At the Intersection of Competition and Data Protection Law

German Competition Authority imposes antitrust-based restrictions on Facebook’s collection and processing of user data

On 7 February 2019, the German Federal Cartel Office or Bundeskartellamt (the BKa) issued its decision in the Facebook case. The BKa decided that Facebook had abused its dominant position in the social networks market in Germany by requiring users – as a pre-condition to the use of Facebook – to consent to the linkage of their Instagram and/or Whatsapp data to their Facebook account, and to consent to the collection and use by Facebook of data generated when visiting other websites. Facebook is required to change its terms of service and must discontinue its infringing behaviour within twelve months. No fine was imposed.

Facebook collects user data not just from activity on its own website but also from a variety of other sources. These sources include on the one hand other Facebook-owned services, such as Instagram and WhatsApp, and on the other hand third-party websites which contain a “like” or “share” button, irrespective of whether the user clicks on or scrolls over the button. Moreover, Facebook even collects data from websites which do not carry any reference to Facebook, but use for example the “Facebook Analytics” service.

According to the BKa, requiring users of Facebook to consent to the collection of their data on third-party websites and to the linkage of their Instagram and/or Whatsapp data with their Facebook account, as a pre-condition for access to Facebook’s social media platform, is unfair and excessive. This behaviour is qualified as an abusive exploitation by Facebook of its dominant position in the market for social networks in Germany.

The BKa’s decision does not extend to the way in which Facebook collects user data on the Facebook platform itself. The BKa deliberately left data collection on Facebook’s own platform outside the scope of its investigation, based on the consideration that this data collection is clearly linked to a specific service provided by Facebook (i.e. a social network site) and that, in this case, users “know” that their personal data will be collected and used, because this is “an essential component of a social network and its data-based business model”.

The BKa’s decision requires Facebook to take the following remedial action: (i) assigning data from Whatsapp and Instagram accounts to a Facebook user account and (ii) collecting data from third-party sources and assigning them to a Facebook account will henceforth only be possible provided the users have given their ‘voluntary’ consent.

Voluntary consent implies that the use of Facebook’s social network site may not be made conditional on users consenting to the combination of data from other Facebook-owned applications and/or third party websites with their Facebook data. The obligation applies to all private Facebook users in Germany.

In the absence of voluntary consent, the possibility to combine data from these different data sources will need to be considerably restricted. Facebook has to develop a proposal to restrict such data processing (e.g. by imposing restrictions on the amount of data, the purpose of the use, additional control options for users, anonymization, limitations on data storage…) and submit it to the BKa within four months.

Requiring users to submit excessive amounts of data and/or merging significant data sets without voluntary consent from the data subjects can amount to an abuse of a dominant position.

This decision marks the first time a competition authority ruled on a privacy-related abuse of dominance.  It is also one of the rare findings of an exploitative abuse of dominance. Most abuse of dominance investigations focus on exclusionary abuses (i.e. abuses which can foreclose competitors) rather than on exploitative abuses (i.e. abuses which exploit market power to the detriment of customers). 

With 23 million daily active users and a market share of 95 percent, the BKa found that Facebook is dominant in the German market for social networks. The authority considers that services like LinkedIn, WhatsApp, YouTube, Snapchat, Instagram and Twitter, although they may compete with Facebook to some extent or with respect to specific features, are not part of the same relevant market because they mainly meet different consumer needs. The BKa also considered that no significant parallel use of different platforms could be established. Such “multi-homing” can generally have a countervailing effect against platform market power.

The BKa considers that in view of the data-driven business model of social media apps, the combination by Facebook of data sets from its different social media apps and the collection and use of data originating from third-party websites has contributed to strengthening Facebook’s market power.

The BKa qualifies the abuse as the imposition of unfair contractual terms and conditions. It considers that the European privacy and data protection rules can constitute a standard for the assessment whether Facebook’s terms are fair. The BKa however also suggests that Facebook’s practices have foreclosure effects on competitors “that are not able to amass such a treasure trove of data”.

In an initial reaction Facebook announced that it disagrees with the BKa’s conclusions and intends to appeal the decision. In particular, Facebook believes the BKa has overstepped its powers and misapplied the competition rules resulting in different rules depending on the size of the company.

In its decision, the BKa has taken what is essentially a data protection issue and qualified it as an exploitative abuse of dominance. This is also reflected in the remedy, i.e. the requirement of specific consent, which is basically what EU personal data protection law (as laid down in the GDPR) already requires. The only aspect of the remedies that appears to go beyond that is the prohibition on Facebook to make the use of its platform (deemed dominant) conditional on the processing of personal data gathered outside that platform, in a “take it or leave it” proposition.

The BKa’s approach appears to answer the European Data Protection Supervisor’s call in a 2016 paper for competition authorities (as well as consumer protection agencies) to break out of their “silos” and integrate the protection of citizens’ right to privacy (which is a fundamental right under EU law) in their enforcement priorities. The European Commission has so far, particularly in merger cases (including its assessment of the Facebook/WhatsApp decision, where it examined possible effects on the combination of WhatsApp data with Facebook data), consistently held the view that privacy-related concerns are outside the scope of competition law rules. However, recent statements from top Commission officials, including Commissioner Vestager, suggest that the Commission’s thinking may be evolving towards a greater willingness to take privacy-related concerns on board in competition law assessments.