The German Federal Cartel Office (BKartA) has imposed drastic restrictions on Facebook with regard to the processing of user data in a highly anticipated decision. On February 7, 2019, the BKartA issued a Press release and a Background paper reported on the decision (as well as on December 17, 2017 on the ongoing proceedings in the context of a Background paper). The decision is remarkable for its novel combination of data protection law and antitrust law standards for data processing by dominant companies in digital markets. However, the last word has not yet been spoken. Facebook has already announcedThe company has decided to appeal the decision to the Düsseldorf Higher Regional Court. It remains to be seen whether the appellate courts will approve the extensive use of data protection arguments to establish an abuse of a dominant position, or whether they will make a course correction.
Initial situation
According to Facebook’s terms and conditions, users can currently only use the social network on the condition that Facebook also collects data about the user on the Internet or on smartphone apps outside of the Facebook site and assigns it to the Facebook user account. Specifically, Facebook grants itself the right to merge all data collected on (i) Facebook itself, (ii) the Group’s own services such as WhatsApp and Instagram, and (iii) the data collected on third-party websites with the Facebook user account.
Order of the BKartA
The BKartA has issued the following orders to Facebook for Germany, but without additionally issuing direct sanctions:
The Office’s decision covers several data sources:
- In the future, the services belonging to the Facebook group like WhatsApp and Instagram continue to collect the data. However, an assignment of the data to the user account at Facebook is only possible with the voluntary consent of the user. If consent is not given, the data must remain with the other services and may not be processed in combination with the Facebook data.
- A collection and Allocation of data from third party websites to the Facebook user account will also only be possible in the future if the user voluntarily consents to the assignment to the Facebook user account.
If there is a lack of consent for the data from the Group’s own services and third-party websites, Facebook can only collect the data in a very restricted manner and assign it to the user account. Facebook must develop appropriate solutions for this and submit them to the Office.
In the words of its president Andreas Mundt, the BKartA is thus taking on a “internal unbundling” of the data processed by Facebook.
Legal argumentation of the BKartA
a) Market dominance in the social networking market
According to the BKartA’s findings, Facebook takes a leading position in Germany on the Social network market a dominant position a. As far as can be seen, the BKartA defines the market narrowly by classifying services such as LinkedIn and Twitter in particular as not belonging to the same market. Accordingly, Facebook has a market share of over 90% on the relevant market.
The BKartA then emphasizes in the context of its examination of the abuse of a dominant position pursuant to Section 19 GWB the “special obligations under antitrust law“This is a formulation that is also familiar in the context of proceedings under Art. 102 TFEU and Art. 7 KG, as the special responsibility of market-dominant companies is referred to in constant practice (“special responsibility”, for the first time in ECJ decision i.S. Michelin from the year 1983).
b) Merging of data as an abuse of exploitation
The BKartA goes on to say that users had no choice but to either accept Facebook’s extensive use of data or to refrain from using the network. The obligatory ticking of a box for consent to Facebook’s terms of use is not a sufficient basis for such extensive data use in this initial situation. According to the BKartA, the following is particularly problematic Unlimited merging of data of the original Facebook website with data from the Group’s own services such as Instagram and WhatsApp, as well as from third-party sites that are equipped with interfaces (e.g. Like or Share button). Simply calling up such third-party sites leads to a flow of data to Facebook. Most users are not even aware of this. This comprehensive data aggregation allows Facebook to create very precise user profiles.
The BKartA specifically examines whether a Exploitation Abuse according to the reading of antitrust law pursuant to Section 19 (2) GWB. Market-dominant companies behave abusively, among other things, if they exploit the market opponent – in this case, consumers as Facebook users – by charging excessive prices or by means of unreasonable contractual terms and conditions (socalled “unfair competition”). Abuse of conditions). In the view of the BKartA, this applies in particular to
[…] if, at the same time, exploitation also hampers competitors who cannot accumulate such a treasure trove of data.
c) GDPR as a yardstick for exploitation facts
It is interesting and possibly groundbreaking that the BKartA, in a next step, will be Provisions of the GDPR as a benchmark takes for the assessment of whether there is an abuse of a dominant position under antitrust law. The reliance on provisions from other laws for the determination of an abuse of a dominant position is not new in principle, but here for the first time with regard to the provisions of data protection and the GDPR in particular. In its press release, the BKartA emphasizes that under the German ARC also Fundamental law and other legal value decisions, including from civil law, such as the law on general terms and conditionsThe following table shows the effects of the new rules on the control of abusive practices under antitrust law:
In such proceedings, the application of the provisions of European abuse control [pursuant to Art. 102 TFEU] is always an option. Such abuse proceedings against Facebook would also be possible in principle under the corresponding intervention standard of Art. 102 TFEU. However, so far only in Germany has a supreme court case law developed in which fundamental rights or other legal value decisions – in this case data protection – can also be taken into account for the abusiveness of the conduct of a market dominator. However, due to the cross-border significance of the proceedings, the Bundeskartellamt closely coordinated with both the European Commission and other foreign competition authorities during the proceedings.
