CPDP 2022

Are Democratic Institutions
Doing Enough to Protect
Democracy, Freedom, and
Privacy from the Threat of
monopoly power?
How do we help
DG comp Fight
Monopoly Power?

$1.7bn
Financial penalty, 2019
$4.3bn
$2.7bn
European Commission fines against Google

$1.7bn
$4.3bn
$2.7bn
Google revenue, 2019 $161.8bn

$1.7bn
$4.3bn
$2.7bn

Atomic Unit of
Data Processing

-GDPR, Article 5 (1) (b)
(b)collected for specified, explicit and legitimate purposes
and not further processed in a manner that is
incompatible with those purposes; further processing for
archiving purposes in the public interest, scientific or
historical research purposes or statistical purposes shall,
in accordance with Article 89(1), not be considered to be
incompatible with the initial purposes
Personal data shall be:

1 O 1 O1
Ring fenced personal data

Scope
is determined by what the data subject could
foresee when the data was first collected.
1 O 1 O1 1 O 1 O1

1 O 1 O1
1 O
1 O 1 O1
1 O 1 O1
1 O 1 O1
Put a company’s
data under the
microscope.

1 O 1 O 1
1.An organization
collects some personal
data. It is lawful.

1 O 1 O 1
1.An organization
data. It is lawful.
2.The organization has
many purposes it wants
to use the data for.

1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1 O 1 O 1
1.An organization
data. It is lawful.
3. The organization has an internal
data free-for-all. “The Big Bang”

1 O 1 O 1
1.An organization
data. It is lawful.
3. The organization has an internal
data free-for-all.
4. But this is vulnerable to
enforcement of GDPR Article
5(1)b.
“The Big Bang”
“Universe Heat Death”

1 O 1 O 1
Many purposes.
But few lawful
data.

Market 1
Leveraging data from one market into another
Grew on the merits.

Market 1
Market 2

Market 1
Market 2
Personal data
Offensive leveraging of data

Market 1
Market 2 Market 3
Personal data

Market 1
Cross-use of data between processing purposes

Market 1
“Privacy tying” of
processing purposes
Purpose 1
Purpose 2
Purpose 3
Purpose 4
Purpose 5
Purpose 6
Purpose 7
more

Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Purpose
Market 1
Market 2 Market 3

@johnnyryan
Data collected on Google’s
own properties
(all purposes)

@johnnyryan
own properties
(all purposes)
Data collected on other
companies’ properties
(all purposes)

@johnnyryan
own properties
(all purposes)
Data collected on other
companies’ properties
(all purposes)
All data will be used across
all Google businesses, in all
markets

WE MUST HELP
DG COMPETITION
DO 3 THINGS

Your Google Account
Add your account .
.
.
Sign in to get the most out of your device.
Or create a new account
Enter your email
Learn more
SKIP

Your Google Account
Your inbox
Your web
browsing
Where you go
What you do on
your phone
What you
watch
? ?
? ?
? ?
Add your .
.
.
Sign in to get the most out of
Or create a new
Enter your
Learn
S

Market 2
E-mail
Market 3
Operating
Systems
Market 4
Ads on others’
sites/apps
Market 5
Ads on own
sites/apps
Market 1
Maps

Case 4:20-cv-05146-YGR Document 550-2 Filed 03/09/22 Page 111 of 248
?
• Core experience challenges
C, ••• Bl
?
• tJ ffl
EB m~
•• CJ ?
We h3Ve to stop think11gabout ettabhshng resoectful relclilCml"ips with our use1s as s.trictly a cnmmunic..1,on
ctlallenQe- :ind reckon wlh the fac.1
that oui-n11nose-1:ind underty,ngmechanismsmust be fundamentally rewired in
orde, to support meaningfurtransparency anctcontrol.
• Wecollect data 1nahuge bucket andallow It ~o rlowwherever and whenever
EVf:fl can't trace 11
, People c.;,rft 10110w
how w11ethe15harinq the,r data 1ranslates 10va1ue tor rhem
Measurement being integrated into data consent. (Wedidn't decide-by ourselves that we have broad permissions, We have it
because of our dual usage of the data we are collecting).
Kalle:We haveto say what we take for granted.
From the synthesis workshop
Broad permission structure/ecosystem experience complexity r,NAAetc.)
Lackof (actual) tangible (p13n) benefits in products/across products (for majority of user, increase benefit)
Strong connection of ads and product p13n (Making product and ads benefits tangible to users explicit/separately)
Display ads experiehce/perception (1P & 3P)
Lackof privacy-specific products/features
Lackof observable proof (ads & product)
CONFIDENTIAL GOOG-CABR-04754288

• Core experience challenges • tJ ffl
EB m~
•• CJ ?
We h3Ve to stop think11gabout ettabhshng resoectful relclilCml"ips with our use1s as s.trictly a cnmmunic..1,on
ctlallenQe- :ind reckon wlh the fac.1
that oui-n11nose-1:ind underty,ngmechanismsmust be fundamentally rewired in
orde, to support meaningfurtransparency anctcontrol.
• Wecollect data 1nahuge bucket andallow It ~o rlowwherever and whenever
EVf:fl can't trace 11
, People c.;,rft 10110w
how w11ethe15harinq the,r data 1ranslates 10va1ue tor rhem

PURPOSE LIMITATION
IS KRYPTONITE
TO BIG TECH

Processing Purpose Data Lawful Basis etc.
. Its processing purposes.
Company “A”
Spreadsheet of every processing purpose (a detailed “ROPA")

Company “B”
Company “A” wants to buy

Company “B”
What will happen
if these spreadsheets
make Babies?
Company “B”

What will happen
if these spreadsheets
make Babies?
FitBit…
Google DoubleClick… etc.
wants to buy

3
Early guidance
& enforcement
of DMA

“In respect of each of its core platform services identified pursuant to
Article 3(7), a gatekeeper shall:
(a) refrain from combining personal data sourced from these core
platform services with personal data from any other services offered
by the gatekeeper or with personal data from third-party services,
and from signing in end users to other services of the gatekeeper in
order to combine personal data, unless the end user has been
”
Digital Markets Act, Article 5(1)(a)
of Regulation (EU) 2016/679. ;
presented with the specific choice and provided consent in the sense
a single opt-in to a
data free-for-all?

“In respect of each of its core platform services identified pursuant to
Article 3(7), a gatekeeper shall:
(a) refrain from combining personal data sourced from these core
platform services with personal data from any other services offered
by the gatekeeper or with personal data from third-party services,
and from signing in end users to other services of the gatekeeper in
order to combine personal data, unless the end user has been
Digital Markets Act, Article 5(1)(a)
presented with the specific choice
with the requirements under Article 4(11), Article 6(1) point
(a), and Article 7
for each processing purpose, in line
of Regulation (EU) 2016/679. ;
”
We proposed this change prevent Big Tech claiming
ambiguity to rely on one all-encompassing OK button

Improve your service with data?
OFF

Improve your service with data?

Urge the Commission to
use purpose limitation to:
1. Tame giants,
2.Understand & block
mergers; and
3.Avoid trap of single OK.

CPDP 2022

Recommended

Recommended

More Related Content

Similar to CPDP 2022

Similar to CPDP 2022 (20)

More from Johnny Ryan

More from Johnny Ryan (20)

Recently uploaded

Recently uploaded (20)

CPDP 2022