Unfair Data Protection Practices May Constitute an Abuse of Market Power
The Situation: An investigation launched in 2016 by the German competition authority was meant to determine if Facebook was abusing its market position with its imposition of "misleading" data protection policies.
The Result: It was concluded that Facebook's data processes did abuse its dominant position, thereby justifying "far-reaching restrictions" on the social media giant.
Looking Ahead: Facebook has announced that it will appeal the decision, citing the intense competition in the region, and alleging that the authority had misinterpreted Facebook's compliance with the General Data Protection Regulation ("GDPR").
The German competition authority opened an investigation against Facebook in 2016 to inquire whether Facebook was abusing its dominant position in the market for social networks through the imposition of "misleading" data protection policies to its users. In a decision rendered on February 7, 2019, the German competition authority considered that Facebook's data processing terms, enabling the collection, merger, and use of user data without valid consent, constitute an abuse of a dominant position justifying "far-reaching restrictions" on Facebook.
Data Constitutes the Economic Value of Social Networks
The German competition authority found that the sources of the data collected by the social network are two-fold: (i) data collected through the use of Facebook-owned services, such as WhatsApp or Instagram, and/or (ii) data collected by third party websites embedding Facebook's products, such as websites comprising Facebook's "like" button. Once the data is collected without valid consent from end-users, Facebook allocates them to the users' Facebook accounts and exploits said data in various ways that are financially attractive. The German competition authority considered that such practice allows Facebook to create a unique database associated with each individual user and thus, expands Facebook's market power. Given that social networks are data-driven products, the authority also considered that access to such data is an important factor for competition in the market.
The Prohibition of Exploitative Data Processing Terms
The competition authority held that "Facebook's users are oblivious as to which data from which sources are being merged to develop a detailed profile of them and their online activities. On account of the merging of the data, individual data gain a significance the user cannot foresee." The theory of harm focuses on the fact that "users are no longer able to control how their personal data is used." In essence, the German competition authority took issue with the fact that Facebook is collecting user data from third party websites when these websites implement a Facebook "like button"—even if the user has not given his consent for this and is not using these services or has actively objected to web tracking. Consequently, it found that Facebook was abusing its dominant position and that the abuse is characterized by Facebook's data processing terms, which are "exploitative business terms" under German competition law due to their content and the manner in which Facebook processes the users' data.
Data Subjects Constitute the Opposite Market Side Under German Competition Law
As a result, for each source of data collection undertaken in Germany, the competition authority imposed Facebook to either receive users' voluntary consent to assign said data to their Facebook accounts, or to considerably restrict its collection and combining of data.
Facebook to Appeal
Facebook has announced that it will appeal the decision of the German competition authority. According to Facebook, the German competition authority underestimates the fierce competition Facebook is facing in Germany. Facebook also claims that the authority misinterprets Facebook's compliance with the GDPR and undermines the mechanisms European law provides for ensuring consistent data protection standards across the European Union. This is because the GDPR authorizes data protection authorities—and not competition authorities—to determine whether companies are complying with their GDPR obligations.
Four Key Takeaways
- The German competition authority's investigation of Facebook found that the company was abusing its dominant market position with its data protection policies.
- The decision noted that certain practices allow Facebook to create a unique database associated with each individual user, thus expanding Facebook's market power.
- The German competition authority also took issue with the fact that Facebook is collecting user data from third party websites when these websites implement a Facebook "like button"—even if the user has not given consent, is not using these services, or has actively objected to web tracking.
- While adopting and enforcing unfair data processing policies may potentially violate both competition law provisions as well as European data protection laws, the decision of the German competition authority concerning Facebook will likely be the first round of a longer legal battle, as the company has stated it will appeal the ruling.
Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our “Contact Us” form, which can be found on our website at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.