The Digital Markets Act and GDPR – Considerations for ‘gatekeepers’

After its initial proposal in December 2020, the landmark European Digital Markets Act (DMA) has entered into force on the 1st of November 2022. This new regulation is striving for a fair and competitive digital economy and establishing a level playing field for businesses operating online. To help foster competition, the DMA relies on ‘interoperability’. This is an important tool in promoting competition and to prevent monopolies shutting down, or stifling user-empowered growth and innovation. The DMA will require gatekeepers to allow other services to ‘interoperate’ with their services, prevent them from treating their own service with favourability, and require them to allow their users to uninstall any pre-installed apps or software.   

In this blog, we will focus on what the purpose of this new regulation is, how it will have an impact on EU GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation). and EU data rights, and what steps should be taken to manage tensions between the DMA and the EU GDPR. As this legislation only affects data subjects who are resident within the European Union, ‘GDPR’ refers only to EU GDPR.  

What is the DMA? 

The Digital Markets Act is the regulation that sets rules for a narrowly defined large online platform called the gatekeepers. Its main objective is to solve the traditional anti-trust problems in the digital sector by defining a large online platform that provides an important gateway between business users (BUs) and consumers as a digital gatekeeper.  

The digital gatekeeper is the core online platform that will offer services between consumers and organisations, it will have most likely become indispensable to thousands of organisations and millions of consumers. 

Gatekeeper status

The core platform providers can be online intermediation services, search engines, video-sharing platforms, web browsers, operating systems, online advertising services and digital assistants.

The 3-part test to qualify as a gatekeeper includes: 

1. Has a significant impact on the internal market e.g. it provides the same core platform service in at least three Member States and
   • annual turnover of above €7.5 billion in each of the last three financial years or
   • average market capitalisation or its equivalent fair market value amounted to at least €75 billion in the last financial year
2. Engaging with a large number of businesses and user base e.g. 45 million monthly active end users and 10,000 annual active business users in the EU
3. Having an entrenched and durable position e.g. met the criteria in point 2 for at least the past 3 years

The Commission then designates the organisation as a gatekeeper, unless the organisation provides compelling evidence to the contrary. The Gatekeeper must comply with the requirements within 6 months of being awarded gatekeeper status and it will be re-evaluated every 3 years.

Gatekeeper requirements

If any digital platform qualifies as a gatekeeper under the above criteria, they will be required to: 

• Ensure interoperability with certain functionalities (especially for messaging/ communication services) to third party. 
• Allow their BUs and users to have real-time access to the data that they generate in their use of the gatekeeper’s platform (data portability). 
• Provide third party search engines with access to fair, reasonable, and non-discrimination (FREAND) terms and ensure the protection of the personal dataInformation which relates to an identified or identifiable natural person. of end users, allowing the small competitors to train their algorithms in order to provide better results to the users and become a more reliable competitor for the gatekeepers. 
• Submit an independently audited description of the techniques for profiling consumers to the European CommissionOne of the core institutions of the European Union, responsible for lawmaking, policymaking and monitoring compliance with EU law. and the Commission shall transmit it to the European Data Protection Board (EDPB) informing the enforcement of data protection rules. 

Digital gatekeepers should keep in mind that they should not: 

• Treat services and products offered by themselves more favourably when ranking similar services or products offered by third parties on the gatekeepers’ platform (i.e. Google should not push its own apps above others). 
• Prevent consumers from linking to businesses outside their platforms. 
• Prevent users from uninstalling any pre-installed software or appAn application, downloaded by a user to a mobile or other device. if they wish to (i.e. Google cannot stop you from linking your Gmail account to a non-Google service).
• Track end users outside of the gatekeepers’ core platform service for targeted advertising, without the effective consentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed. of such users. 

In case of non-compliance, the gatekeepers will be imposed fines of up to 10% of its total global annual turnover or 20% in the event of a repeated infringement. Periodically, the gatekeeper may be entitled to fines up to 5% of the average daily global turnover in case of non-compliance with prior recommendations.

The DMA impact on the GDPR

Before going through the DMA’s impacts on the GDPR, the first thing to bear in mind is that both instruments have a philosophical difference in approach. For the GDPR, its purpose is to limit the data flows and empower the data subjectAn individual who can be identified or is identifiable from data. and, in some cases, this means preventing data sharing.  

On the other hand, the purpose of the DMA is to encourage data sharing, to bypass traditional anti-trust enforcement, and to create upfront obligations to gatekeepers in order to level the playing field for small companies in the digital world. Meaning the DMA has a more economic and anti-monopolistic stance when compared to the GDPR, which takes an economically natural standing – treating all businesses the same. Thus, they have different purposes and different legal bases.

Similarities between the DMA and the GDPR 

Though the DMA and the GDPR have different legal bases, there are similarities between both. In some situations, the DMA follows and refers to the rules set out in the GDPR. For example, the DMA refers to the definition of ‘consent’ and ‘profiling’ that are laid out in the GDPR and complements Article 4 of the GDPR. The DMA solves the problem regarding the lack of transparency in profiling practices by letting the gatekeepers submit an independently audited description of the techniques for profiling of their consumers.

Possible tensions between the DMA and the GDPR 

Despite the similarities between the DMA and the GDPR, there are some unclear areas which may create tensions between the two pieces of legislation. The main three are:  

• Data portability (Article 6 (9)(10) of the DMA). Although this article complements the right to data portability under Article 20 of the GDPR as it further applies to BU data generated, not just data concerning, and ensures continuous and real-time access to data. This provision is raising concerns of where the DMA provision on portability complements, what it covers, and whether is it the same as the GDPR. 
• According to Article 6(11), the gatekeeper shall ensure the protection of the personal data of end users by appropriate means such as the anonymisation of such personal data. This provision left us with the unanswered question of who will decide on the definition of anonymisation. 
• The DMA only set a cooperation obligation on the European Commission with the national authorities (Article 37), but there is currently no explicit statement requiring cooperation with the EDPB. This can be considered a missed opportunity to have an interlinking provision between both instruments, the DMA and the GDPR, leading to risk inconsistency in practice. 

What steps should be taken to manage tensions between the DMA and the GDPR? 

To ensure the cooperation between both instruments, further examples and guidance on how best to involve the data protection authorities and the EDPB in the formal decision-making procedureAn approved and established way of completing a certain task. from the European Commission and vice versa is required.

Though there is indeed a need for some coordination and clarification, there’s no contradiction between the DMA and the GDPR. Still, other tensions remain unsolved and all we can do is wait and see.  

If your organisation will be impacted by the new regulation and require advice and support with complying with both EU and/or UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU., please fill out the form below.