When it comes to the governance and regulation of data markets and technologies, there are multiple regulatory regimes that can and do come into play. In the digital economy, rather than just being a by-product of using online services, (personal) data frequently acts as a currency and can also be seen as a tradeable commodity and asset for developing new or improving existing products, like more relevant search results or better targeted ads. In this vein, access to data on individuals could be considered essential for the market position of a company and it is therefore unsurprising that the acquisition and commercial use of (personal) data has increasingly been catching the eye of competition authorities.
The German federal competition authority, Bundeskartellamt, delved into the business model of Facebook, which is built on offering, on one hand, a free social networking service to individual users. and space for targeted ads to advertisers on the other. Following an investigation that started in March 2016, on 7 February 2019 Bundeskartellamt issued a decision stating that Facebook abuses its position on the market for social networks, where it was found to be dominant, and forbidding it from combining user data from different sources. This was the first case where the processing of personal data was considered in the context of abuse of dominance under competition rules.
Data as decisive factor for competition
The competition issues in question stem from the way and extent to which Facebook collects, uses, and merges data in its users’ accounts. Namely, the decision does not concern the processing of data generated from using Facebook’s own website (first-party data), but rather the collecting of data from third-party sources outside the social network and attributing it to individual users’ accounts. Such collection takes place via the embedded “like” or “share” buttons or Facebook analytics tools on other websites or apps, sometimes without an obvious sign that Facebook is present on the site, or through other Facebook-owned services, like Instagram or WhatsApp. In this way, Facebook is able to build from the combination of data sources detailed profiles of its users (and even non-users), who are likely unaware of this massive background data collection and pooling. The competition authority stressed that users cannot expect data that is generated using services other than Facebook to be added to their Facebook account. Further, Bundeskartellamt took note that Facebook users’ only choice is either accepting this comprehensive tracking and compiling of their data or refraining from using the social network altogether, which “cannot be referred to as voluntary consent”.
So, how has Facebook’s conduct amounted to an abuse of dominant position on the market? Firstly, negative impact or harm for users was found to be in the loss of control over how the data are used and combined and for which purposes. Secondly, Facebook could leverage the user “lock in” effects to the detriment of its competitors, who would not be able to amass the data to the same extent, and, based on the profiles created, improve its advertising services, hence becoming more and more indispensable. When a company with significant market power, for example, imposes unfair prices or unfair business terms and thus exploits consumers, this could be characterised as an exploitative abuse of dominance. Working in close contact with the relevant data protection authority and consumer associations, in the Facebook case, Bundeskartellamt relied on and took into account the applicable data protection rules that provided “normative guidance”, finding that Facebook’s terms of service and the way and the extent to which it collects and uses data are to the disadvantage of its users, “against the European data protection laws”, and thus established the infringement of competition rules. What the relationship is between finding a violation of data protection rules and establishing an infringement of competition law is a discussion that is, unfortunately, beyond the scope of this post.
Following the Bundeskartellamt’s decision, which affects only private Facebook users based in Germany – but might, nevertheless, have wider implications – Facebook is required to change its terms of service that are imposed on consumers and propose a technical solution regarding third-party tracking for users to opt out; the social network service provider may only combine and, in the case of tracking users across the internet, collect data from third parties and assign them to a Facebook user account if users voluntarily consent. This is intended to re-establish procompetitive conditions on the market. However, as the decision is not yet final, the tech giant has a month to appeal to the court, which Facebook already said it intends to do.
Competition and data justice, hand in hand?
From the data justice perspective, web tracking is problematic due to numerous reasons that could also be relevant in the context of appraising competition concerns. That is, third-party tracking across the internet may act disruptively to normal competition by way of data concentration, excessive data collection, and resulting exploitation; issues that were addressed, for example, in the Microsoft/LinkedIn merger. Online tracking can also threaten consumers’ privacy; yet, the processing of personal data and related privacy concerns traditionally do not fall within the scope of competition law, but under the data protection framework, as was underlined in the European Commission decision clearing the Facebook-WhatsApp merger and in the Asnef-Equifax ruling of the European Court of Justice.
As is evident, however, several competition enforcers across Europe, most notably in Germany and France, have started to explore possible competition issues related to collecting, accumulating, and using (personal) data in firms’ business models. To recall, as data processing is an entrepreneurial activity with importance for the competitiveness of a company, privacy and data protection considerations could be – and were – brought under competition rules in order to assess their impact on competition where data serve as the main input for the company’s products. This is even more relevant in situations of asymmetry between the user and the provider; privacy aspects could in this light be considered a dimension of the product’s quality in the competition assessment, or, as indeed decided in the Facebook case at hand, understood as exploitative abuse.
While it is undisputable that competition law and the emerging global data justice regime each have their own independent objectives, it appears that in addressing the harms resulting from the business model of web trackers, they could act as mutually reinforcing, at least to a certain extent, with competition law and enforcement adding “an important layer of protection against exploitative third-party tracking”. Following how far-reaching the impact of the Bundeskartellamt decision will be will certainly be very interesting – and pertinent.
