How to address the overlap between competition and data privacy laws? The EC and EDPB seek views

Is GDPR protection of personal data being undermined by the EU’s pro-competition data sharing obligations, or is the GDPR being used as a ‘shield’ to reduce the effectiveness of those rules? How should competition and data privacy authorities work together? And how are divergent approaches to data protection enforcement across Europe affecting competition? Last week, the European Data Protection Board (EDPB) and European Commission (EC) jointly held a half-day stakeholder event on the overlap between data privacy and competition law, which heard views on these questions. We attended this session with over 80 other participants from industry, academia and civil society. In this blog, we reflect on the discussions and on what we expect to see next.

Key discussion themes

A lack of regulatory coherence between the GDPR and the EU’s wider digital rulebook, particularly the Digital Markets Act (DMA), remains a major pain point for a wide range of organisations across the digital supply chain, including major and minor players, and both potential recipients and providers of information. Despite joint guidance from the EDPB and EC on the interaction between the DMA and the GDPR, issued over a year ago, key questions remain unresolved in practice. Areas of friction highlighted included the extent to which potential third-party recipients of data shared under the mandatory provisions of the DMA could or should be vetted for risks posed to the security of the personal data being transferred.

While discussion kept returning to the EU’s DMA regime, it was emphasised that data privacy issues also arise in the application of the EU’s antitrust rules, including in abuse of dominance enforcement (as seen in the regulatory scrutiny of Apple’s App Tracking Transparency approach) and in EU merger control, where accumulation of personal data may be seen as something entities compete on. It was also recognised that competition law relevant issues can impact a wide range of data privacy analyses. For example, where entities have significant market positions this can impact the analysis of whether data subject consent is freely given (such as in the context of ‘pay or consent’ cookie banners, discussed below) and the apportionment of controller and processor roles. It was discussed that a customer’s real-world control over personal data, for the purposes of controllership under the GDPR, could potentially be undermined where a major supplier dictates the terms of supply, e.g. by requiring the use of their own standard terms without negotiation.

There were extensive calls for greater collaboration and coordination between data protection and competition authorities in the EU to ensure consistency between their work products and therefore improve legal certainty for businesses. For example, attendees highlighted that the concept of ‘dominance’ plays an important role in the EDPB’s opinion on ‘pay or consent’ cookie mechanisms (discussed in our blog here), but without drawing sufficiently on guidance from competition law. On the other side, the “anonymisation” of personal data plays an important role in the sharing of search data under the DMA, yet the interpretation of “anonymisation” in DMA enforcement risks diverging from how it is understood under the GDPR. Attendees called for authorities to work more closely together to address these challenges, emphasising the importance of collaboration both at the guidance stage and in specific enforcement cases. Suggested forms of collaboration included joint sandboxes, formalised or semi-formalised relationships (equivalent to the UK’s Digital Regulation Cooperation Forum) or ad hoc involvement as and when needed.

Regulatory fragmentation and divergent enforcement by national data protection authorities (DPAs) in the EU were also cited as a key competition concern, particularly for those operating in the advertising and e-commerce space, with the French DPA singled out as an outlier. The French DPA has taken a hard line on cookies and other tracking technologies in recent years (as we discuss here) and, earlier this year, announced a €3.5 million fine against an unnamed company for sharing loyalty scheme data with a social media company to support targeted advertising. Some attendees noted this divergence in enforcement significantly undermines efforts to create a digital internal market. It will be interesting to see whether the EDPB’s new draft guidance on the imposition of fines, which aims to help harmonise DPAs’ approaches to deciding whether to issue GDPR fines, will help to address these concerns once finalised.

Next steps and outlook

The EDPB and EC are set to publish a written report on the stakeholder event, which should provide further insight into their key takeaways from the session. Following this, they will develop new draft guidance on the interaction between data privacy and competition law. This will be subject to public consultation, providing a second opportunity for stakeholders’ input. Although the EDPB has already published a position paper on this topic (discussed here), there is a clear need for further guidance in this area, and the EDPB’s work programme for 2026-2027 indicates that this will be prioritised by the Board.