Face­book deci­si­on by the Ger­man Federal Car­tel Office on user data

The Ger­man Federal Car­tel Office (BKar­tA) has impo­sed dra­stic restric­tions on Face­book with regard to the pro­ces­sing of user data in a high­ly anti­ci­pa­ted deci­si­on. On Febru­a­ry 7, 2019, the BKar­tA issued a Press release and a Back­ground paper repor­ted on the deci­si­on (as well as on Decem­ber 17, 2017 on the ongo­ing pro­ce­e­dings in the con­text of a Back­ground paper). The deci­si­on is remar­kab­le for its novel com­bi­na­ti­on of data pro­tec­tion law and anti­trust law stan­dards for data pro­ces­sing by domi­nant com­pa­nies in digi­tal mar­kets. Howe­ver, the last word has not yet been spo­ken. Face­book has alrea­dy announ­cedThe com­pa­ny has deci­ded to appeal the deci­si­on to the Düs­sel­dorf Hig­her Regio­nal Court. It remains to be seen whe­ther the appel­la­te courts will appro­ve the exten­si­ve use of data pro­tec­tion argu­ments to estab­lish an abu­se of a domi­nant posi­ti­on, or whe­ther they will make a cour­se correction.

Initi­al situation

Accord­ing to Facebook’s terms and con­di­ti­ons, users can cur­r­ent­ly only use the social net­work on the con­di­ti­on that Face­book also collects data about the user on the Inter­net or on smart­pho­ne apps out­side of the Face­book site and assigns it to the Face­book user account. Spe­ci­fi­cal­ly, Face­book grants its­elf the right to mer­ge all data collec­ted on (i) Face­book its­elf, (ii) the Group’s own ser­vices such as Whats­App and Insta­gram, and (iii) the data collec­ted on third-par­ty web­sites with the Face­book user account.

Order of the BKartA

The BKar­tA has issued the fol­lo­wing orders to Face­book for Ger­ma­ny, but without addi­tio­nal­ly issuing direct sanctions:

The Office’s deci­si­on covers several data sources:

  1. In the future, the ser­vices belon­ging to the Face­book group like Whats­App and Insta­gram con­ti­nue to collect the data. Howe­ver, an assign­ment of the data to the user account at Face­book is only pos­si­ble with the volun­ta­ry con­sent of the user. If con­sent is not given, the data must remain with the other ser­vices and may not be pro­ces­sed in com­bi­na­ti­on with the Face­book data.
  2. A collec­tion and Allo­ca­ti­on of data from third par­ty web­sites to the Face­book user account will also only be pos­si­ble in the future if the user volun­ta­ri­ly cons­ents to the assign­ment to the Face­book user account.

If the­re is a lack of con­sent for the data from the Group’s own ser­vices and third-par­ty web­sites, Face­book can only collect the data in a very restric­ted man­ner and assign it to the user account. Face­book must deve­lop appro­pria­te solu­ti­ons for this and sub­mit them to the Office.

In the words of its pre­si­dent Andre­as Mundt, the BKar­tA is thus taking on a “inter­nal unbund­ling” of the data pro­ces­sed by Facebook.

Legal argu­men­ta­ti­on of the BKartA

a) Mar­ket domi­nan­ce in the social net­wor­king market

Accord­ing to the BKartA’s fin­dings, Face­book takes a lea­ding posi­ti­on in Ger­ma­ny on the Social net­work mar­ketdomi­nant posi­ti­on a. As far as can be seen, the BKar­tA defi­nes the mar­ket nar­row­ly by clas­si­fy­ing ser­vices such as Lin­kedIn and Twit­ter in par­ti­cu­lar as not belon­ging to the same mar­ket. Accord­in­gly, Face­book has a mar­ket share of over 90% on the rele­vant market.

