.svg)
In the Privacy Soapbox, we give privacy professionals, guest writers, and opinionated industry members the stage to share their unique points of view, stories, and insights about data privacy. Authors contribute to these articles in their personal capacity. The views expressed are their own and do not necessarily represent the views of Didomi.
Do you have something to share and want to take over the privacy soapbox? Get in touch at blog@didomi.io
The diagnosis is clear: Europe is sick with regulatory inflation. It’s buried under legal texts, suffocating beneath layers of regulation, so much so that the European Commission is preparing to tackle the problem head-on… by publishing a new text. This is what scientists call fighting fire with fire. And they think it’s going to work, much like a local GP who, shocked by the ineffectiveness (or disastrous side effects) of a treatment, decides to increase the dosage of the initial medicine. Clever, in a way... at least it’s one way to justify a salary.
A hundred and fifty-six pages, then, to simplify. The text is even called Digital Package on Simplification, if that’s not a good sign! Complexity is in for a ride. They’re going to blast it away, anything resembling nuance will end up in the great administrative grinder. “We promise, this time we’re really simplifying,” say the Commission officials, and we might even believe they’re sincere.
As for us, we’ll be less ambitious. Let’s modestly focus on one aspect of this grand simplification work: Article 88b, which brings back an old recurring idea of consent at browser level.
Leaking as a means of consultation
Let’s start with the form. If I was able to access this project, it’s first and foremost because it leaked. You can find it everywhere on LinkedIn.
The result? We get a sneak preview of what’s coming our way. Nice, though not very serious for an institution like the Commission to let draft regulations slip like that. It doesn’t give the impression of a tidy house. One could almost think it’s intentional, not out of pure malice (although...), but rather to test the waters, take the pulse of the digital herd, gather comments, and feel the ground before officially launching a consultation.
If that’s really what’s happening, it would almost be good news; it would mean we still have time to avoid the worst.
But scratch the surface of the project, and hope deflates quickly. It says, in black and white, in the preamble to Article 88b, that a “principle agreement” has already been reached between DG Connect and DG Just. Translation: the worm is already in the fruit; the compromise is baked into the regulation. We’re told it’s just a matter of fine-tuning, of small adjustments to come... in short, the deal is done.
For a simplification project, it certainly simplifies things, even democracy.
Toward a sustainable simplification of simplifying complexity
The Commission’s stated goal is to simplify. And to simplify, it thought: let’s move consent to the browser level. In plain terms, instead of multiple consent banners, users will make a one-time choice when installing or updating their browser. One choice instead of a thousand. Simplicity made simple (almost simplistic).
The text says
The data subject shall be able to [give consent or] refuse a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means.
In other words, the user must be able to refuse automatically, without seeing a consent banner. A general principle setting such as “I refuse everything, always, everywhere” would do.
The problem, as Didomi pointed out in its submission to the Commission’s call for contributions last September, is that to make this work (if one insists on simplifying at all costs, even against logic), you need a protocol, a standard that allows communication of the user’s choice. In other words, you need a common language between browsers and website publishers (that’s the Commission’s “machine-readable” part). You also need a taxonomy of processing purposes, to ensure that consent, if ever given, still meets the GDPR’s specificity requirement.
The Commission agrees that a standard is necessary. And as for who should develop it? “The market will figure it out,” says the Commission. As for what it should look like, well, good luck, the Commission isn’t here to do the dirty work. Instead, it outsources it. The standard will be defined by “stakeholders of the digital industry,” by the “global internet market players”. In other words, by a bodiless entity, if such a thing exists. Because really, who is the “global internet”? Does it have a phone number?
That said, the Commission itself acknowledges that reaching an agreement among all internet players will be difficult. So it reserves the right—if it finds the industry’s response insufficient (spoiler alert: it will)—to require browser and OS manufacturers (read: Apple, Google, Microsoft) to come up with a solution for everyone, which will then have to be approved by the Commission.
So much for simplification.
In short: I create conditions for a default refusal of data use; I let the digital industry deal with it; and if that fails, I turn to the GAFAMs who, incidentally, already operate perfectly well without consent, and give them the power to become the gatekeepers of everyone else’s consent. Never mind that this completely contradicts the Commission’s other work on competition law (DSA, DMA, record-breaking fines, and so on). Details, details.
Let’s recall that the Omnibus Package is meant to simplify digital legislation. “I love simplifying,” says the Commission, with the same tone as an alcoholic insisting, “I love grape juice.” The truth is, I have no idea how the concept of simplification fits into the minds of Commission members. In the face of such mystery, my drawer of coherent narratives is completely empty. One word comes to mind: clownish.
The Commission : A sad clown
The thing about clowns is that they’re sometimes sad. Spinoza, who knew a thing or two about human nature, said it was because of their “sad passions.” Among those, he included remorse. And remorse, it seems, the Commission has plenty. They do seem to realize that this will roughly collapse Europe’s digital economy. They’re not completely oblivious to that piece of obviousness. They know that generalizing the refusal of consent across all sites, apps, and platforms, and forcing everyone to respect that signal, will push Europe’s internet into a severe starvation diet. You can be in favor or against that morally, fair enough, but you still have to grasp the risk: this could destroy the advertising foundation on which our entire digital economy rests.
