Facebook – Bundeskartellamt’s landmark decision blurs the line between data protection and competition law

Key Points

In many countries, authorities are taking a closer look at how data is collected and used and what level of control users have in that regard. That is also true for the German Bundeskartellamt or Federal Cartel Office (“FCO”).

In a landmark decision of 7 February 2019, which follows a three-year investigation, the FCO prohibited Facebook from making the use of the company’s social network conditional upon the user giving permission to have the company collect user and device-related data from sources outside Facebook and merge this data with information from the Facebook user account. Those sources include other Facebook owned services such as WhatsApp and Instagram, as well as third-party mobile apps or third-party websites.

According to the information published so far [1], the FCO considers that Facebook’s current practice of “comprehensive processing of personal data” based on the users’ consent to Facebook’s terms of service upon registration constitutes an abuse of Facebook’s dominant position on the social network market in Germany. The abusive conduct consists mainly of a violation of the EU General Data Protection Regulation (“GDPR”). It is the first time that a competition authority in the EU relies on a failure to comply with data protection laws to establish a competition law infringement.

The FCO did not impose a fine but required changes to Facebook’s data processing policies, which the FCO has described as far-reaching restrictions on the processing of user data. The details of the required remedies are still to be determined and the onus is on Facebook to adapt its terms and conditions (“T&Cs”) in a way that secures the user’s freedom of choice when providing Facebook with access to data. The company has twelve months to implement a solution and four months to come up with a road map.

The FCO’s decision relates only to private users in Germany, but it may well have a wider effect. Addressing the use of information across services and the combination and processing of this information to create a unique and tailored user experience touches upon a core aspect of Facebook’s business model. The interface between access to big data and market power is at the heart of this case and we expect that more cases with this focus will be brought in the future.

The decision is not yet in force and, according to public sources, Facebook has appealed the decision to the Düsseldorf Higher Regional Court.

Background

Signing up to Facebook is conditional upon the user’s consent to Facebook’s T&Cs. These include that Facebook can collect data on users and their devices outside of the Facebook platform via so-called Facebook Business Tools integrated in third party websites and apps and can assign these data to the user’s Facebook account. Facebook can also process user data across Facebook’s other platforms (e.g. WhatsApp and Instagram). Therefore, under the current T&Cs, Facebook can combine data from its own and Facebook-owned services as well as from third party websites and apps. Third-party websites with embedded interfaces such as “Like” or “Share” buttons, implement the data exchange with Facebook when the website/app is installed or opened. Even if no Facebook symbol is visible to users of a website, user data may still be provided to Facebook.

The FCO’s decision aims to disentangle this data pool. Facebook group entities would still be allowed to collect their users’ data. However, the data collection would need to be kept separate. Without the user’s consent, which must no longer be a requirement for using Facebook’s services, data processing would “generally take place in an internally separated process”. Andreas Mundt, the FCO’s president described this as “internal divestiture of Facebook’s data”.

The FCO’s reasoning: Abusive data policy

The prohibition decision is based on Section 19 of the German Act against Restraints of Competition (“GWB”), which is the national equivalent of Article 102 TFEU. The FCO considers Facebook’s practice an exploitative abuse of its dominant market position to the detriment of private users and competitors.

National market for private social networks

The FCO has defined the relevant market as the national market for private social networks. This excludes nearly all services which Facebook would consider directly competing with Facebook for its users’ attention, such as YouTube, Snapchat, Pinterest and Twitter, as well as networks for professional requirements, such as LinkedIn or Xing. The FCO conducted user surveys and does not consider these services sufficiently comparable to Facebook.

Dominant position of Facebook

On the relevant market, Facebook holds a dominant position in Germany. The FCO refers to a very high user-based market share, especially among daily active users, which by far exceeds the presumption threshold for dominance under German law. It also argues that this would hold true even if services such as YouTube, Snapchat, and Twitter were included in the relevant market. Furthermore, the FCO refers to strong network effects, difficulties associated with switching to another social network (lock-in effect), high barriers to market entry, and competitors losing share and exiting the market while Facebook’s user figures remain very high and even keep rising. Indirect network effects on the advertising market and Facebook’s significant data pool further increase the entry barriers. The FCO also sees signs of the market “tipping”, which would result in a monopolistic position of Facebook in the future.

Exploitative T&Cs as an abuse of dominance

According to the FCO, Facebook’s data policy – which requires compulsory user consent to collecting and merging data from third-parties’ (including affiliated companies’) platforms and websites when joining Facebook – constitutes an exploitative abuse of Facebook’s dominant market position.

This is certainly the most interesting part of the case. The FCO argues that due to Facebook’s T&Cs, users have insufficient control over the processing of their data and its allocation to their Facebook accounts and that this amounts to an abuse of dominance by Facebook.

