European Publishers Council

CONFIDENTIAL Position Paper from the European Publishers Council on the Impact of the General Data Protection Regulation “GDPR” on News Media Publishers April 2020 European Publishers Council's public ID number in the Transparency Register is: 4456380381-30 On the basis of an internal questionnaire sent to our members, this position paper from the European Publishers Council has been prepared for the European Commission to consider as part of their review of the General Data Protection Regulation “GDPR”, and is divided into five Parts: Part I – Introduction and Overview looking at the effects of the GDPR on news publishers and to inform the European Commission of the unintended consequences of the GDPR on news publishers and on the online advertising eco-system more widely on which they critically depend as a source of revenue.

…publishers and on the online advertising eco-system more widely on which they critically depend as a source of revenue. Part II – Looking Forward: Key Recommendations While the GDPR has played a major role in strengthening data protection in the EU, we have seen increasing market concentration to the detriment of smaller market participants in the ad tech ecosystem which negatively impacts news publishers. We invite the European Commission to consider and remedy the shortcomings we have identified which affect innovation and competition in the market. Part III provides our short overview of the objectives of the GDPR, the principles it enshrines and draws some conclusions from its implementation.

…overview of the objectives of the GDPR, the principles it enshrines and draws some conclusions from its implementation. Part IV analyses the GDPR’s unintended consequences in more detail: As will be seen, the GDPR has increased concentration in the markets in which the collection and processing of personal data is important, including in online advertising markets on which news publishers are so heavily dependent. We will also show that the GDPR and privacy considerations have been used by Google to engage in anticompetitive conduct. Part V identifies some problematic practices that the GDPR has not prevented: First, the GDPR has not prevented Google from combining the data it collects across its user-facing services (e.g., YouTube, Search, Maps) and use it for a wide variety of purposes, hence allowing what has been labelled an “internal data free-for-all”.

Maps) and use it for a wide variety of purposes, hence allowing what has been labelled an “internal data free-for-all”. Second, due to the narrow approach of DG Competition, the GDPR has done nothing to prevent big data mergers, which once again strengthen the position of large online platforms. Ref. Ares(2020)2297856 - 29/04/2020 2 I. Introduction and Overview This position paper presents the views of the European Publishers Council (“EPC”)1 on the General Data Protection Regulation (“GDPR”)2 and its effects on news publishers and the wider online community. Its purpose is to inform the European Commission of the unintended consequences of the GDPR on news publishers, and on the online advertising eco-system on which they critically depend as a source of revenue.

…on news publishers, and on the online advertising eco-system on which they critically depend as a source of revenue. While the GDPR has provided important benefits to society at large in terms of increased privacy, it has also strengthened the dominant position of large platforms in online advertising markets, such as Google and Facebook, to the detriment of their smaller rivals and news publishers. This increased market concentration harms news publishers in terms of choice, innovation and revenues and arguably undermines the benefits of GDPR for the users of large platforms. For these reasons, the current situation is in our view unsustainable.

…of GDPR for the users of large platforms. For these reasons, the current situation is in our view unsustainable. The regulatory changes brought by the entry into force of the GDPR have affected news publishers significantly: ➢ First, on the positive side, the GDPR has raised privacy-awareness for their readers and initiated and promoted social debate on the important topic of data protection. GDPR has increased privacy-awareness in corporations across business sectors, and placed this important fundamental right on the agenda across Europe, as well as globally. ➢ Second, on a more negative side, compliance with GDPR is a particularly challenging task for news publishers. There are many reasons for this, but the main issue is that processing of personal data is a key aspect of most publishers’ business models.

…for this, but the main issue is that processing of personal data is a key aspect of most publishers’ business models. Processing of personal data is an absolute necessity both when providing a news publisher service (providing services over the internet always involves processing personal data in the form of IP addresses, but also often for such purposes as personalisation of the services), as well as for revenue generation through ads. The publishers’ products cannot be provided without processing personal data; nor can the revenues needed to fund the content production be generated without processing personal data. For news publishers, it is therefore not a question of whether personal data must be processed, but how personal data can be processed ensuring the right to privacy but without removing the financial fundament for the publisher’s business.

…be processed ensuring the right to privacy but without removing the financial fundament for the publisher’s business. 1 The EPC is a high-level group of Chairmen and CEOs of Europe’s leading media groups representing companies with newspapers, magazines, online publishing, journals, databases, books and broadcasting. We have been communicating with Europe’s legislators since 1991 on issues that affect freedom of expression, media diversity, democracy and the health and viability of media companies in the European Union. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), O.J. 2016, L 119/1.

