digital economy regulation

This edition features stories about the European Parliament rapporteur’s proposed changes to the framework for high-risk suppliers under the Cybersecurity Act 2 (CSA2) and the proposal amending the directive on measures for a high common level of cybersecurity across the EU (NIS2); an event discussing how the Digital Markets Act and existing competition rules can address generative AI and AI assistants; a consultation on guidelines from the European Data Protection Board (EDPB) on data protection authorities' powers to impose fines under the GDPR; EDPB guidelines on the interplay between the Digital Services Act and the GDPR; and the first stakeholder meeting of the Media Board. It also lists events taking place this week.

The rapporteur would require that national measures going beyond new EU rules covering the same risk-management requirements cease to apply one year after the EU rules take effect. The European Commission would have to deliver guidance on the consistent application of key aspects of the directive on measures for a high common level of cybersecurity across the EU (NIS2), including when security audits may be required.

Artificial intelligence (AI) policy in the Caribbean remains at an early and uneven stage. Some countries are developing strategies, institutions and readiness assessments, while others have no specific AI policy. Only Cuba and the Dominican Republic have adopted national AI strategies, although neither policy document allocates a specific amount of public investment to AI.

While the Digital Markets Act was not specifically designed for AI, it can address AI-related competition concerns that arise from the types of digital platform bottlenecks and gatekeeper practices already targeted by the regulation. These include, for example, barriers to the distribution of alternative products and services. For other concerns, such as the use of publishers’ content for AI services, the enforcement of general antitrust rules plays an important role.

Markéta Gregorová (Greens, Czechia) suggested that the European Commission’s identification of high-risk suppliers (HRS) under the proposed Cybersecurity Act 2 be based on “specific and substantiated evidence”, without requiring a previous, separate designation of a high-risk country. The rapporteur proposed a two-year deadline for phasing out HRS equipment from all telecom networks, following the HRS identification. The Commission proposal would set a three-year deadline for mobile networks, while the deadlines for fixed and satellite would be determined by the Commission at a later stage. Ms Gregorová would open the door to compensating telecoms operators and other entities subject to phase-out requirements if they cause a disproportionate burden. This is not foreseen under the Commission proposal.

The Advocate General of the Court of Justice of the EU considered that consent to direct marketing by a company's “partners” is valid only if individuals are informed of the partners’ identities when giving consent. If this is not the case, such partners must obtain fresh consent to lawfully process the individuals’ personal data for direct marketing purposes.