EDPB Launches Comprehensive Market Study on Data Broker Practices

The European Data Protection Board (EDPB) has announced the launch of a comprehensive market study focused on data broker activities within the European Union. This initiative represents a significant step in the EDPB's ongoing efforts to strengthen data protection enforcement and address emerging challenges in the digital economy.

The study comes at a critical time as data brokerage has become an increasingly prominent component of the digital ecosystem. Data brokers, which collect, aggregate, and sell personal information from various sources, operate in a complex regulatory environment that often lacks transparency and clear oversight.

Scope and Objectives of the Market Study

The EDPB's market study will examine several key areas:

Data Collection Practices: The study will investigate how data brokers obtain personal information, including through public records, online tracking, purchase histories, and data partnerships with other companies.

Data Processing Activities: Researchers will analyze how collected data is processed, combined, and enriched to create detailed consumer profiles.

Compliance with GDPR: A central focus will be assessing how data broker operations align with the General Data Protection Regulation, particularly regarding lawful processing grounds, transparency requirements, and data subject rights.

Cross-border Data Flows: The study will examine international data transfers and the implications for EU data protection standards.

Market Structure: An analysis of the data broker industry's organization, including major players, market concentration, and business models.

Regulatory Context and Significance

This market study aligns with the EDPB's strategic priorities for 2023-2025, which emphasize addressing challenges posed by new technologies and complex data processing operations. The initiative also responds to growing concerns about:

• The opacity of data broker operations
• The potential for discrimination through profiling
• The accumulation of vast amounts of personal data without individuals' knowledge
• The difficulty for individuals to exercise their data protection rights

Methodology and Timeline

The EDPB plans to employ a mixed-methods approach, combining:

• Analysis of publicly available information and industry reports
• Surveys and questionnaires distributed to data brokers
• Case studies of specific data broker operations
• Consultation with data protection authorities across EU member states

While the EDPB has not announced a specific completion date, market studies of this scale typically require 12-18 months to complete, followed by a period for analysis and report preparation.

Expected Outcomes and Impact

The results of this study are expected to inform several key areas:

Guidance Development: The EDPB may issue new guidelines or interpretations of GDPR provisions specifically addressing data broker practices.

Enforcement Coordination: Findings will help harmonize enforcement actions across EU member states, ensuring consistent application of data protection rules.

Legislative Recommendations: The study may identify gaps in current legislation that require regulatory updates or new laws.

Industry Standards: Results could contribute to the development of industry codes of conduct or certification mechanisms for data brokers.

Implications for Businesses and Consumers

For businesses that work with data brokers or engage in similar data aggregation activities, the study's findings may necessitate operational changes to ensure compliance with evolving regulatory expectations.

Consumers can expect greater transparency about how their personal information is collected and used, along with strengthened mechanisms to control their data.

Related Regulatory Developments

This market study is part of a broader regulatory trend examining data-intensive business models. Similar investigations are underway in other jurisdictions, including:

• The UK Information Commissioner's Office (ICO) ongoing work on data broking
• US Federal Trade Commission scrutiny of data broker practices
• Various national-level investigations into specific data broker companies

The EDPB's study will likely influence these parallel efforts, contributing to a more coordinated global approach to regulating data brokerage.

How to Stay Informed

Stakeholders can follow the progress of this market study through the EDPB's official channels:

• EDPB website for announcements and publications
• EDPB plenary meetings where study progress may be discussed
• National data protection authority websites for member-state specific developments

As the study progresses, the EDPB has indicated it will provide opportunities for public consultation and stakeholder input, ensuring that the final recommendations reflect a broad range of perspectives and expertise.