European Union: Council passes data handling obligations in DMA
Compare with different regulatory event:
Description
Council passes data handling obligations in DMA
On 18 July 2022, the Council of the European Union adopted the Digital Markets Act (DMA) including data transmission and processing obligations. The adopted text defines as “gatekeepers” the companies providing “a core platform service” (such as browsers, messengers or social media) that operate in three or more member states and have more than 45 million monthly “end users” and 10'000 “business users”. Furthermore, such companies must have an annual turnover of over EUR 7.5 billion or at least EUR 75 billion of market capitalisation. The DMA will ban the combination of personal data between different services provided by the gatekeeper. Finally, the DMA establishes that the Commission can impose fines of up to 10% of the gatekeeper's total worldwide turnover in the preceding financial year, and up to 20% in case of repeated infringements.
Original sourceScope
Policy Area
Competition
Policy Instrument
Unilateral conduct regulation
Regulated Economic Activity
cross-cutting
Implementation Level
supranational
Government Branch
legislature
Government Body
parliament
Complete timeline of this policy change
Hide details
2020-12-15
under deliberation
2021-11-25
under deliberation
2021-12-15
under deliberation
2022-03-24
under deliberation
2022-07-05
under deliberation
2022-07-18
adopted
2022-11-01
in grace period
2023-05-02
in force
Key regulatory dimensions
Regulated subjects
The businesses, government agencies or individuals affected by this policy or regulatory change.
producer / supplier
1
Type
Private organisation
Economic activity
platform intermediary: e-commerce,platform intermediary: other,platform intermediary: user-generated content,search service provider,software provider: app stores,online advertising provider,other service provider,streaming service provider,messaging service provider,infrastructure provider: cloud computing, storage and databases,infrastructure provider: other,software provider: other software
Category
All
2
Type
Private organisation
Economic activity
cross-cutting
Category
All
3
Type
Private organisation
Economic activity
cross-cutting
Category
All
Policy change by business practice
The detailed activities within the scope of this policy or regulatory change.
personal data (all forms): data processing
Regulatory tool
Purpose/processing limitation
Prohibition of end-user contract limitations
Prohibition of targeted trading partner under-cutting or other discrimination
User consent: Opt-in requirement
Prohibition of supplementary contractual obligations
End user access requirement
Other corporate behavioural requirement
User or public reporting requirement
Redressal mechanism requirement
Complaint mechanism requirement
Prohibition on combining personal data with data obtained from other provided services
Prohibition on combining personal data with data obtained through third parties or business users
Sanctions
Fine
Regulated subjects
1 2 3
advertisement (any targeting): data processing
Regulatory tool
Prohibition of supplementary contractual obligations
End user access requirement
Other corporate behavioural requirement
User or public reporting requirement
Redressal mechanism requirement
Complaint mechanism requirement
Sanctions
Fine
Regulated subjects
1 2 3
advertisement (any targeting): monetisation (any form)
Regulatory tool
Prohibition of supplementary contractual obligations
End user access requirement
Other corporate behavioural requirement
User or public reporting requirement
Redressal mechanism requirement
Complaint mechanism requirement
Sanctions
Fine
Regulated subjects
1 2 3
service (digitally delivered): sale
Regulatory tool
Prohibition of supplementary contractual obligations
End user access requirement
Other corporate behavioural requirement
User or public reporting requirement
Redressal mechanism requirement
Complaint mechanism requirement
Sanctions
Fine
Regulated subjects
1 2 3
corporate data: advertising data: storage (any form)
Regulatory tool
End user access requirement
User or public reporting requirement
Redressal mechanism requirement
Complaint mechanism requirement
Sanctions
Fine
Regulated subjects
1 2 3
consumer data (all forms): storage (any form)
Regulatory tool
End user access requirement
Redressal mechanism requirement
Complaint mechanism requirement
Prohibition on combining personal data with data obtained from other provided services
Prohibition on combining personal data with data obtained through third parties or business users
Sanctions
Fine
Regulated subjects
1 2 3
algorithm: ML/AI optimisation algorithm incl. matching, ranking, sorting: operate
Regulatory tool
Prohibition of self-preferencing in algorithms or presentation
Redressal mechanism requirement
Complaint mechanism requirement
Sanctions
Fine
Regulated subjects
1 2 3