the Digital Markets Advisory Committee shall include representatives of the EDPB, and calls, more broadly, for an institutionalised and structured cooperation between the relevant competent oversight authorities, including data protection authorities. This cooperation should ensure in particular that all relevant information can be exchanged with the relevant authorities so they can fulfil their complementary role, while acting in accordance with their respective institutional mandates.

1. INTRODUCTION AND BACKGROUND

1. On 15 December 2020, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council on contestable and fair markets in the digital sector (Digital Markets Act) (hereafter, ‘the Proposal’) ( 1 )

2. Shaping Europe’s Digital Future , which indicated that additional rules may be needed to ensure contestability, fairness and innovation and the possibility of market entry, as well as public interests that go beyond competition or economic considerations. The Communication also announced that the Commission would explore ex ante rules to ensure that markets characterised by large platforms with significant network effects acting as gatekeepers, remain fair and contestable for innovators, businesses, and new market entrants. The Proposal follows the Communication, which indicated that additional rules may be needed to ensure contestability, fairness and innovation and the possibility of market entry, as well as public interests that go beyond competition or economic considerations. The Communication also announced that the Commission would explorerules to ensure that markets characterised by large platforms with significant network effects acting as gatekeepers, remain fair and contestable for innovators, businesses, and new market entrants. ( 2 )

3. vis-à-vis these business users According to the Explanatory Memorandum to the Proposal, a few large platforms in the digital sector increasingly act as gateways or ‘gatekeepers’ between business users and end users. Such gatekeepers are said to be entrenched in digital markets, leading to significant dependencies of many business users and negative effects on the contestability of the core platform services concerned. In certain cases, the dependencies lead to unfair behaviourthese business users ( 3 )

4. The objective of the Proposal is to address at EU level the most salient incidences of unfair practices and weak contestability in relation to so-called ‘core platform services’. ( 4 ) To this end, the Proposal: — establishes the conditions under which providers of core platform services should be designated as ‘gatekeepers’ (Chapter II); — sets out the practices of gatekeepers that limit contestability and that are unfair, laying down obligations that the designated gatekeepers should comply with, some of which are susceptible to further specification (Chapter III); — provides rules for carrying out market investigations (Chapter IV); and — contains provisions concerning the implementation and enforcement of this Regulation (Chapter V).

5. The EDPS was consulted informally on the draft Proposal for a Digital Markets Act on 8 December 2020. The EDPS welcomes the fact that he has been consulted at this early stage of the procedure.

6. In addition to the Proposal, the Commission has also adopted a Proposal for a Regulation of the European Parliament and of the Council on Single Market for Digital Services (Digital Services Act) and amending Directive 2000/31/EC. In accordance with Article 42(1) of Regulation 2018/1725, the EDPS has also been consulted on the Proposal for a Digital Services Act, which is the subject matter of a separate Opinion.

2. CONCLUSIONS

In light of the above, the EDPS makes the following recommendations:

— to specify that the Proposal complements both Regulation 2016/679 and Directive 2002/58/EC, and that the Proposal does not particularise or replace any of the obligations of core platform services under Regulation 2016/679 and Directive 2002/58/EC;

— to specify in Article 5(a) of the Proposal that the gatekeeper shall provide end-users with a user-friendly solution (of easy and prompt accessibility) for consent management in line with Regulation 2016/679, and, in particular, the requirement of privacy by design and privacy by default laid down in Article 25 of Regulation 2016/679;

— to add a reference to end-users under Article 5(f) of the Proposal;

— to clarify the scope of the data portability envisaged in Article 6(1)(h) of the Proposal;

— to reword Article 6(1)(i) of the Proposal to ensure consistency with the GDPR, taking into account in particular the definition of ‘personal data’ under Article 4(1) of the GDPR;

— to strengthen the reference in Article 6(1)(j) of the Proposal specifying in a recital that the gatekeeper shall be able to demonstrate that the anonymised query, click and view data have been adequately tested against possible reidentification risks;

— to add reference to end-users in Article 10(2)(a) of the Proposal;

— to reword Article 11(2) of the Proposal by replacing ‘or’ with ‘and’;

— to specify that the audited description shall be shared by the Commission with the EDPB or at least the competent supervisory authorities under the GDPR at their request;

— to specify under Article 32(1) that the Digital Markets Advisory Committee shall consist of representatives of the European Data Protection Board, as well as of representatives of the competent authorities of the Member States for competition, electronic communications, audio-visual services, electoral oversight, and consumer protection;

— to consider introducing minimum interoperability requirements for gatekeepers and to promote the development of technical standards at the European level, in accordance with the applicable Union legislation on European standardisation;

— to establish an institutionalised and structured cooperation between the relevant competent oversight authorities, including data protection authorities. This cooperation should ensure in particular that all relevant information can be exchanged with the relevant authorities so they can fulfil their complementary role, while acting in accordance with their respective institutional mandate.

Brussels, 10 February 2021. Wojciech WIEWIÓROWSKI

(1) COM(2020) 842 final.

(2) COM(2020) 67 final.

(3) COM(2020) 842 final p. 1.

(4) COM(2020) 842 final p. 2.