Post

We all know that the GDPR et al. aren't working great. Alas, the current proposals to fix that — in what EU jargon calls an "omnibus" — make it way worse. This counter-proposal is: better for people, simpler for businesses, *much* stronger on security, competition, sovereignty, and online safety. 🧵

Before diving in, just for giggles, Ireland currently holds the rotating Presidency of the Council but their proposed compromise text is so spectacularly bad that their own AI Minister won't even admit to it being their proposal. mu.social/profile/toni...

For context: Ireland is MAGA's primary beachhead in Europe. As indicated in the video, part of the proposal is that you would no longer need to consent to your personal data being used if it's for AI. The only companies this benefits are those with large existing surveillance systems: MAGA techs.

That's not the only issue: • The text is very favourable to tech monopolies and supports them against challengers. • It fails to simplify, even very obvious things. • The way in which it kills cookie banners is broken. • It directly undermines national security & online safety of vulnerable people.

I won't recap my entire proposal, but here are some highlights in presented in problem/solution pairs. PROBLEM: The omnibus has a broken theory of how the digital economy works. It follows the belief that there's a "data economy" and that the more data circulates, the more value is created.

SOLUTION: That's simply wrong. The value of circulating data depends on what the data refers to: • Gains from being shared (antirival): e.g. the rules of a game. • Neutral when shared (nonrival): e.g. a factoid. • Loses when shared (rival): e.g. purchase intentions, product behaviour.

In most cases in the digital economy, a consumer-facing business sharing data with other parties is *losing* value in the process. This is particularly true of advertising businesses sharing with competitors like Google or Meta. Hot tip: sharing a business asset with competitors is bad, actually.

Businesses have a *data advantage* which they need to protect. Allowing their providers to access that data in limited, controlled ways helps, but definitely not donating it to as many others as possible — which the omnibus pushes for. I've written about this before: berjon.com/competition-....

Instead of the omnibus's loosening of the rules that protect businesses' data advantage, which favours firms with enough market power to force others to give them data (you know who), my proposal has a series of measures to protect businesses against these depredations.

And the funny thing is: making the data economy better for businesses that aren't tech monopolies also brings better privacy to people. Anyone telling you it's a choice between the two has been snorting too much tech lobbying.

PROBLEM: The omnibus offers a solution against cookie banners but then makes it not apply to media sites. The net result is: 1) Publishers, who need the greatest protection from Google taking their data, are unprotected. 2) Media sites become even shittier by comparison, helping Apple News, etc.

SOLUTION: Remove the media exemption. Also tweak enough of the proposed ePrivacy terminal storage exemptions to make ad businesses possible (but not invasive) with the automated signal. I've long had a proposal for this: berjon.com/gpc-under-th...

PROBLEM: The omnibus doesn't actually simplify some things that could safely be simplified. GDPR compliance was part of my portfolio for 5 years at the @nytimes.com — and let me tell you: some parts of the GDPR are totally useless. They cost time and help no one. But those are still in?

SOLUTION: Well, just remove them. Or at least remove them for businesses that aren't too big. Sometimes simplification really is that simple.

I cite a whole bunch of cases, but just to provide a few here… This includes Iran using it to target US troops in the current war: www.lawfaremedia.org/article/iran...

Seeing it used directly in conflict like this may seem new, but it's not as if it hadn't been reported on as a threat before: www.wired.com/story/phone-...

It's not as if the same EU officials who are working to facilitate ADINT haven't been targeted as well: netzpolitik.org/2025/databro...