Thread by @gabrielazanfir

Now that we have the text of the #DMA published, let me point out a couple of outstanding provisions that have data protection implications & that show why this Regulation concerns all businesses & platform users, not only gatekeepers. Let's go 🧵 1/?
consilium.europa.eu/media/56086/st…

First of all, check out the list of Core Platform Services that may pull a business into the gatekeeper class (Art 2). Notably including web browsers, virtual assistants, & *online advertising services*, e.g. Exchanges, as long as they are provided by a business offering a CPS 2/

But this is not a thread about the threshold to become a gatekeeper (check Art 3). It just points out data protection implications of the #DMA. Of note, "consent", "profiling" in the #DMA are defined as in the #GDPR. Bonus: "non-personal" data & "data" are also defined 3/

This means that whenever the enforcer of the DMA (i.e. the European Commission) will enforce the DMA & these concepts play a role, it will need to interpret and apply definitions from the #GDPR. DPAs only have a loose consultative role, maybe. Spells trouble 4/

The rules on consent for processing personal data actually play a very big role, since the first key obligation gatekeepers have is to NOT combine personal data across their different services if they do not first obtain valid *GDPR* consent (Art 5(1)). Let's untangle this: 5/

Technically, gatekeepers will be forced to obtain GDPR consent if they wish to:
1) process, *for the purpose of providing online advertising services*, personal data of their end-users using *services of 3rd parties* that make use of core platform services of the gatekeeper; 6/

2) combine personal data across all of their services, CPS or not, or *with personal data from third-party services*;
This one is quite big & it is also not limited by specific purposes. Regardless of the purposes for which this combination occurs, it can only occur on consent 7/

3) "cross-use" personal data from the relevant core platform service in other services provided separately by the gatekeeper, including other core platform services, and vice-versa;
This one goes beyond "combining". Could cross-use mean "inform"? "be added to?" Maybe 8/

4) sign in end users to other services of the gatekeeper *in order to combine personal data*.
So all of these 4 things can only happen if #GDPR consent is obtained - withdrawable, freely given, informed, specific!
See how COM & DPA competences overlap? 9/

Interestingly, there is also an obligation that when this consent "has been refused or withdrawn by the end user, the gatekeeper *shall not repeat its request for consent for the same purpose more than once within a period of one year*" 🤯 Quite a big one. 10/

Also interestingly, the provision adds that when the gatekeepers can rely on a legal obligation, vital interest of the data subject and processing data for the performance of task in the public interest, they can do so (Arts 6(1)(c),(d),(e)) GDPR. So in almost no situation 11/

Recital 36 specifically clarifies that GDPR Contract and Legitimate Interests cannot justify the combination of personal data.
Another big one, and relevant for the debate on what lawful ground to use for some processing of personal data by social media platforms 12/

Why does the #DMA include these rules? Because "the processing for the purpose of providing online advertising services of personal data from 3rd parties using CPS gives gatekeepers potential advantages in terms of accumulation of data, thereby raising barriers to entry"(R36)13/

And because "Gatekeepers process personal data from a significantly larger number of third parties than other undertakings" (R36 too).
The #DMA also tries to solve the "take it by giving all data or leave it" approach to using core platform services, per R36: 14/

See that detail here, technically requesting that gatekeepers give access to their services even if end users don't consent to the combination and cross-use of their personal data across services and from 3rd parties: 15/

But as with all EU law, there is an oddity following in the next Recital, 37, which says that access to the same level quality of service can be denied if the degradation of quality is a direct consequence of not being able to combine or cross-use personal data 🤔 🤷‍♀️ 16/

There is an anti-#darkpatterns Article as well, saying that all these obligations cannot be circumvented by offering choices in a non-neutral manner, or by subverting users' autonomy, decision-making via the structure, design, function of a user interface or a part thereof 17/

Other obligations that gatekeepers have and that will have immediate intersection & overlap with data protection law are two of the obligations in Article 6 on *data portability* and *real time access to personal data for business users*. Why? Here: 18/

Article 6(9) is truly outstanding for the #DataPortability aficionados and close followers of the #GDPR:
Gatekeepers are under an obligation to provide this super broad portability of "data provided by the end user or generated through the activity of the end user" 19/

You'll observe, I hope, how this portability is not framed as a "right" like in the GDPR, but as a matter of technical fact.
Also that it clearly covers data generated (inferred from?) the activity of the end users on the Core Platform Service, no negotiation here. 20/

This portability can also be exercised through "third parties authorised by an end user" - if you were wondering why the #DGA Data Governance Act went on and on about intermediation services. It all makes sense now 😅👀 21/

The other Article 6 stunner re: data protection overlap is Art 6(10). No kidding: it obliges gatekeepers to give access in real time (!) to *aggregated and non-aggregated data, including personal data, that is provided for or generated in the context of the CPS* 🤯 22/

This includes access for business users to the personal data generated by end-users (e.g. you and me) when engaging with a business user on a gatekeeper's platform providing a Core Platform Service, "when the end user opts in to such sharing by giving their consent". /23

This, again, means GDPR consent. So, again, the enforced of the #DMA will interpret and apply what #GDPR consent means in this context, a competence that the lead DPA of a gatekeeper would also have. Enforcement battles in sight! /24

I have a couple more things to get off my chest after reading the whole text, but I need to stop for now. I hope to add another thread later, at least on the full centralization of enforcement of the DMA under the EU COM. Thanks for joining my complete geek out. 24/24