Thread · 3 tweets · 22 May 2019

Only the first party should be a controller (with perhaps very rare and purpose-limited exemptions), joint controllership should die a fiery death unless there is unmistakable cobranding, the cases in which consent can be relied upon should be stringently limited.

At least a summary of DPIA and LIA should be public. User agents (operating system, browser) should exist in the framework with specific obligations. Location data should be sensitive at least at some degree of precision.

Tougher rules should kick in at a given level of industry concentration (measured eg. by HHI) to account for lack of user alternatives. Using the sentence "transparency and choice" seriously should lead to jail time.