Exploitative business terms can constitute an abuse under German competition law but the scope of such a “qualitative” abuse has not been very well defined in the past. In its decision, the FCO considers that Section 19 GWB applies to cases where one contractual party is so powerful that it is practically able to dictate the terms of the contract to the other party. It refers to two decisions where the German Federal Court of Justice applied Section 19 GWB to protect a party in an unbalanced negotiation position against contract terms which violated constitutional rights (Pechstein) or civil law provisions (VBL-Gegenwert). The FCO takes the view that these principles can be applied to all other areas of the law as well. It then concludes that Facebook’s T&Cs are in violation of the GDPR and that this violation was a manifestation of Facebook’s market power.

To establish that the T&Cs are abusive, the FCO considers that it is not necessary to determine that the violation (of data privacy laws) was only possible because of Facebook’s dominance. Instead, it is deemed sufficient that Facebook’s dominant position has significance for the violation of the GDPR (normative causality) and that the violation in effect provides Facebook with a competitive edge over competitors in the form of access to expanded sources of data for processing.

Balancing of interests: Disproportionate or unbalanced demands by Facebook?

Pursuant to Section 19 GWB, T&Cs required by a dominant party to a contract can be considered abusive based on qualitative criteria. This requires a balancing of interests. T&Cs are deemed abusive if, taking the normative values of the GWB or other – non-competition law-related – legal provisions into account, they can no longer be considered to meet the interests of both parties. This is also the approach taken by the Federal Court of Justice in the decisions which the FCO refers to in the Facebook case (the VBL-Gegenwert and Pechstein decisions). The T&Cs required by the dominant company vis-à-vis its customers need to satisfy the principle of proportionality.

The case summary, press release and FAQ do not provide much information on the balancing of the contractual parties’ interests undertaken by the FCO and why it is deemed disproportionate or no longer balanced for Facebook to require users to consent to comprehensive data usage by Facebook in return for access to the company’s social network.

On the one hand, one can safely assume that in view of the success of Facebook, Facebook’s social network is considered a valuable service by users. It is also known that Facebook developed and maintains this service with significant innovation and substantial investment. This service is provided to users free of charge, in return for consent to use data generated by users.

On the other hand, many users do not appear to be very concerned with Facebook collecting and using their online data. Put otherwise, even though the usage of their personal data may not be irrelevant to users, they do not appear to place as high a value on it as the FCO appears to do. The case report of the FCO does not seem to provide any information to the contrary, for example on evidence from surveys showing that data usage is a preeminent aspect for users.

Balancing of interests: Violation of legal provisions as a determinative factor?

The FCO may not have considered it necessary to delve deeper into the balancing of interests because it refers to Facebook’s data policy allegedly violating the GDPR. Indeed, the FCO’s view in relation to Section 19 GWB is that the balancing of interests must go against the dominant company if its T&Cs are to be considered “illegal” due to a violation of non-competition related legal provisions. Some commentators argue that the violation of legal provisions “determines” the balancing of interests. There is an on-going debate, however, whether this holds true for each and every violation of legal provisions or if there are additional requirements for such a determination. For example, in one of the decisions of the Federal Court of Justice (VBL-Gegenwert II), which the FCO refers to, the Court states that not every use of illegal T&Cs by a dominant company constitutes an abuse of dominance.

The FCO’s assessment seems to rely entirely on the lack of “voluntary” consent to Facebook’s data policy. The FCO argues that the users’ actual consent cannot be considered effective because it is not genuinely “voluntary”, since it is provided for the purpose of concluding the contract. However, users may agree to the T&Cs because they consider it a good deal to get access to the social network for free, in return for their consent for Facebook to use their data. In that event, would this still be an imbalanced or disproportionate deal? Would it still violate the GDPR?

Concluding remarks: A test case for the FCO

This case raises many questions about the relationship between competition law and consumer protection law. It clearly concerns what President Mundt calls “Datenhoheit”, with the FCO attaching great importance to personal data. By doing this, the FCO reaches into the area of data protection, continuing a trend of considering personal data as a relevant competitive parameter, and claiming that the data protection authorities do not have exclusive competence in this area. This deviates from the Commission’s view that “[a]ny privacy-related concerns flowing from the increased concentration of data [...] do not fall within the scope of the EU competition law rules but within the scope of EU data protection rules.” The latest amendment to the German competition law, may support the FCO’s view, since it establishes access to data as a relevant parameter to determine market dominance. However, the amendment relates to the assessment of an undertaking’s market position but not to an abusive conduct itself.

Does the FCO go too far in moving the boundaries of competition law from the protection of competition to direct consumer protection? The FCO may see the decision as a test case for its competencies. Since Facebook has appealed the decision, it will be interesting to see if the courts support the FCO’s position. The outcome of the court proceeding will likely also determine whether the FCO will open further abuse of dominance cases at the interface between data protection and competition law. Other competition authorities will continue to watch this case very closely.

 

[1] This includes a case summary, a press release and a FAQ document issued by the FCO: https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Meldungen%20News%20Karussell/2019/07_02_2019_Facebook.html.