…free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), O.J. 2016, L 119/1. 3 The competition landscape within advertising is a particularly challenging one, where publishers’ main competitors are not usually other publishers, but rather a few major global corporations which often operate under different jurisdictions to the publishers, or which through their platforms create a dominant market position that makes it possible for them to both capitalise on certain legal positions in relation to GDPR, and to dictate to the wider market.

…for them to both capitalise on certain legal positions in relation to GDPR, and to dictate to the wider market. When it comes to consent, publishers are not required to put Consent Management Platforms (CMP) in place in order to process data on their own account; but are forced to do so by the buy-side, which needs the publishers to get the consents of the users on their behalf in order for them to operate, and if publishers do not help them to obtain consent they will quite simply put their money elsewhere. The human resources and capital costs involved in ensuring compliance with the GDPR, together with the threat of a high level of fines, disproportionately burden the smaller publishers – which are limited by both financial resources and by personnel.

…disproportionately burden the smaller publishers – which are limited by both financial resources and by personnel. For example, Microsoft had 1.600 engineers working on GDPR compliance since its enactment in 2016.3 By contrast, news publishers, many of which are SMEs, do not have the lawyers, data experts and programmers necessary to make compliance with the GDPR a smooth and effective process.4 Additionally, compliance with certain requirements of the GDPR, such as adopting technical and organisational measures, and monitoring and documenting data flows, exhibits economies of scale and scope, which tend to create a competitive advantage for large organisations. Even though the GDPR is by nature “scalable”, the requirements are extremely challenging for smaller companies working in businesses where data is necessarily an intrinsic part of participation.

…for smaller companies working in businesses where data is necessarily an intrinsic part of participation. ➢ Third, an even more negative impact of the GDPR on news publishers is that it has a large impact on one of their main sources of revenue (or in some cases their only source of revenue), which is online display advertising. While historically news publishers directly negotiated advertising deals with advertisers or their agencies, in the digital space news publishers increasingly rely on programmatic advertising,5 and on providers of ad intermediation services, such as Google. Moreover, as online advertising increasingly relies on behavioural targeting, it is essential for advertising intermediaries to collect and process data about online users.

103 → 12

originalus šaltinis (PDF) ↗

…8 February 2024 Response from the European Publishers Council (EPC) to the European Commission’s Call for Evidence on the Report on the General Data Protection regulation Transparency Register ID: 4456380381-30 The European Publishers Council (“EPC”), a high-level group of Chairmen and CEOs of Europe’s leading media and publishing groups representing companies with newspapers, magazines, online publishing, journals, databases, books, eLearning, online marketplaces, radio and TV broadcasting. In 2020, EPC submitted to the European Commission extensive comments on the impact of the General Data Protection Regulation (GDPR) on news media and publishing companies. These comments, for the most part, continue to be relevant and accurate.

(GDPR) on news media and publishing companies. These comments, for the most part, continue to be relevant and accurate. General comments While the GDPR has provided important benefits to society at large in terms of increased privacy, it has also strengthened the dominant position of large platforms in online advertising markets, such as Google and Facebook, to the detriment of their smaller rivals and publishers. This increased market concentration harms news media and publishers in terms of choice, innovation and revenues, and arguably undermines the protections granted to users from the GDPR for the users of large platforms. For these reasons, the current situation continues to be, in our view, unsustainable.

…for the users of large platforms. For these reasons, the current situation continues to be, in our view, unsustainable. It is important to note that on the positive side, the GDPR has increased privacy-awareness in corporations across business sectors, and placed this important fundamental right on the agenda across Europe, as well as globally. The GDPR has, and continues to raise privacy- awareness for publishers' readers and promote social debate on the important topic of data protection while the media and advertising industry has put considerable effort into the development of solutions to help with compliance. Ref. Ares(2024)971054 - 08/02/2024 2 However, it is important to recall that (i) processing of personal data is an essential element for the running of publishers’ business models, for providing new publisher services (i.e.

…data is an essential element for the running of publishers’ business models, for providing new publisher services (i.e. recommendation, personalisation) as well as for revenue generation through programmatic advertising; and (ii) programmatic advertising is delivered via a tightly interwoven ecosystem of large and small actors which are all interdependent. As a consequence, the challenges of the GDPR for most publishers have been and continue to be about friction and coordination with the ad tech ecosystem, and ensuring that publishers can confidently maintain a trusted relationship with their audience.