The BKartA further argues that antitrust law and data protection law pursue an aligned purpose in the area of abuse of conditions by stating in its background paper:
After all, the purpose of data protection law is also to protect the data subject from unjustified data processing of his or her personal data by the market counterparty.”
Specifically, the BKartA, apparently in close exchange with data protection authorities (although it remains unclear exactly with which ones), is examining whether the Data processing by Facebook is justified under the GDPR. This refers to an examination of the lawfulness of the data processing pursuant to Art. 6 DSGVO, even if the BKartA does not directly refer to this provision in the published documents. The BKartA comes to the conclusion that
- the data processing is neither necessary for the performance of the contract (cf. Art. 6 para. 1 lit. b DSGVO),
- nor an overriding legitimate interest of Facebook in the processing of the data (cf. Art. 6 (1) (f) DSGVO), and
- also No valid consent The data subject’s consent to the data processing in question (cf. Art. 6 (1) (a) of the GDPR), as in particular no voluntary consent was given. Valid consent could only have been affirmed if the use of the original Facebook website had not been made dependent on the granting of consent to the comprehensive use of data.
The BKartA qualified Facebook’s terms of use and the type and scope of data collection and use as contrary to data protection and at the same time as an exploitative abuse contrary to antitrust law. It requires a far-reaching “internal unbundling” of the data processed by Facebook (see above regarding the orders of the BKartA). Sanctions were not imposed in these proceedings, as the BKartA conducted the investigation as part of administrative proceedings (and not in fine proceedings). As mentioned at the beginning, Facebook has already announced that it will appeal the decision.
Critical Appraisal and Parallels to Swiss Antitrust Law
The counterpart to the abuse of conditions under the German ARC is laid down in Swiss antitrust law in Art. 7 para. 2 lit. c KG, according to which the Enforcing unreasonable prices or other unreasonable terms and conditions. by market-dominant companies qualifies as abusive conduct. There is only very sparse practice on exploitative abuse in Switzerland. By far the majority of cases concern so-called predatory pricing, which does not involve exploitation of the market opponent, but rather the question of whether other market participants are abusively forced out of the market. This makes sense, since the Purpose of Swiss antitrust law in the protection of effective competition and not in consumer protection or data protection. Questions relating to fairness and data protection law therefore do not, in principle, fall within the remit of the competition authorities.
An excessive examination of data protection violations by competition authorities is therefore questionable and opens a Pandora’s box: It is unclear what standard should be applied for the examination of whether a violation of data protection provisions qualifies as an abuse of a dominant position. In any case, it is not acceptable to consider every data protection violation by a market-dominant company as a violation of antitrust law. In the case of abuse of exploitation, the prevailing doctrine is a Causal link The German Federal Ministry of Justice requires a distinction to be made between the enforcement of unreasonable terms and conditions (such as the terms and conditions of use that violate data protection) and market dominance. An abuse of exploitation therefore only exists if a company exploits its dominant position in the market to obtain business advantages from its customers, that it would not have been able to implement without market power and with functioning competition. The decisive factor is therefore how Facebook would have behaved if it were not dominant. How would companies in a competitive comparative market process and aggregate user data? It is questionable whether companies would have behaved differently in a competitive comparative market. It is still open at the moment how intensively the BKartA has dealt with these points.
Little is known so far about the specific review of the terms of use by the BKartA. The BKartA is apparently examining the grounds for justification that we know from Art. 6 DSGVO. However, it probably assesses these from an antitrust law perspective and not necessarily in the same way as a data protection authority would. In particular, it would be interesting to know which Role the market power of Facebook had for the assessment of the justification according to Art. 6 DSGVO. In the literature on data protection law, the Market position of the data processor and the power imbalance between the data controller on the one hand and the data subject on the other hand classified as a relevant factor in particular for the assessment of the voluntariness of consent within the meaning of Art. 6(1)(a) GDPR (so in particular Ingold, Art. 7 GDPR N 27, in: Sydow [ed. ], Europäische Datenschutzgrundverordnung, Handkommentar, Baden-Baden 2017; Schultz, Art. 7 GDPR N 19 f. and 24, in: Gola [ed.], DS-GVO, Kommentar, Munich 2017). In this respect, the assessment of the legal ground for data processing under the GDPR and the facts of exploitative abuse under antitrust law is based on a similar trade-off as a basis. As is well known, the GDPR is largely aimed at curbing the unrestricted and non-transparent use of data by technology giants. It is intended to give citizens more control over their personal data.
The interplay between data protection and competition law in the age of Big Data and data mining, with the power imbalances and information asymmetries that are typical of this, has preoccupied European supervisory authorities for several years. Based on a decision of the European Parliament in March 2017, in particular the Digital Clearinghouse a voluntary network of data protection, consumer protection and competition authorities, which meets at regular intervals to discuss current regulatory issues. The BKartA’s decision is a further step in the direction of convergence of these areas of law, albeit limited to Germany and subject to any course correction by the appellate courts.