ICO Meta decision: a pragmatic contrast to EU ideology

Significant news from the ICO re Meta: lower price than EU, and no “less personalised ads” offering… in the UK. The “Pay or OK” type of approach is alive and well over there (in this case: for Facebook & Instagram). Compared to the EU approach, it looks like the UK regulator has taken a pragmatic stance that ultimately is more in line with the Court of Justice’s Bundeskartellamt judgment than the EDPB’s Consent or Pay Opinion.

Put differently: ICO compliance with CJEU judgments > EDPB compliance with CJEU judgments. (Same with pseudonymisation & SRB)

One gem from the statement of the Information Commissioner’s Office: “the ICO recognises that online platforms, like every business, need to operate commercially”. Put differently: data protection doesn’t require services to operate at a loss.
 
I would expect the usual “but then it must be the same price in the EU!” clamoring, but as someone who has worked alongside product teams in a wide range of sectors over many years, I am certain the development of the extra alternative for the EU (following the EDPB’s creation of the notion of a “free alternative without behavioural advertising” or FAWBA) didn’t come free of charge.
Beyond questions surrounding support for certain languages that only exist in some regions within the EU and other EU-specific costs, this might become an interesting anecdote on the cost of devising a third option like a FAWBA.
 
In practice, I see this more as a reflection of a different approach between the ICO and the EDPB (and as a result, all EU-based supervisory authorities in charge of GDPR enforcement): while the EDPB has taken more ideological positions born out of a lopsided view (data protection > all else), the ICO shows once again (like with its overtures regarding ePrivacy/PECR consent exemptions and non-enforcement) that it is more willing to also take other aspects into account (such as the freedom to conduct business – and economic and financial considerations more generally).
 
Reading through the ICO’s press release (link below), I see encouraging signs that a reality check is happening.

As I wrote yesterday ( https://lnkd.in/ecg3x2vB ), I have various thoughts on the broader simplification agenda in the EU as it relates to digital laws, and I hope this can be yet another example that a practical middle-ground can be found, one in which laws can be interpreted and applied in a way that allows the protection of personal data *and* business considerations to work hand in hand.
Ultimately, we need regulators to reintroduce balance – and not to focus purely on one right (and pretend the rest doesn’t matter at all).
 
Perhaps we can one day see the EDPB – or at the very least national supervisory authorities and the European Commission – push the needle in that direction too?
 
Link to the ICO statement: https://lnkd.in/eZnn_4w7