Digital traces left behind our internet use offer a detailed insight into our preferences and identity. These data are collected by companies in a manner often invisible to users and the profiles created based on them can be useful to advertisers, to serve us more targeted ads, for example. The questions that these practices raise are normally within the remit of data protection rules. Following the Facebook case in Germany, there is some more clarity whether such pervasive online tracking could also be dealt with, from an enforcement perspective, under the existing competition policy framework, particularly since data and privacy could be seen as factors of competition in the digital economy; for the time being and following from recent developments, it seems the answer is: not really.
German competition authority goes after Facebook, gets blocked
Earlier this year, the German federal competition authority, Bundeskartellamt, issued a decision which stated that Facebook abused its dominant position on the market for social networks by way of its data collection practices. The decision concerned the tech giant’s pooling and combining of users’ data from third-party sources, for example by using the ‘like’ or ‘share’ buttons or through its other services like Instagram or WhatsApp. The competition authority assessed that, in such situations, users cannot expect such data to be added to their Facebook data profiles. Bundeskartellamt found that the company’s terms of service and such data collection and use are against European data protection legislation regarding consent and established an infringement of competition rules. The competition authority attempted to carry out an “internal divestiture of Facebook’s data”; pursuant to the decision, Facebook was to change its terms of service as regards the users in Germany and implement a technical solution that would allow its users to opt out of third-party tracking and combining all data in their Facebook account.
After the decision was published, Facebook expressed its disagreement with it, saying its practices are GDPR compliant. Further, it noted that “the GDPR specifically empowers data protection regulators – not competition authorities – to determine whether companies are living up to their responsibilities”; in the light of the EU-wide harmonized rules, it claimed, the “Bundeskartellamt’s order… [provides] different rights to people based on the size of the companies they do business with”. Facebook appealed; at the end of August, the Higher Regional Court in Düsseldorf indeed suspended the decision at hand. This now means the largest social networking platform does not need to apply the restrictions placed upon its data collection and combining practices by the competition authority, “for the time being”, until the decision is final.
Among other matters, the regional court said it has serious doubts as regards the legal basis for the Bundeskartellamt’s decision; it apparently did not accept that the violations of the rules in one regime would at the same time be instrumental in finding an infringement in another. The court also stated that Facebook users decide autonomously about (not) consenting to its terms of service and did not see the users as being exploited, since they can and do make the same data available to other companies as well.
What now?
A win for Facebook (who, during the summer, also settled with the US regulator over its privacy practices), this seems to be a hard hit to the German competition authority and its attempt to apply competition law in a way that is more responsive to market reality shaped by big tech. Nonetheless, Bundeskartellamt has already announced that it will appeal the regional court’s decision to the Federal Court of Justice, Germany’s highest court. As it often goes with court proceedings, getting matters clarified will take time. Also, the outcomes of the litigation might not provide all the guidance that is urgently needed on regulating online tracking technologies and data collection and use in a more comprehensive way.
On the EU level, in February, after the Bundeskartellamt’s decision, the European Commission commented that at that time, there was no European case regarding the company’s market power. Still, Facebook’s practices remain on their radar, as the Commissioner (currently still) responsible for the competition portfolio, Margrethe Vestager, did not rule out a Facebook case in the future. Following the European elections in May, the new European Commission is just being formed; in it, Vestager was actually appointed the executive vice president with a task to keep Europe “fit for the digital age” and to continue her work as the Commissioner for competition. Some speculate this signals the EU wants to bring its regulatory powers closer together in the areas considered as rather separate, like competition and data protection laws; whether this is the case and how the EU’s approach will further evolve in practice, should be known soon enough. (In fact, Vestager said just a few days ago that “what we need is not more competition enforcement. We need regulation.” She continued that “we may also need broader rules to make sure that the way companies collect and use data doesn’t harm the fundamental values of our society.”)
In terms of competition issues, Facebook is not the only tech giant facing increased scrutiny at the moment; in the US, Google is the subject of an antitrust investigation by 50 US states and territories over its market dominance and, among other concerns, data collection practices, after already being fined by the EU regulator on several occasions in cases related to other aspects of the digital economy, like online advertising or search engines.
That data protection and competition are in fact importantly intertwined was also recently revealed by a niche web browser Brave, which found that Google is apparently secretly using hidden web pages to feed its users’ data to advertisers, in circumvention of its own policies and the GDPR. Some commented that such granular data could be of significant competitive advantage to Google over its digital advertising competitors.
These developments indicate that it is high time for policy level clarifications on how to address these challenges and develop a more apt regulatory approach to data-driven big tech.
