On February 6th, the German Competition Authority (Bundeskartellamt or BKA) adopted its long-awaited Facebook decision, imposing far-reaching restrictions on how the social network can collect and process user data. This decision follows a preliminary assessment that the BKA published in December 2017, which this blog discussed at length.
The BKA’s decision—as set out in a case summary and background paper—sticks closely to its preliminary assessment. In this blog post, I therefore recap what the case was exactly about, discuss what the current decision means, and look forward to what’s on the horizon for Facebook.
The issue: Facebook’s data processing
The BKA started a case against Facebook based on the way the social network collects and processes user data. The authority has not been concerned with the treatment of data generated by the use of the social network itself (termed ‘on Facebook’). After all, ‘the provision of a social network aiming at offering an efficient, data-based business model funded by advertising requires the processing of personal data. This is what the user expects.’
What the authority takes issue with is how Facebook collects and processes data from third-party apps and websites (‘off Facebook’). Firstly, Facebook collects data from its daughter apps WhatsApp and Instagram. Remember that in the course of merger proceedings, Facebook once declared it would be technically infeasible to match users’ Facebook and WhatsApp accounts in order to better target ads on Facebook. When that appeared easier than expected, the Commission fined Facebook €110M for providing misleading information.
Secondly, Facebook collects data from any website that uses ‘Facebook Business Tools’, which is any website where you can ‘like’ or ‘share’ content, where you can log in through your Facebook account, or that uses Facebook’s analytics services. When users spend time on such websites, this data is also added to their Facebook profile, leading—again—to more targeted advertisements.
When it comes to these ways of collecting user data from outside the social network, the BKA holds that ‘the efficiencies in a business model based on personalised advertising do not outweigh the interests of the users’. Indeed, users are unaware of such data collection and have not consented to it.
The legal analysis: when competition law met data protection
As this concerns an abuse of dominance case, the BKA goes through the traditional steps of defining the relevant market, establishing Facebook’s dominant position on it, and laying out a theory of abuse.
Market definition
The BKA defines the relevant market as the social network market in Germany. In doing so, it explicitly recognizes Facebook as a multi-sided platform serving users on the one hand, and advertisers running targeted advertisements on the other. Of these two sides, however, the authority considers the user side a separate market, which is in line with scholarship on the issue. The fact that users make use of Facebook for free is not a problem, as the recently inserted §18(2a) of the German Competition Act makes it clear that ‘[t]he assumption of a market shall not be invalidated by the fact that a good or service is provided free of charge.’
According to the BKA, Facebook does not face a lot of competition in the social network market. Now that Google is shutting down its Google+ social network, all that’s left is a number of smaller German providers. Other online services commonly referred to as ‘social media’ are not included in the market, as they are not interchangeable enough from a consumer point of view. Professional networks such as LinkedIn, messaging services such as WhatsApp or Snapchat, or other social media such as Instagram, YouTube or Twitter are therefore excluded from the market.
Market power (dominant position)
When it comes to market power, the BKA focuses on the fact that ‘Facebook’s user-based market share is very high, especially among daily active users, where Facebook has a market share exceeding 95%.’ To be safe, the authority also notes that the services of the Facebook group ‘would have a combined market share far beyond the market dominance threshold’ even if one would include YouTube, Snapchat, Twitter, WhatsApp, and Instagram in the relevant market.
According to the BKA, this won’t change any time soon. While competitors are leaving the market, Facebook’s user figures keep rising (or at least stagnate at a high level). This ‘strongly indicate[s] a market tipping process which will result in Facebook.com becoming a monopolist.’ The main reason for such tipping is found in direct network effects, which imply that users benefit most from being active on the platform where most of the other users are active.
In addition, the BKA examines other factors affecting a multi-sided platform’s market power, including indirect network effects leading to barriers to entry, access to competitively relevant data, and innovation-driven competitive pressure (the relevance of all of these factors is explicitly recognized in the recently inserted §18(3a) of the German Competition Act). Taken together, the BKA concludes Facebook is in a dominant position.
Abuse of dominant position
When it comes to the actual abuse, the BKA holds that ‘[u]sing and actually implementing Facebook’s data policy, which allows Facebook to collect user and device-related data from sources outside of Facebook and to merge it with data collected on Facebook, constitutes an abuse of a dominant position on the social network market in the form of exploitative business terms’. In specifying the exact nature of the abusive behaviour, the BKA relies heavily on the General Data Protection Regulation (GDPR).
