Simplification and the Draghi report: a critique of implementation

Simplification and the Draghi report in relation to EU digital laws: what could/should be done? Some thoughts I shared at an event yesterday on the topic:

1. The laws themselves are not always bad.
While I have argued for getting rid of the ePrivacy Directive altogether (by taking into account overlaps with the GDPR and other laws) and for certain changes to the GDPR itself, there is a lot of good in the laws.
The problem often stems from the actual *implementation* of these rules, in particular their *interpretation* by authorities.

2. These interpretations are often too strict for their own good.
I have written extensively about a wide range of issues that authorities are causing as a result of their interpretation of rules. Here are some examples:

(i) The interpretation of the European Data Protection Board (EDPB) of whether “consent or pay” as a business model is compatible with the GDPR, in its Opinion re (whatever it means by) “large online platforms”, and its expansive interpretation of core concepts such as “freely given” and “informed” consent.
Consequence: massive legal uncertainty, an Opinion being quoted against publishers of websites who do not seem to be a “large online platform”, and business viability being brought into question.

(ii) The EDPB’s interpretation re Article 5(3) of the ePrivacy Directive, stretching notions in a manner that doesn’t work from a practical perspective.
Consequence: creation in practice of a need for consent for *every* interaction with a computer and *every* Internet communication)

(iii) Limitations to “contract” (GDPR) and “service” (ePrivacy), according to various authorities such as the CNIL (France)
Consequence: though there is no hierarchy of GDPR legal grounds, consent becomes the primary legal ground, and elements without which a service wouldn’t exist need to be disassociated from the service

(iv) A broad interpretation of the notion of “personal data” (despite case law) to try to bring AI model training within the GDPR’s scope.
Consequence: everything becomes personal data for a provider, even a needle (that the provider doesn’t know exists) in a haystack

3. The authorities adopting such interpretations must be held accountable.
I have often disputed the view that the EDPB’s positions are unchallengeable. Yet as long as the EDPB believes itself to be free from rules on accountability, it will take positions that are purely based on a lopsided view, one that *only* takes into account the fundamental rights to privacy and data protection (and notably not the freedom to conduct business or freedom of expression). There is no primacy of data protection, as the EU Charter of Fundamental Rights and the GDPR both make abundantly clear. Apparently accountability is needed to restore balance between fundamental rights & freedoms.

*Conclusion*: simplification is worthwhile, but we need to also fix governance for that to work.

See comments for links to in-depth articles on these topics.