The EU’s Digital Markets Act creates a new regulatory framework for large digital platforms in the EU, including specific reporting obligations for those digital platforms designated as “gatekeepers”. Article 15 of the DMA requires gatekeepers to report on their consumer profiling activities. The European Commission has sought feedback on its draft gatekeeper reporting template for consumer profiling required under Article 15 (the “Template”).
We welcome the opportunity to engage with the EC and have submitted a formal response to the consultation (see here). In this piece, we look at what gatekeepers will need to disclose under the Template, the extent to which the Template’s requirements align with Article 15, and where some potential issues with the Template may arise.
The obligation to describe techniques for profiling consumers
Consumer profiling is, in a nutshell, the use of consumer data to create individual “profiles” which can be used by a platform to provide targeted content to end users. Consumer profiling is commonly used in digital advertising to deliver personalised advertisements to targeted audiences.
Article 15 requires gatekeepers to submit an independently audited description of the consumer profiling techniques applied to or across its core platform services. The recitals to the DMA clarify that this should include: 1) whether personal data is relied on; 2) the processing applied; 3) the purpose in preparing and using the profile; 4) the duration of profiling; 5) the impact of profiling; 6) and the steps used to get consent from consumers. The audited description is then transferred to the European Data Protection Board to inform the enforcement of data protection rules.
The ultimate purpose of the reporting obligation is for the EC to ensure a minimum level of effectiveness of gatekeepers’ transparency obligations vis-a-vis end users. This puts external pressure on gatekeepers not to make deep consumer profiling the industry standard, since potential entrants or start-ups may not be able to access data to the same extent and depth, or at a similar scale.
The Template’s requirements
The Template requires gatekeepers to provide a range of information, including: (i) information on the identity of the gatekeeper; and (ii) information about the consumer profiling techniques.
Largely user-friendly, clear and aimed at avoiding duplication for gatekeepers…
The consumer profiling information required under the Template is, in some places, straightforward and aligned with the obligations under other EU legislation. Much of the required information is likely to already be collected by gatekeepers under the Digital Services Act or the General Data Protection Regulation (“GDPR”). The language of the Template also aligns in many places with the GDPR, which should reduce uncertainty and confusion when it comes to interpretation.
…but some refinement needed to ensure the EC isn’t swamped with information…
The current wording of the Template requires gatekeepers to provide a significant level of information on consumer data, including detailed descriptions of categories of data, and of the data itself. Gatekeepers are also required to provide types of volunteered, observed and inferred data used for consumer profiling.
To ensure their compliance with these obligations, gatekeepers would likely have to undertake a burdensome exercise to identify all responsive data. The result will be providing long lists of datafields, inundating the EC with information that will make it difficult to “see the wood for the trees”. This might be of limited utility, given the EC’s overall objective of ensuring transparency for end-users.
This unintended outcome could be avoided if the Template were to require gatekeepers to instead provide the “main parameters” of data used for consumer profiling e.g., relating to consumers’ age, sex, socio-economic status, etc. This would ensure that the obligations on the gatekeepers are proportionate, while also providing the EC and users with a clearer understanding of the nature of the data being collected, and thus the potential depth of consumer profiling.
…and to ensure competitively sensitive information isn’t disclosed…
Another issue is that the Template currently requires gatekeepers to provide information on “alternative measures to profiling” that have been implemented or considered. While this level of information is not envisaged by the DMA, what is of most concern is that information on alternative measures to profiling is likely to be competitively sensitive and does not serve the purpose of enabling users to compare relative levels of data collection by rival services.
An alternative to requesting this information would be for the Template to instead ask for more open-ended information concerning gatekeepers’ choice of data protection techniques, and why they believe they strike the right balance between optimising the relevant service and protecting users’ privacy. This is likely to be of use for users, and therefore more effective at transparency that benefits comparison across different services.
… and to protect privilege
The Template also requires the names of the employees and external experts who worked on putting together the report be disclosed. This is problematic on a number of levels, not least of which is that requiring gatekeepers to disclose external experts (a group that would include external legal counsel) could inadvertently breach the principle of legal privilege and rights of confidentiality, since individuals cannot be compelled to disclose whether they have sought legal advice in relation to a particular issue.
One way to resolve this issue would be for the Template to expressly exclude external legal counsel from gatekeeper’s disclosure obligations.
Next steps
The EC closed its call for evidence on 15 September and will now consider feedback from participants. Linklaters has contributed to the EC’s public consultation on the Template and our response is available here.
For more information the DMA, visit our Digital Markets Act Hub, a one-stop shot providing key developments about the DMA to help you navigate the changing regulatory landscape.
For further information, please contact:
Gerwin Van Gerven, Partner, Linklaters
gerwin.vangerven@linklaters.com
