The European Data Protection Board (EDPB) is actively engaging in the enforcement process of the Digital Markets Act (DMA), particularly concerning Article 6(11). This involvement means that if your business is subject to both the DMA and the General Data Protection Regulation (GDPR), you should integrate GDPR analysis into your DMA compliance efforts.
EDPB's Strategic Moves
The EDPB's recent publications highlight a strategic approach to managing overlapping regulations. Three key documents illustrate this:
- Comments on the European Commission's draft measures regarding Alphabet's compliance with Article 6(11) DMA, dated 05 May 2026, focusing on anonymisation and pseudonymisation.
- A Template for Cross-Regulatory Cooperation Agreements, dated 07 July 2026, emphasizing cooperation between authorities.
- A legal study on the interplay between the AMLD and GDPR, dated 01 August 2021, addressing financial matters.
These documents collectively demonstrate the EDPB's efforts to create a framework for managing overlapping regulatory regimes.
Key Insights
1. Direct Involvement in DMA Measures Data protection authorities are actively commenting on DMA specification measures. This means that a DMA obligation isn't automatically GDPR-compliant. Both need separate analyses.
2. Focus on Anonymisation and Pseudonymisation The EDPB's comments on Article 6(11) highlight the importance of distinguishing between anonymised and pseudonymised data. Pseudonymised data remains personal data under GDPR, and treating it as anonymous can lead to compliance issues.
3. Formalizing Cross-Regulatory Cooperation The EDPB is pushing for structured cooperation between different regulatory authorities. This aims to prevent conflicting instructions but requires effective implementation to avoid parallel scrutiny.
4. A Pattern of Regulatory Overlap The EDPB's previous work on AMLD and GDPR shows a pattern of addressing regulatory overlaps. The DMA and GDPR interaction is expected to follow similar challenges, with one framework requiring data handling that the other restricts.
Implications for Your Team
If you're advising a business under the DMA, you can't separate DMA compliance from privacy considerations. The EDPB's involvement means privacy analysis is integral to understanding DMA obligations.
Consider these questions:
- Is the data under the DMA obligation personal data? Aggregation or removal of identifiers doesn't automatically exempt it from GDPR.
- What is your legal basis for processing? A DMA obligation might justify processing under Article 6(1)(c) GDPR, but you must document this and ensure it doesn't exceed the obligation.
- Is valid consent maintained? New data sharing under DMA requires fresh consent, not reliance on previous records.
The risk of non-compliance stems from inconsistency. You might fulfill a DMA requirement that a data protection authority later deems unlawful, or vice versa. Documenting your reasoning for both is crucial.
Action Items
Immediate Steps
- Map DMA Obligations: Identify every DMA obligation involving personal data and flag those where data is shared externally.
- Classify Data Accurately: Determine if data is anonymised, pseudonymised, or identifiable, and document who made this determination.
- Review Consent Records: Ensure existing consent covers DMA-driven uses. If not, plan for re-consent.
Next Steps
- Establish a Joint Review Process: Require privacy and regulatory sign-off before implementing DMA compliance measures.
- Conduct Data Protection Impact Assessments: For large-scale data sharing, document your assessments and data protection strategies.
- Update Consent Notices: Ensure your consent notices reflect new data flows accurately.
Ongoing Tasks
- Monitor EDPB Publications: Stay updated on cross-regulatory interplay developments to anticipate coordination efforts.
- Maintain a Regulatory-Conflict Log: Document conflicts between DMA and GDPR obligations, your reasoning, and outcomes as evidence of compliance efforts.