And then, giving the keys to consent management to Google, Apple, and Microsoft is a brilliantly disastrous idea, in the way that a rope is a brilliant solution for someone contemplating hanging himself. So yes, they feel a bit guilty. They want to save at least one European soldier, to show they’re not heartless. The folks at the Commission are still nice, don't get the wrong idea.
Because, you see, democracy is no laughing matter at the Commission. We want it to survive, at least long enough to draft a few more regulations. The administration administers. So, we're not going to sink the media right away with everyone else. We tell media organizations: no need to follow the automated consent signal, do what you want, you, the moral conscience of Europe, weary knights, last defenders of a struggling democratic society.
Here’s what Recital 39 says:
In light of the importance of independent journalism in a democratic society and in order not to undermine the economic basis for that, media service providers should not be obliged to respect the machine-readable indications of data subject’s choices.
In short, lifeboats are distributed to those deemed worthy of floating. The underlying logic is: everyone’s going to lose a lot of money, everything’s doomed, but we’d still like to pay a few journalists, because, well, they’re nice, and democracy, you know. So we exempt them from GDPR compliance. For them, it's free, because deep down they are more equal than others. That's democracy for you.
Why not. But it raises a serious ethical question. If we exclude the press, allowing them to ignore GDPR as reinterpreted by the Commission, it’s because we know they would otherwise die in the world the Commission is creating. It’s a tacit acknowledgment of the harm being done in the name of simplification. But then, why do others deserve less? Why save only one industry?
Not to worry, it says in the preamble that everything will be “fine-tuned.” You don’t say. They’ll have to work hard, because this is quite the mess. Everyone loves a circus, sure, it’s nostalgic, but that doesn’t mean we need to play clowns every time we have five minutes to spare.
The expanding realm of total refusal
In the first paragraph of Article 88b, the Commission seems to acknowledge that it has always been easier to refuse than to accept trackers and data processing. It doesn’t even talk about consent anymore, it says the user has the right to refuse (not to consent) in an automated way. In short, consent must meet strict conditions to be valid but refusal doesn’t. You can refuse everything, everywhere, all the time, but you can’t consent in the same way.
Don’t believe me? Just look at the text:
The data subject shall be able to [give consent or] refuse a request for consent (...).
The phrase “give consent or” is in brackets. Meaning: they’re not sure it belongs there, and might even remove it altogether. Otherwise, why put it in brackets?
The truth is, the Commission knows it’s impossible to consent en bloc because of the GDPR’s specificity requirement. But you can absolutely refuse en bloc, since refusal has no validity conditions. And that’s precisely what the Commission is creating: a consent blocker.
Because while the GDPR states that withdrawing consent must be as easy as giving it, it doesn’t say that giving consent must be as easy as refusing it. A subtle nuance, yes, but that’s what nuance is. Put differently, some user choices are simply not “as easy” as others.
Treating the imaginary invalid: A method
Let's sum it up.
- Commission’s stated goal: make Europe more competitive by simplifying its rules.
- Method: add a new regulation to the endless pile, cutting off the advertising tap. No more money, no more problems. Then, hand over the keys to consent to operating systems and browsers i.e., American gatekeepers.
- Minor issue worth mentioning: doing this will kill off a large part of the digital industry, particularly the press. Obviously, this is a bit of a problem given that we are still, at least for the time being, a democracy.
- Solution: Never mind, we'll simply exempt the media outlets; they won't have to apply all this regulatory mess. Because of the principle of equality before the law.
- Result: we avoid amputating the right leg while stopping the heart (seasonal metaphor, inspired by November 11 commemorations).
Clownish is the word that comes to mind, I know.
Of course, this is a bit simplified (but as I often say, in life, you must simplify or you’re not honoring the principle of simplification). Still, it’s clear that the Commission is losing the plot. It’s getting lost in the fog it creates. On reflection, it’s like a Molière comedy, The Imaginary Invalid:
– Mr. Legislator, my economy is coughing. Can you do something?
– It’s breathing too heavily. We’ll prescribe an advertising air cut via Omnibus.
– But, doctor, won’t that kill it?
– Dear sir, let the professionals handle it. Death would merely prove the treatment worked.
And indeed, it’s flawless logic: a patient who no longer complains is a cured patient. When it comes to European administration, that logic holds, especially if we admit that, from its point of view, a good citizen is a dead one.
That said, there are one or two good ideas in there. That’s the thing with human production, it’s rarely entirely worthless. It’s even why people tend to find babies cute, in general.
For example, the proposal takes into account recent SRB case law, which introduces the idea that one must consider actual reidentification capabilities when determining whether data is personal data. We are shifting from an objective analysis to a subjective analysis of the concept of personal data. Not bad. However, there is no need to go into further detail here, as others have described this shift very well (see, in particular, Peter Craddock's posts on the subject)
