Emergence of the ‘Neo-Brandeisians’

Thus, matters unfolded until the curtain began to descend on the second Obama term in 2016. In the midst of presidential primary season, a targeted political challenge to the prevailing economic approach to antitrust first came to light. No one has yet clearly identified who was doing the targeting, but the March 26, 2016 edition of The Economist magazine included an article that suggested U.S. firms were earning excessive profits because new entry was blocked by monopoly abuses and by “lobbying” to obstruct competition. The Economist suggested scrutiny of U.S. antitrust policy as one item on a broad list of suggested remedies.

Read the full piece here.

With the European Commission’s recent announcement that it had deemed the revamped data-protection framework from the United States to be “adequate” under the European Union’s stringent General Data Protection Regulation (GDPR), the stage is set for what promises to be a legal rollercoaster in the European Court of Justice (CJEU). The Commission’s decision is certain to be challenged, and the CJEU’s ultimate decision in that case has the potential to shape transatlantic relations and global data governance for years to come.

Read the full piece here.

What is anonymity? Do we have a right to it? And against what other values should this right be balanced when it comes to government regulation? This blog post will be the first in a series that looks at what anonymity is, why it is important, and what tradeoffs should be considered when applying a right to anonymity in specific contexts.

Read the full piece here.

Abstract

Consumer welfare has been a north star of the Federal Trade Commission (FTC), providing an organizing principle for diverse issues under the Commission’s dual competition and consumer protection missions and, specifically, a uniform ground on which to examine the law and economics of privacy matters and the tradeoffs that privacy policies entail. This paper provides the first contemporary literature synthesis by former FTC staff that brings together the legal and economics literatures on privacy. Our observations are the following: (a) privacy is a complex subject, not a simple attribute of goods and services or a simple state of affairs; (b) privacy policies entail complex tradeoffs for and across individuals; (c) the economic literature finds diverse effects, both intended and unintended, of privacy policies, including on competition and innovation; (d) while there is diverse and growing evidence of the costs of privacy policies, countervailing benefits have been understudied and, as of yet, empirical evidence of such benefits remains slight; and (e) observed costs associated with omnibus policies suggest caution regarding one-size-fits-all regulation.

I had thought we were in the dog days of summer, but the Farmer’s Almanac tells me that I was wrong about that. It turns out that the phrase refers to certain specific dates on the calendar, not just to the hot and steamy days that descend on the nation’s capital in . . . well, whenever they do (and not just before Labor Day, that’s for sure). The true dog days, it turns out, are July 3-Aug. 11, no matter the weather. So maybe this is just the cat’s tuches of summer, as if that makes it better.

Read the full piece here.

Abstract

Depending on implementation details, the EU Digital Markets Act (DMA) may have negative consequences regarding information privacy and security. The DMA’s interoperability mandates are a chief example of this problem. Some of the DMA’s provisions that pose risks to privacy and to the protection of personal data are accompanied either by no explicit safeguards or by insufficient safeguards. The question is then: how to interpret the DMA consistently with Articles 7-8 of the EU Charter of Fundamental Rights which ground the rights to privacy and the protection of personal data? Using the example of the prohibition on restricting users from switching and subscribing to third-party software and services (Article 6(6) DMA), I show that Charter-compatible interpretation of the DMA may depart from the intentions of the DMA’s drafters and even be perceived by some as significantly limiting the effectiveness of the DMA’s primary tools. However, given that—unlike the GDPR—the Charter takes precedence over a mere regulation like the DMA, such policy objections may have limited legal import. Thus, the true legal norms (legal content) of the DMA may be different than what a superficial reading of the text could suggest or, indeed, what the drafters hoped to achieve.

The Norwegian Data Protection Authority (DPA) on July 14 imposed a temporary three-month ban on “behavioural advertising” on Facebook and Instagram to users based in Norway. The decision relied on the “urgency procedure” under the General Data Protection Regulation (GDPR), which exceptionally allows direct regulatory interventions by other national authorities than the authority of the country where the business is registered (here: Ireland).

My initial view of the decision is that it is both a misuse of the urgency procedure and mischaracterizes the leading judgment from the EU Court of Justice (CJEU) on which it purports to rely (see my analysis of that judgment: part 1 and part 2). The decision misses the critical legal issue that it’s unclear to what extent the CJEU’s analysis applies to first-party personal data (collected by Facebook and Instagram) as the Court’s judgment expressly covered third-party data (collected “off-platform”).

Read the full piece here.

Among the regulatory tools created by the European Union’s Digital Markets Act (DMA)—landmark competition legislation that took effect across the EU last November—is a mandate that the largest digital-messaging services must be made interoperable. In the name of promoting fairness in digital markets, these gatekeeper services are asked to allow external services to connect with them, enabling new and smaller players to compete.

Read the full piece here.

Yesterday, I delved into the recent judgment in the Meta case (Case C-252/21) from the Court of Justice of the European Union (CJEU). I gave a preliminary analysis of the court’s view on some of the complexities surrounding the processing of personal data for personalized advertising under the GDPR, focusing on three lawful bases for data processing: contractual necessity, legitimate interests, and consent. I emphasized the importance of a nuanced understanding of the CJEU decision and pointed out that the decision does not determine definitively whether Meta can rely on legitimate interests or fall back on user consent for personalized advertising.

Read the full piece here.