The BKar­tA then empha­si­zes in the con­text of its exami­na­ti­on of the abu­se of a domi­nant posi­ti­on pur­suant to Sec­tion 19 GWB the “spe­cial obli­ga­ti­ons under anti­trust law“This is a for­mu­la­ti­on that is also fami­li­ar in the con­text of pro­ce­e­dings under Art. 102 TFEU and Art. 7 KG, as the spe­cial respon­si­bi­li­ty of mar­ket-domi­nant com­pa­nies is refer­red to in con­stant prac­ti­ce (“spe­cial respon­si­bi­li­ty”, for the first time in ECJ deci­si­on i.S. Miche­lin from the year 1983).

b) Mer­ging of data as an abu­se of exploitation

The BKar­tA goes on to say that users had no choice but to eit­her accept Facebook’s exten­si­ve use of data or to refrain from using the net­work. The obli­ga­to­ry ticking of a box for con­sent to Facebook’s terms of use is not a suf­fi­ci­ent basis for such exten­si­ve data use in this initi­al situa­ti­on. Accord­ing to the BKar­tA, the fol­lo­wing is par­ti­cu­lar­ly pro­ble­ma­tic Unli­mi­ted mer­ging of data of the ori­gi­nal Face­book web­site with data from the Group’s own ser­vices such as Insta­gram and Whats­App, as well as from third-par­ty sites that are equip­ped with inter­faces (e.g. Like or Share but­ton). Sim­ply cal­ling up such third-par­ty sites leads to a flow of data to Face­book. Most users are not even awa­re of this. This com­pre­hen­si­ve data aggre­ga­ti­on allo­ws Face­book to crea­te very pre­cise user profiles.

The BKar­tA spe­ci­fi­cal­ly exami­nes whe­ther a Explo­ita­ti­on Abu­se accord­ing to the rea­ding of anti­trust law pur­suant to Sec­tion 19 (2) GWB. Mar­ket-domi­nant com­pa­nies behave abusi­ve­ly, among other things, if they explo­it the mar­ket oppo­nent – in this case, con­su­mers as Face­book users – by char­ging exces­si­ve pri­ces or by means of unre­a­son­ab­le con­trac­tu­al terms and con­di­ti­ons (socal­led “unfair com­pe­ti­ti­on”). Abu­se of con­di­ti­ons). In the view of the BKar­tA, this app­lies in par­ti­cu­lar to

[…] if, at the same time, explo­ita­ti­on also ham­pers com­pe­ti­tors who can­not accu­mu­la­te such a tre­a­su­re tro­ve of data.

c) GDPR as a yard­stick for explo­ita­ti­on facts

It is inte­re­sting and pos­si­b­ly ground­brea­king that the BKar­tA, in a next step, will be Pro­vi­si­ons of the GDPR as a bench­mark takes for the assess­ment of whe­ther the­re is an abu­se of a domi­nant posi­ti­on under anti­trust law. The reli­an­ce on pro­vi­si­ons from other laws for the deter­mi­na­ti­on of an abu­se of a domi­nant posi­ti­on is not new in princip­le, but here for the first time with regard to the pro­vi­si­ons of data pro­tec­tion and the GDPR in par­ti­cu­lar. In its press release, the BKar­tA empha­si­zes that under the Ger­man ARC also Fun­da­men­tal law and other legal value deci­si­ons, inclu­ding from civil law, such as the law on gene­ral terms and con­di­ti­onsThe fol­lo­wing table shows the effects of the new rules on the con­trol of abusi­ve prac­ti­ces under anti­trust law:

In such pro­ce­e­dings, the app­li­ca­ti­on of the pro­vi­si­ons of Euro­pean abu­se con­trol [pur­suant to Art. 102 TFEU] is always an opti­on. Such abu­se pro­ce­e­dings against Face­book would also be pos­si­ble in princip­le under the cor­re­spon­ding inter­ven­ti­on stan­dard of Art. 102 TFEU. Howe­ver, so far only in Ger­ma­ny has a supre­me court case law deve­lo­ped in which fun­da­men­tal rights or other legal value deci­si­ons – in this case data pro­tec­tion – can also be taken into account for the abusi­ve­ness of the con­duct of a mar­ket domi­na­tor. Howe­ver, due to the cross-bor­der signi­fi­can­ce of the pro­ce­e­dings, the Bun­des­kar­tell­amt clo­se­ly coor­di­na­ted with both the Euro­pean Com­mis­si­on and other for­eign com­pe­ti­ti­on aut­ho­ri­ties during the proceedings.

