Article 5(2) of the Digital Markets Act and the ‘pay-or-consent’ business model at the intersection of public and private autonomy*

Under Article 5(2) Digital Markets Act (DMA), ‘gatekeepers’ must not combine or cross-use personal data from core platform services with other datasets unless the user has granted consent under the General Data Protection Regulation (GDPR). At this interface between quasi-competition law and data protection, a multitude of fundamental rights and economic interests intersect, given that the two legal regimes pursue different objectives (fairness and contestability vs personal data protection). The article analyses whether Article 5(2) DMA succeeds in striking a balance between the rights and interests of users and businesses, or whether it unduly constricts the private rights of either party. Methodologically, the analysis is conducted against the backdrop of the dichotomy between private and public autonomy coined by Habermas. The article argues that autonomy interests are only sufficiently protected if it is possible to determine a price constituting an ‘equivalent alternative’ as stipulated by Article 5(2) DMA and its Recitals (36) and (37). If no adequate price-setting mechanism can be found, then GDPR and DMA create a position inconsistent with the principles of private and public autonomy and inappropriately restrict the commercial freedom of businesses and the autonomy of data subjects in commercialising their data.