Post

For context: Ireland is MAGA's primary beachhead in Europe. As indicated in the video, part of the proposal is that you would no longer need to consent to your personal data being used if it's for AI. The only companies this benefits are those with large existing surveillance systems: MAGA techs.

That's not the only issue: • The text is very favourable to tech monopolies and supports them against challengers. • It fails to simplify, even very obvious things. • The way in which it kills cookie banners is broken. • It directly undermines national security & online safety of vulnerable people.

I won't recap my entire proposal, but here are some highlights in presented in problem/solution pairs. PROBLEM: The omnibus has a broken theory of how the digital economy works. It follows the belief that there's a "data economy" and that the more data circulates, the more value is created.

SOLUTION: That's simply wrong. The value of circulating data depends on what the data refers to: • Gains from being shared (antirival): e.g. the rules of a game. • Neutral when shared (nonrival): e.g. a factoid. • Loses when shared (rival): e.g. purchase intentions, product behaviour.

In most cases in the digital economy, a consumer-facing business sharing data with other parties is *losing* value in the process. This is particularly true of advertising businesses sharing with competitors like Google or Meta. Hot tip: sharing a business asset with competitors is bad, actually.

Businesses have a *data advantage* which they need to protect. Allowing their providers to access that data in limited, controlled ways helps, but definitely not donating it to as many others as possible — which the omnibus pushes for. I've written about this before: berjon.com/competition-....

Instead of the omnibus's loosening of the rules that protect businesses' data advantage, which favours firms with enough market power to force others to give them data (you know who), my proposal has a series of measures to protect businesses against these depredations.

And the funny thing is: making the data economy better for businesses that aren't tech monopolies also brings better privacy to people. Anyone telling you it's a choice between the two has been snorting too much tech lobbying.

PROBLEM: The omnibus offers a solution against cookie banners but then makes it not apply to media sites. The net result is: 1) Publishers, who need the greatest protection from Google taking their data, are unprotected. 2) Media sites become even shittier by comparison, helping Apple News, etc.

SOLUTION: Remove the media exemption. Also tweak enough of the proposed ePrivacy terminal storage exemptions to make ad businesses possible (but not invasive) with the automated signal. I've long had a proposal for this: berjon.com/gpc-under-th...

PROBLEM: The omnibus doesn't actually simplify some things that could safely be simplified. GDPR compliance was part of my portfolio for 5 years at the @nytimes.com — and let me tell you: some parts of the GDPR are totally useless. They cost time and help no one. But those are still in?

SOLUTION: Well, just remove them. Or at least remove them for businesses that aren't too big. Sometimes simplification really is that simple.

PROBLEM: The omnibus massively worsens national security and online safety. A severe and largely ignored national security problem is ADINT (Advertising Intel). The pervasive surveillance developed for commercial purposes also has espionage (personal and corporate) and military applications.

I cite a whole bunch of cases, but just to provide a few here… This includes Iran using it to target US troops in the current war: www.lawfaremedia.org/article/iran...

Seeing it used directly in conflict like this may seem new, but it's not as if it hadn't been reported on as a threat before: www.wired.com/story/phone-...

It's not as if the same EU officials who are working to facilitate ADINT haven't been targeted as well: netzpolitik.org/2025/databro...

And it's not as if the ADINT threat only comes from foreign adversaries — it's also dangerous when a far right government uses it for roundup raids: www.404media.co/email/0ba0f6...

SOLUTION: Well, first, don't introduce changes that make this kind of data collection easier. Second, tighten up the rules so that data collection becomes primarily first party, make geo data and browser data (that Chrome collects) sensitive and better protected.

And finally… PROBLEM: Ireland. GDPR enforcement follows a business's residence. So if you're in Poland and Google violates the GDPR with your data, you have to seek recourse where Google is set up, which is Ireland (same for Meta, Microsoft, and many others).

In general, this makes sense. How the GDPR is applied varies significantly between countries (and don't get me started on Germany), and expecting most sizes of businesses to be able to handle several dozen DPAs is unrealistic. But Ireland uses this to be a data haven — like a tax haven, for data.

It's also bad for European businesses: they have to play by the rules and compete with American businesses that don't. Of all the EU countries that could side with foreign authoritarian rule, I really wouldn't have thought it'd be Ireland. And yet here we are.

That’ll be historic. Ireland was utterly depressed for most of the 20th century until the 90s when lobbying from Irish expatriates in the USA seeking a place to stash their USD created Ireland’s tax haven status and the Celtic Tiger era followed. It also destroyed the country in 2008.

Half the TDs in power believe (wrongly) they can have that prosperity back again and will do absolutely anything the multinationals ask to make it happen. To be fair, said multinationals are propping up most of the national economy and EU Parliament kinda shuns us here out of proximity to UK.

SOLUTION: The very biggest companies can afford to deal with a lot of data authorities. So I introduce a Very Large Data Controller regime, modelled after DSA/DMA. The VLDCs, in addition to stricter controls over how they process data, have the GDPR applied in the jurisdiction of the data subject.

So if you're French, it's the CNIL that's the competent authority for to Google, Meta, Microsoft, Amazon, etc. No need to pressure Ireland: since they don't want to apply the law they simply don't get to (except for Irish residents).