Facebook and Google can implement a 500-page law.
A startup cannot.
So I think it's important to keep "How are we encouraging competition in the marketplace?" in mind as these proposals go through.
Not to put too fine a point on it, but letting marketplace needs influence who gets access to a user's data is how we got to this point in the first place. It's a separate discussion, and it needs to be kept separate. Besides, whatever people come up with in that regard, the commercial entities that want access to users' data can really have no reasonable objection to obtaining strict, explicit consent to access that data. With the concomitant legally binding and criminally enforceable rules attached.
Competition in the marketplace is good, but people are a society's priority. We can't lower the barriers to access on a user's private data in the name of, "this is good for business."
That's a reasonable position to take in the two joint discussions, but that's not "keeping the discussions separate", that's defining your priority and optimizing for it at the expense of other concerns. Dismissing those concerns because they are not important enough is fine, dismissing them as if they didn't belong to the discussion is dishonest.
I contest that the discussions are separable at all. The same regulation can be very good disregarding its effect as a barrier to entry, and very bad not disregarding it. Whether or not any particular regulation is good on net depends on pros and cons analysis that actually takes all relevant cons into account.
I'm okay with that. I worked on so many small e-commerce sites early in my career that just had a "CC" column in their user database, and it was all so sloppy and horrible. None of these would have been a big enough target for serious hacking, but also the security was never so good that an amateur couldn't walk off with 1,000 cards.
Now, payments are all handled by people who treat that data much more seriously. I certainly trust Stripe or Shopify over random web dev X.
If personal data starts being treated with that kind of care -- and the interoperability and exporting is also important -- I think that's only a good thing, even if it means that Google and facebook get a head start on that.
Just because a social network were build on open standards doesnt automatically invalidate a persons/platforms ability to permission their data.
It seems to me like there are two important issues currently. There's access to data, but there's also how influence works and who controls that. Right now, social media companies decide what rises to the top of your feed.
The current situation is that if you want to be part of the Facebook community (for lack of a better word), you need to let Facebook decide how you see that data. I could see an argument that some kind of federated system might allow different lenses where you could still communicate in a social media way but different things could rise to the top.
Anyway, the point is these two concerns seem to be at odds with each other. If you don't want one party to have the power they get from being the only party in charge of processing the data, then you need multiple parties to have access to the data.
The user being in control of access to his/her own data is not a concept that should frighten any legitimate business people. But businesses being in charge of access to a user's data is absolutely a concept that should frighten users. The power of determining access has to be shifted back to the user where it belongs. If some businesses that specialize in "data brokering" are harmed because users are suddenly able to choose to disallow them access, so be it.
Again, allowing businesses to influence and determine who gets to access a user's data is literally the reason we're in this predicament in the first place. Solve that stuff separately if you want, but under no circumstances can end runs around the user's ownership of their data be allowed.
Interoperability is better for companies, particularly small ones. But the idea here is to help people prevent companies from accessing their data willy nilly. I'd think the goal would be to decrease the number of access points and to require that strict, explicit, legally binding, criminally enforceable, consent be given for every access to a user's data.
If you want to help smaller companies compete, that's a different discussion that can be had. But securing the data of users and providing a great deal more privacy than user's have right now really is a completely reasonable effort in its own right. In fact, I would think for the vast majority of users, the effort to ensure security and privacy should probably take precedence over providing more companies potential access to their data.