Firstly, the BKA takes great care to justify its reliance on the GDPR to establish a competition law infringement. After all, the European Commission’s position is that ‘any privacy-related concerns […] do not fall within the scope of the EU competition law rules but within the scope of the EU data protection rules.’
Instead of focusing on the Commission’s position, the Bundeskartellamt relies on the case law of the German Federal Court of Justice, which considers contract terms abusive if they violate the German Civil Code (in particular when such terms are imposed by a party with superior power). By analogy, the BKA holds that ‘the European data protection regulations […] can or, considering the case-law of the highest German court […], must be considered when assessing whether data processing terms are appropriate under competition law.’ As the GDPR does not aspire to full consistency of enforcement, competition authorities can also consider and interpret its provisions.
More specifically, then, Facebook’s terms and conditions violate the GDPR as there is no effective consent for such extensive processing of data pursuant to Article 6(1a). The problem lies in the voluntary nature of the consent, which cannot be assumed if such consent is a prerequisite for using Facebook in the first place. The problem, in other words, is that when users want to use Facebook, they don’t have a choice except than to accept all terms and conditions.
‘Ok, so there’s a violation of the GDPR—how is this a competition issue?’, one might wonder. The BKA argues that the infringement of data protection law is ‘a manifestation of Facebook’s market power’. There is a link of causality: because Facebook inappropriately processes user data, it has ‘gained a competitive edge over its competitors in an unlawful way and increased market entry barriers, which in turn secures Facebook’s market power towards end customers.’
Remedy
The BKA orders Facebook to adapt its data policies. Facebook can no longer combine the data it collects from WhatsApp and Instagram with Facebook user accounts without obtaining voluntary consent. (When collecting data from third-party websites, such voluntary consent is already required.) According to the BKA, ‘voluntary’ means that ‘the use of Facebook’s services must not be subject to the users’ consent.’ Without such consent, it can only combine data from various sources to a highly restricted extent. Facebook was given twelve months to implement the necessary changes, but its appeal to the Düsseldorf Higher Regional Court may suspend this deadline.
Commentary: unnecessarily blurring the lines?
Of course, this decision has faced a lot of criticism. Facebook itself is evidently not amused; in a blog post, the company has set out how it believes the BKA ‘underestimates the fierce competition we face in Germany, misinterprets our compliance with GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU.’
It is fair to question whether the decision unnecessarily blurs the lines between competition and data protection law. The connection between the two, which the BKA finds in Facebook’s market power, is somewhat tenuous. Indeed, as Justus Haucap remarks, ‘there is little evidence that would suggest that larger firms violate data protection and privacy standards in a more systematic fashion than smaller firms – if at all, the contrary appears to be true.’
It is unclear whether there are other factors motivating the BKA. In the past, EU competition law has been used to compensate for sleepy regulators. Is a similar dynamic at play here? According to the GDPR’s enforcement mechanism, the Irish data protection supervisor is responsible for scrutinizing Facebook’s data policies. Such supervisors are far from toothless: they have the power to impose fines worth up to 4% of the total worldwide annual turnover of the infringer. Was the BKA unhappy with the lack of action on the part of the Irish data protection supervisor?
Looking ahead: more cases, and what about Facebook’s data integration ploy?
Two other questions remain. Firstly, will the BKA’s precedent be followed by other competition authorities? The Commission’s response, for one, was lukewarm. A spokesperson said it ‘took note’ of the decision and is ‘closely following’ the BKA’s work, adding that ‘[t]he European legislator has made sure that there is now a regulation in place that addresses this type of conduct’, namely the GDPR. Commissioner Vestager has also stated that she doesn’t believe the Facebook decision can serve as a template for EU action as it sits ‘in the zone between competition law and privacy’ and was based in part on German law.
Secondly, what does the BKA’s decision means for Facebook’s plans to integrate Facebook, WhatsApp and Instagram? According to a recently announced plan, the company will unify the underlying technical infrastructure of the various apps, which will make cross-platform communication possible. While the BKA’s decision is geographically limited to Germany, it at least presents an additional technical challenge for an already ambitious plan.