…ad tech ecosystem, and ensuring that publishers can confidently maintain a trusted relationship with their audience. Platforms continue to benefit from GDPR at the expense of publishers As highlighted in EPC 2020 position paper, the GDPR has had the unintended consequence of strengthening the market position of online platforms such as Google and Meta, to the detriment of publishers which depend heavily on their market dominant advertising intermediation tools to monetise their content. The capacity of platforms which have been able rapidly to comply with the GDPR combined with the fear of liability and the large fines envisaged on the basis of the GDPR have led advertisers to concentrate their ad spending on the largest players (in particular Google), as they trust that they are compliant with the Regulation, thereby limiting their own risk.

(in particular Google), as they trust that they are compliant with the Regulation, thereby limiting their own risk. This move has further strengthened the dominant position of online platforms in digital advertising, and the dependency of publishers on their ad intermediation services. In addition, with its structure, the GDPR tends to favour large companies, such as online platforms, which act as one controller processing data from their many services on their servers and can provide users with one simplified customer interface.

…processing data from their many services on their servers and can provide users with one simplified customer interface. In stark contrast to the position of platforms, publishers and other parties of the digital advertising ecosystem face increasingly higher levels of red tape, having to act as joint controllers, relying on joint controller agreements, collecting consent that mentions each party by name, and extensive privacy notices that explain how the joint controllership lays out responsibilities and handles data subject rights. Through their many consumer-facing services, online platforms are in an ideal position to collect user consent for all their services, with a unique ability to combine data from their different services as well as outside of their own ecosystem.

…with a unique ability to combine data from their different services as well as outside of their own ecosystem. The Digital Markets Act (DMA) aims at remedying this issue by demanding greater transparency to the user when seeking their consent to collect and combine data. However, the DMA is new and untested. Adopted in 2023, with enforcement application of the DMA during 2024, plenty of time remains for platforms to consolidate their data based position. Moreover, because article 5.2 of the DMA will continue to allow platforms to combine data from different services on the basis of consumer consent, which they are likely to obtain relatively easily, the potential benefit of that obligation is likely to be negated.

…which they are likely to obtain relatively easily, the potential benefit of that obligation is likely to be negated. Dominant players have weaponised the GDPR The dominant market positions in advertising of Google and Meta has enabled the platforms to impose their vision of how certain GDPR provisions should be implemented by the ecosystem. Since adoption, we have seen Google requiring that publishers obtain end-user 3 consent on their behalf for the processing of personal data which they uniquely benefit from. Considering the dependence of publishers' advertising revenues coming from Google owned services, publishers have not had any realistic possibility of refusing to obtain consent on behalf of the online platform. At the same time, Google designated itself as a data controller independent from the publishers, for data it receives from publishers and collects on publisher pages.

…data controller independent from the publishers, for data it receives from publishers and collects on publisher pages. As a consequence, publishers find themselves responsible for collecting consent on their sites, from their audience, for processing of personal data by Google beyond their knowledge or control. In effect, Google’s approach of transferring the liability to collect data subject’s informed and specific consent to the publishers, has become the de facto norm through the development of the Transparency and Consent Framework (TCF) by IAB Europe. While the TCF finds a way for ad tech vendors to obtain GDPR compliant consent, the burden on publishers remains disproportionate.

…finds a way for ad tech vendors to obtain GDPR compliant consent, the burden on publishers remains disproportionate. This approach, combined with the lack of transparency of the ad tech ecosystem has led to a situation where some publishers prefer collecting consent on behalf of more third party vendors than they have contracts with, in order to anticipate enforced sharing of data beyond their control, and thereby mitigating their own risk of exposure to GDPR breaches. This leads to the unfortunate increase in ever-more complex cookie consent banners presented to the user. Another example of GDPR weaponisation would be the unilateral decision by Google to deprecate third party cookies on Chrome, the most used browser in EEA. Their stated objective is to “both protect people's privacy online and give companies and developers tools to build thriving digital businesses.

…to “both protect people's privacy online and give companies and developers tools to build thriving digital businesses. The Privacy Sandbox reduces cross-site and cross-app tracking while helping to keep online content and services free for all”1. This objective has raised many concerns among publishers and the ad ecosystem, and triggered an investigation from the UK Competition and Markets Authority. “In February 2022 the CMA accepted commitments from Google to address its competition concerns. These commitments involve the CMA working with Google on the design and assessment of the Privacy Sandbox proposals before a final decision is taken to remove third-party cookies from Chrome”2.

29 → 12

originalus šaltinis (PDF) ↗