The often-quoted description of data as the "new oil" now seems rather quaint. The seemingly all-conquering tech giants are seen by many as surfing a tsunami of proprietary data with nobody else getting a free ride. But is the party nearly over in the EU? New regulation is focusing on data sharing and transparency as the key to breaking down barriers to competition in digital markets. While we don't have the final text or even the final position for all the incoming legislation, we do know there will be a very significant impact on the use of big data, so data-rich businesses need to follow developments closely.
The symbiotic relationship between data and competitive advantage in the online world is well established. In many, but not all cases, the data is personal data. The way big tech collates and analyses user data to track users and serve targeted adverts, has been under particular scrutiny. The ability of large online platforms and search engines to make use of third party data from advertisers or sellers on their platforms, and the perceived lack of control users have over that data, is now the focus of legislators and regulators on the competition, consumer, digital and data sides.
One of the most high profile (but by no means the only) focus of actions targeted at the intersection of data and competition is Facebook (now Meta). Key actions include:
While the outcome of these investigations and cases are pending, they demonstrate the close relationship between control of big data and competition.
The European Commission is tackling these issues through a raft of legislation, some of which focuses specifically on data and some of which only touches on it (see here for a summary and anticipated timelines). A few of the incoming initiatives are squarely aimed at tackling big tech's data advantage and levelling the data playing field.
European Strategy for Data
One of the main initiatives under the European Strategy for data is the draft Data Act, published in February 2022. As we discuss here, the Data Act aims to remove barriers to data sharing, give business users access to data they contribute to creating, and individuals more control over all their data (not just personal data). It will empower users of connected devices to access and share data they generate with third parties, as well as to switch cloud and edge service providers. It also aims to protect SMEs by providing a harmonised framework in which data can be shared, equalising access to data across the market. It will apply to relevant UK businesses operating in EU markets.
The Act is seen as a crucial tool to help share the benefit of data among a wider range of businesses, and to give users more control over data they contribute to creating. It is at the beginning of the legislative process and will sit alongside the Data Governance Act which creates a trusted framework for data sharing and data altruism.
Digital Services package
The Digital Markets Act will have a profound impact on players designated as "gatekeepers". The politically agreed version of the Digital Markets Act has been published. It introduces mandatory actions and prohibitions on gatekeepers designed to level the playing field for digital businesses. Data driven advantages including access to and collection of personal and non-personal data and analytics capabilities, are explicitly cited as relevant to a company's designation as gatekeeper. See here for more.
In respect of data, gatekeepers:
The DMA is expected to be adopted in the coming weeks, meaning it will enter into force later in 2022. Following that, it will take six months to apply, likely taking up to mid-2023. The designation process will start, which might take up to mid-2023. From there, the regulatory dialogue would formally start. Finally, the compliance process is expected to begin around Q1 2024.
Political agreement has also been reached on the Digital Services Act. The agreed text had not yet been published at the time of writing, but the press releases indicate that large online platforms will need to protect users from illegal content, goods and services.
In respect of data:
The agreed text is now subject to formal approval by the European Parliament and Council. It will apply fifteen months from adoption or from 1 January 2024, whichever is later. However, it will apply to very large online platforms and very large online search engines four months after their designation as such.
One of the areas in which access to data provides a crucial advantage is targeted advertising. The EU and the UK are both looking at the role data plays in the online advertising system and the extent to which it presents a barrier to competition and/or a privacy issue. As noted above, the DSA is likely to restrict certain types of targeted advertising and the EC's draft ePrivacy Regulation, currently stuck in trilogues, may tighten up rules on the use of cookies and similar technologies for the purposes of online tracking and targeted advertising.
New rules regulating the use of AI under the EC's draft AI Act may further reduce barriers to competition by requiring transparency of algorithms for certain types of AI.
The UK government has been looking at reforming both competition and data protection policy, as well as at overhauling consumer protection laws. While its areas of focus are similar to the EU's, it has not got as far with concrete proposals.