The BKar­tA fur­ther argues that anti­trust law and data pro­tec­tion law pur­sue an ali­gned pur­po­se in the area of abu­se of con­di­ti­ons by sta­ting in its back­ground paper:

After all, the pur­po­se of data pro­tec­tion law is also to pro­tect the data sub­ject from unju­sti­fied data pro­ces­sing of his or her per­so­nal data by the mar­ket counterparty.”

Spe­ci­fi­cal­ly, the BKar­tA, appar­ent­ly in clo­se exchan­ge with data pro­tec­tion aut­ho­ri­ties (alt­hough it remains unclear exact­ly with which ones), is exami­ning whe­ther the Data pro­ces­sing by Face­book is justi­fied under the GDPR. This refers to an exami­na­ti­on of the law­ful­ness of the data pro­ces­sing pur­suant to Art. 6 DSGVO, even if the BKar­tA does not direct­ly refer to this pro­vi­si­on in the published docu­ments. The BKar­tA comes to the con­clu­si­on that

  1. the data pro­ces­sing is neit­her necessa­ry for the per­for­mance of the con­tract (cf. Art. 6 para. 1 lit. b DSGVO),
  2. nor an over­ri­ding legi­ti­ma­te inte­rest of Face­book in the pro­ces­sing of the data (cf. Art. 6 (1) (f) DSGVO), and
  3. also No valid con­sent The data subject’s con­sent to the data pro­ces­sing in que­sti­on (cf. Art. 6 (1) (a) of the GDPR), as in par­ti­cu­lar no volun­ta­ry con­sent was given. Valid con­sent could only have been affir­med if the use of the ori­gi­nal Face­book web­site had not been made depen­dent on the gran­ting of con­sent to the com­pre­hen­si­ve use of data.

The BKar­tA qua­li­fied Facebook’s terms of use and the type and scope of data collec­tion and use as con­tra­ry to data pro­tec­tion and at the same time as an explo­ita­ti­ve abu­se con­tra­ry to anti­trust law. It requi­res a far-rea­ching “inter­nal unbund­ling” of the data pro­ces­sed by Face­book (see abo­ve regar­ding the orders of the BKar­tA). Sanc­tions were not impo­sed in the­se pro­ce­e­dings, as the BKar­tA con­duc­ted the inve­sti­ga­ti­on as part of admi­ni­stra­ti­ve pro­ce­e­dings (and not in fine pro­ce­e­dings). As men­tio­ned at the begin­ning, Face­book has alrea­dy announ­ced that it will appeal the decision.

Cri­ti­cal App­rai­sal and Par­al­lels to Swiss Anti­trust Law

The coun­ter­part to the abu­se of con­di­ti­ons under the Ger­man ARC is laid down in Swiss anti­trust law in Art. 7 para. 2 lit. c KG, accord­ing to which the Enfor­cing unre­a­son­ab­le pri­ces or other unre­a­son­ab­le terms and con­di­ti­ons. by mar­ket-domi­nant com­pa­nies qua­li­fies as abusi­ve con­duct. The­re is only very spar­se prac­ti­ce on explo­ita­ti­ve abu­se in Switz­er­land. By far the majo­ri­ty of cases con­cern so-cal­led pre­d­a­to­ry pri­cing, which does not invol­ve explo­ita­ti­on of the mar­ket oppo­nent, but rather the que­sti­on of whe­ther other mar­ket par­ti­ci­pants are abusi­ve­ly for­ced out of the mar­ket. This makes sen­se, sin­ce the Pur­po­se of Swiss anti­trust law in the pro­tec­tion of effec­ti­ve com­pe­ti­ti­on and not in con­su­mer pro­tec­tion or data pro­tec­tion. Que­sti­ons rela­ting to fair­ness and data pro­tec­tion law the­re­fo­re do not, in princip­le, fall wit­hin the remit of the com­pe­ti­ti­on authorities.

