RT @[email protected]

Breaking: In decisions just out, Meta is not only on the hook for privacy fines totaling nearly €400 million, but it must also — quickly — find a new legal basis for its sprawling targeted advertising empire. 🧵

https://pro.politico.eu/news/158293

🐦🔗: https://twitter.com/vmanancourt/status/1610652904188174338

POLITICO Pro

Can smart EU lawyers with data protection chops help me understand the basic legal proposition of this case?
I get the Art 6 bases for processing, and how Meta’s latest maneuvers (moving from consent to contractual basis) were legally sketchy and made EDPB mad. 1/
But I don’t get at a more fundamental level why “take it or leave it” is not an option. I’m probably out of practice.
2/
Why can EDPB say “Meta, you have to offer this service on different and less profitable terms than you do now”? Why was consent not an OK basis, with FB saying “this version, where you consent to targeted ads, is the one we offer”? 3/
I’m not trying to push back (yet). I assume there’s a good answer, or else I’d see more coverage. But I haven’t found it so far. @[email protected]? @[email protected]? @[email protected]? 4/
I get that the GDPR offers a substantive baseline of privacy protection. So the US’s quasi-contractual, Lochnerian shenanigans won’t cut it. Platforms can’t offer terms below that baseline level of protection and say “the user consented, it’s fine!” 5/
But for processing that the GDPR permits with consent, if controllers can’t say “the consent-based service is the only one we offer,” it seems like there’d be endless cases where DPAs can require an alternate version of a commercial service, with different privacy tradeoffs. 6/
Like “Airlines can’t offer frequent flyer perks — tracking flight history requires consent. But passengers must also have an option to get those perks even if the airline can’t see their flight history.”
7/
It just seems like data protection rules would become deeply enmeshed with, and displace, competition or fair trade rules. 8/

Or that the social network is one service, and the ads are another, so the GDPR rules for the social network can presume that ads are not relevant?

That one also seems like a competition policy question.

9/

Thanks, it’s late here, I assume I missed something. 10/10

@daphnehk This is a great thread and it's something that confuses me too about some of the European rulings I've seen come out.

It seems like the rulings boil down to "Internet companies offering any non-paid service in Europe must offer it free of any obligation whatsoever to the people using the service for free."

@amuse @daphnehk this is not about whataoever obligations, it's about: which law regulates data protection (contract law, or data protection law), and about data protection, so the scope is rather narrow, and not extremely broad as you put it.

@DiogoConstantino @daphnehk I'm probably speaking much more broadly than Daphne was, sorry for being confusing there.

Beyond this specific law and case, just seems to me that the collection of EU perspectives on tech in general seems to be "You can offer free services, but you can't ask anything in return from their users"

I can totally understand from a privacy perspective why that's desirable, I'm having a harder time seeing how that's a feasible way to run tech businesses.

And I'm personally happy to just pay a small fee for ad-free, pro-privacy things but I doubt I'm in the majority.

@amuse @DiogoConstantino @daphnehk isn't this a bit like saying:

seems to me that the collection of EU perspectives on tech in general seems to be "you can offer ride sharing services, but you have to treat your full time workers as employees, not independent contractors"

I can totally understand from a labour law and worker rights perspective why that's desirable, I'm having a harder time seeing how that's a feasible way to run a tech business.

@MechanicalTurk @DiogoConstantino @daphnehk I think it's actually a lot more like the government saying "You can offer ride sharing services, but you can't require the user to enable location sharing to summon the vehicle".

That's technically do-able, but completely changes a major pillar of what the business actually does to operate.

@amuse @MechanicalTurk @daphnehk it's a reasonable requirement for a government to do, if the business can'g operate like that, it shouldn't exist