The government's intention to create a lighter touch, alternative regime to the EU's in order to foster innovation and competition is well known. In its 'Benefits of Brexit' White Paper, published in January 2022, it suggested it will take a more targeted approach than the EU in terms of the digital markets competition regime.
Informed by the Furman Review and the CMA report of its market study into online platforms and digital advertising, as well as by the work of the Digital Markets Taskforce (the CMA working closely with Ofcom and the ICO), the government launched a consultation on potential changes to the competition regulation of digital markets in July 2021. This focused on the design of anew pro-competition regime for digital platforms with strategic market status to be overseen by the Digital Markets Unit which brings together members from the CMA, DCMS, BEIS and HM Treasury, the ICO, Ofcom and FCA (DMU).
In May 2022, the government published its response to the consultation outlining plans to introduce a legislative regime underpinned by binding codes of conduct individually targeted at companies engaged in "Digital Services" which are designated as having "Strategic Market Status" (SMS). The regime will be overseen and enforced by the DMU. It is explicitly targeted at a handful of 'big tech' businesses and overlaps with elements of the EU's Digital Services and Data packages.
In particular, the government intends the codes will introduce fair-play rules to make it easier for consumers to switch between digital service providers without losing their data, and give them greater overall control over their data. Rules will also be introduced to ensure fair prices for content providers like news publishers and advertisers. SMS firms will also be required to notify smaller firms about changes to algorithms which may impact their revenue. The DMU will have wide ranging powers to oversee and enforce the regime, including to fine SMS firms up to 10% of annual global revenue. These are likely to be brought in under the Digital Markets,Competition and Consumer Bill, announced in the Queen's Speech in May 2022.
The government's April 2022 response to the consultation on reforming competition and consumer law also proposes some more general reforms to the UK's competition regime but these focus largely on reforming existing processes and enhancing the CMA's enforcement powers, rather than on specifically data-related issues.
In addition, the UK government announced plans to overhaul the UK data protection regime in its September 2021 consultation 'Data a New Direction', suggesting a pro-competition, pro-innovation approach. Again, we have not reached the stage of developed proposals although the government announced the Data Protection Bill in the May Queen's Speech with publication expected before the summer recess in July and a response to the consultation with further detail expected by the end of June.
In short though, we have some way to go before we know how the UK's regime will compare with the EU's in these areas. The likelihood is there will be significant similarities as well as considerable differences.
In the meantime, data protection and competition regulators continue to look closely at the use of data by digital market leaders. They have the power to impose considerable financial penalties under the data protection framework and, in the EU, under the competition regime, to those breaching the rules, but the EU's longer term approach is to break down the big data advantage through regulation, whether or not that advantage is an 'unfair' one in competition law terms.
It remains to be seen the extent to which the UK follows suit and what the impact will be if it does not, but in-scope UK businesses operating in the EU will be impacted by the incoming EU legislation, as well as by new UK rules. Things are definitely changing in the world of big data, and businesses need to stand by to absorb and adapt to the new laws.
Victoria Hordern looks at what constitutes health data and the lawful bases on which it can be processed under the (UK) GDPR.
1 of 7 Insights
Victoria Hordern looks at the use of big data and AI in medical diagnostics in the context of data protection and AI regulation.
2 of 7 Insights
Elisa-Marlen Eschborn looks at the opportunities created by the planned European Health Data Space, and at whether they can be realised by 2025.
3 of 7 Insights
Ed Hadcock looks at the importance of fair and lawful processing of health data to establish trust as well as data protection compliance.
4 of 7 Insights
Jo Joyce looks at cybersecurity challenges facing health data and at ways to manage risk.
5 of 7 Insights
Debbie Heywood looks at the scientific research provisions in the UK GDPR and Data Protection Act 2018, in the context of health data.
6 of 7 Insights
Victoria Hordern looks at the restrictions on exporting health data and at whether they are really proportional given that potential benefits could well outweigh any risk.
7 of 7 Insights
Back to