An exces­si­ve exami­na­ti­on of data pro­tec­tion vio­la­ti­ons by com­pe­ti­ti­on aut­ho­ri­ties is the­re­fo­re que­stion­ab­le and opens a Pandora’s box: It is unclear what stan­dard should be app­lied for the exami­na­ti­on of whe­ther a vio­la­ti­on of data pro­tec­tion pro­vi­si­ons qua­li­fies as an abu­se of a domi­nant posi­ti­on. In any case, it is not accep­ta­ble to con­si­der every data pro­tec­tion vio­la­ti­on by a mar­ket-domi­nant com­pa­ny as a vio­la­ti­on of anti­trust law. In the case of abu­se of explo­ita­ti­on, the pre­vai­ling doc­tri­ne is a Cau­sal link The Ger­man Federal Mini­stry of Jus­ti­ce requi­res a distinc­tion to be made bet­ween the enfor­ce­ment of unre­a­son­ab­le terms and con­di­ti­ons (such as the terms and con­di­ti­ons of use that vio­la­te data pro­tec­tion) and mar­ket domi­nan­ce. An abu­se of explo­ita­ti­on the­re­fo­re only exists if a com­pa­ny exploits its domi­nant posi­ti­on in the mar­ket to obtain busi­ness advan­ta­ges from its custo­mers, that it would not have been able to imple­ment without mar­ket power and with func­tio­n­ing com­pe­ti­ti­on. The decisi­ve fac­tor is the­re­fo­re how Face­book would have beha­ved if it were not domi­nant. How would com­pa­nies in a com­pe­ti­ti­ve com­pa­ra­ti­ve mar­ket pro­cess and aggre­ga­te user data? It is que­stion­ab­le whe­ther com­pa­nies would have beha­ved dif­fer­ent­ly in a com­pe­ti­ti­ve com­pa­ra­ti­ve mar­ket. It is still open at the moment how inten­si­ve­ly the BKar­tA has dealt with the­se points.

Litt­le is known so far about the spe­ci­fic review of the terms of use by the BKar­tA. The BKar­tA is appar­ent­ly exami­ning the grounds for justi­fi­ca­ti­on that we know from Art. 6 DSGVO. Howe­ver, it pro­bab­ly asses­ses the­se from an anti­trust law per­spec­ti­ve and not necessa­ri­ly in the same way as a data pro­tec­tion aut­ho­ri­ty would. In par­ti­cu­lar, it would be inte­re­sting to know which Role the mar­ket power of Face­book had for the assess­ment of the justi­fi­ca­ti­on accord­ing to Art. 6 DSGVO. In the lite­ra­tu­re on data pro­tec­tion law, the Mar­ket posi­ti­on of the data pro­ces­sor and the power imba­lan­ce bet­ween the data con­trol­ler on the one hand and the data sub­ject on the other hand clas­si­fied as a rele­vant fac­tor in par­ti­cu­lar for the assess­ment of the volun­ta­ri­ness of con­sent wit­hin the mea­ning of Art. 6(1)(a) GDPR (so in par­ti­cu­lar Ingold, Art. 7 GDPR N 27, in: Sydow [ed. ], Euro­päi­sche Daten­schutz­grund­ver­ord­nung, Hand­kom­men­tar, Baden-Baden 2017; Schultz, Art. 7 GDPR N 19 f. and 24, in: Gola [ed.], DS-GVO, Kom­men­tar, Munich 2017). In this respect, the assess­ment of the legal ground for data pro­ces­sing under the GDPR and the facts of explo­ita­ti­ve abu­se under anti­trust law is based on a simi­lar tra­de-off as a basis. As is well known, the GDPR is lar­ge­ly aimed at cur­bing the unre­stric­ted and non-trans­pa­rent use of data by tech­no­lo­gy giants. It is inten­ded to give citi­zens more con­trol over their per­so­nal data.

The inter­play bet­ween data pro­tec­tion and com­pe­ti­ti­on law in the age of Big Data and data mining, with the power imba­lan­ces and infor­ma­ti­on asym­me­tries that are typi­cal of this, has preoc­cu­p­ied Euro­pean super­vi­so­ry aut­ho­ri­ties for several years. Based on a deci­si­on of the Euro­pean Par­lia­ment in March 2017, in par­ti­cu­lar the Digi­tal Clea­ring­hou­se a volun­ta­ry net­work of data pro­tec­tion, con­su­mer pro­tec­tion and com­pe­ti­ti­on aut­ho­ri­ties, which meets at regu­lar inter­vals to dis­cuss cur­rent regu­la­to­ry issu­es. The BKartA’s deci­si­on is a fur­ther step in the direc­tion of con­ver­gence of the­se are­as of law, albeit limi­ted to Ger­ma­ny and sub­ject to any cour­se cor­rec­tion by the appel­la­te courts.