Post

SOLUTION: That's simply wrong. The value of circulating data depends on what the data refers to: • Gains from being shared (antirival): e.g. the rules of a game. • Neutral when shared (nonrival): e.g. a factoid. • Loses when shared (rival): e.g. purchase intentions, product behaviour.

In most cases in the digital economy, a consumer-facing business sharing data with other parties is *losing* value in the process. This is particularly true of advertising businesses sharing with competitors like Google or Meta. Hot tip: sharing a business asset with competitors is bad, actually.

Businesses have a *data advantage* which they need to protect. Allowing their providers to access that data in limited, controlled ways helps, but definitely not donating it to as many others as possible — which the omnibus pushes for. I've written about this before: berjon.com/competition-....

Instead of the omnibus's loosening of the rules that protect businesses' data advantage, which favours firms with enough market power to force others to give them data (you know who), my proposal has a series of measures to protect businesses against these depredations.

And the funny thing is: making the data economy better for businesses that aren't tech monopolies also brings better privacy to people. Anyone telling you it's a choice between the two has been snorting too much tech lobbying.

PROBLEM: The omnibus offers a solution against cookie banners but then makes it not apply to media sites. The net result is: 1) Publishers, who need the greatest protection from Google taking their data, are unprotected. 2) Media sites become even shittier by comparison, helping Apple News, etc.

SOLUTION: Remove the media exemption. Also tweak enough of the proposed ePrivacy terminal storage exemptions to make ad businesses possible (but not invasive) with the automated signal. I've long had a proposal for this: berjon.com/gpc-under-th...

PROBLEM: The omnibus doesn't actually simplify some things that could safely be simplified. GDPR compliance was part of my portfolio for 5 years at the @nytimes.com — and let me tell you: some parts of the GDPR are totally useless. They cost time and help no one. But those are still in?

SOLUTION: Well, just remove them. Or at least remove them for businesses that aren't too big. Sometimes simplification really is that simple.

PROBLEM: The omnibus massively worsens national security and online safety. A severe and largely ignored national security problem is ADINT (Advertising Intel). The pervasive surveillance developed for commercial purposes also has espionage (personal and corporate) and military applications.

I cite a whole bunch of cases, but just to provide a few here… This includes Iran using it to target US troops in the current war: www.lawfaremedia.org/article/iran...

Seeing it used directly in conflict like this may seem new, but it's not as if it hadn't been reported on as a threat before: www.wired.com/story/phone-...

It's not as if the same EU officials who are working to facilitate ADINT haven't been targeted as well: netzpolitik.org/2025/databro...

And it's not as if the ADINT threat only comes from foreign adversaries — it's also dangerous when a far right government uses it for roundup raids: www.404media.co/email/0ba0f6...

SOLUTION: Well, first, don't introduce changes that make this kind of data collection easier. Second, tighten up the rules so that data collection becomes primarily first party, make geo data and browser data (that Chrome collects) sensitive and better protected.

And finally… PROBLEM: Ireland. GDPR enforcement follows a business's residence. So if you're in Poland and Google violates the GDPR with your data, you have to seek recourse where Google is set up, which is Ireland (same for Meta, Microsoft, and many others).

In general, this makes sense. How the GDPR is applied varies significantly between countries (and don't get me started on Germany), and expecting most sizes of businesses to be able to handle several dozen DPAs is unrealistic. But Ireland uses this to be a data haven — like a tax haven, for data.

In exchange for massive tax income and investment from the MAGA companies, Ireland simply doesn't apply the GDPR. Or only applies it superficially, extremely slowly, when forced to by external pressure. Because the biggest surveillance companies are there, this harms 450 million Europeans.

It's also bad for European businesses: they have to play by the rules and compete with American businesses that don't. Of all the EU countries that could side with foreign authoritarian rule, I really wouldn't have thought it'd be Ireland. And yet here we are.

SOLUTION: The very biggest companies can afford to deal with a lot of data authorities. So I introduce a Very Large Data Controller regime, modelled after DSA/DMA. The VLDCs, in addition to stricter controls over how they process data, have the GDPR applied in the jurisdiction of the data subject.

There's a lot more in the report but I'll stop here. I'm sure that people can disagree on details but I hope I've shown something different: what our data regulations could be like if they were informed by understanding the tech industry instead of by tech monopoly lobbyists.