Post

Businesses have a *data advantage* which they need to protect. Allowing their providers to access that data in limited, controlled ways helps, but definitely not donating it to as many others as possible — which the omnibus pushes for. I've written about this before: berjon.com/competition-....

Instead of the omnibus's loosening of the rules that protect businesses' data advantage, which favours firms with enough market power to force others to give them data (you know who), my proposal has a series of measures to protect businesses against these depredations.

And the funny thing is: making the data economy better for businesses that aren't tech monopolies also brings better privacy to people. Anyone telling you it's a choice between the two has been snorting too much tech lobbying.

PROBLEM: The omnibus offers a solution against cookie banners but then makes it not apply to media sites. The net result is: 1) Publishers, who need the greatest protection from Google taking their data, are unprotected. 2) Media sites become even shittier by comparison, helping Apple News, etc.

SOLUTION: Remove the media exemption. Also tweak enough of the proposed ePrivacy terminal storage exemptions to make ad businesses possible (but not invasive) with the automated signal. I've long had a proposal for this: berjon.com/gpc-under-th...

PROBLEM: The omnibus doesn't actually simplify some things that could safely be simplified. GDPR compliance was part of my portfolio for 5 years at the @nytimes.com — and let me tell you: some parts of the GDPR are totally useless. They cost time and help no one. But those are still in?

SOLUTION: Well, just remove them. Or at least remove them for businesses that aren't too big. Sometimes simplification really is that simple.

PROBLEM: The omnibus massively worsens national security and online safety. A severe and largely ignored national security problem is ADINT (Advertising Intel). The pervasive surveillance developed for commercial purposes also has espionage (personal and corporate) and military applications.

I cite a whole bunch of cases, but just to provide a few here… This includes Iran using it to target US troops in the current war: www.lawfaremedia.org/article/iran...

Seeing it used directly in conflict like this may seem new, but it's not as if it hadn't been reported on as a threat before: www.wired.com/story/phone-...

It's not as if the same EU officials who are working to facilitate ADINT haven't been targeted as well: netzpolitik.org/2025/databro...

And it's not as if the ADINT threat only comes from foreign adversaries — it's also dangerous when a far right government uses it for roundup raids: www.404media.co/email/0ba0f6...

SOLUTION: Well, first, don't introduce changes that make this kind of data collection easier. Second, tighten up the rules so that data collection becomes primarily first party, make geo data and browser data (that Chrome collects) sensitive and better protected.

And finally… PROBLEM: Ireland. GDPR enforcement follows a business's residence. So if you're in Poland and Google violates the GDPR with your data, you have to seek recourse where Google is set up, which is Ireland (same for Meta, Microsoft, and many others).

In general, this makes sense. How the GDPR is applied varies significantly between countries (and don't get me started on Germany), and expecting most sizes of businesses to be able to handle several dozen DPAs is unrealistic. But Ireland uses this to be a data haven — like a tax haven, for data.

In exchange for massive tax income and investment from the MAGA companies, Ireland simply doesn't apply the GDPR. Or only applies it superficially, extremely slowly, when forced to by external pressure. Because the biggest surveillance companies are there, this harms 450 million Europeans.

It's also bad for European businesses: they have to play by the rules and compete with American businesses that don't. Of all the EU countries that could side with foreign authoritarian rule, I really wouldn't have thought it'd be Ireland. And yet here we are.

That’ll be historic. Ireland was utterly depressed for most of the 20th century until the 90s when lobbying from Irish expatriates in the USA seeking a place to stash their USD created Ireland’s tax haven status and the Celtic Tiger era followed. It also destroyed the country in 2008.

Half the TDs in power believe (wrongly) they can have that prosperity back again and will do absolutely anything the multinationals ask to make it happen. To be fair, said multinationals are propping up most of the national economy and EU Parliament kinda shuns us here out of proximity to UK.

Of course then there’s good old fashioned corruption and state capture. 🙄 View from the ground of average Irish person would agree on all things privacy, with the awareness that if big tech packs up and leaves here we are entirely and permanently screwed. Rapid regression to 3rd world screwed.

That’ll be the state capture aspect. We are deeply beholden to consultant culture here - we had a notional €65B surplus a couple of years ago that was supposed to go into a sovereign fund and that seems to have just disappeared. Major industry left would be bio/pharma production.

If history 2008-2016 is anything to go by, after a big tech pullout there’s austerity, spike in cost of living even as services and quality of life decline. Skilled jobs drop sharply and take a decade plus to recover. Then exodus of smart and qualified people, often to Australia, UK, USA.