During the 17th August meeting last week Google presented the following slide when explaining Associated sets.

Associated sets enabled domains owned by different organizations to share data within the web browser. This is compatible with GDPR and PECR, the "Applicable Data Protection Legislation" that Google agreed to be bound by in Google's commitments to the CMA. See the definition from the commitments which follows.

GDPR and PECR, as confirmed by the ICO and CMA in their May 2021 joint statement, has no concept of first and third party. See Box B from the statement which follows.

Associated sets is a very welcome development in the field of lawful data sharing between joint controllers and processors. Complexity can be reduced by removing other aspects of FPS in favor of a single Associated Sets proposal. The name can change.

However the restriction to 3 domains is not required under Applicable Data Protection Legislation. The number in any specification seeking to align to Applicable Data Protection Legislation is infinity.

The use of Standard Contractual Clauses (SCC) - already used in Google's other services (see [1]) - would enable people to consent to common SCCs that apply to data shared between multiple controllers and processors. Controller's A and B could use the same SCC in their privacy policy for data sharing within the web browser. People would consent to this SCC, controller's A and B would signal their compliance with the SCC, and the browser would safely enable data sharing between A and B, confident that people's expectations have been met. This concept is explained in the March 2022 proposed modification to FPS titled "GDPR Validated Sets".

@krgovind and Google are well aware of GVS and the concept of SCCs. Can they explain why they would not consider using this approach to enable Associated Sets in the revised version of FPS? If not answered here in this forum please provide your answer in the September quarterly report to the CMA and market.

[1] Screen shot of general marketing email sent to 51Degrees by Google on 15th August 2022.