In Short
The Situation: An investigation launched in 2016 by the German competition authority was meant to determine if Facebook was abusing its market position with its imposition of "misleading" data protection policies.
The Result: It was concluded that Facebook's data processes did abuse its dominant position, thereby justifying "far-reaching restrictions" on the social media giant.
Looking Ahead: Facebook has announced that it
will appeal the decision, citing the intense competition in the
region, and alleging that the authority had misinterpreted
Facebook's compliance with the General Data Protection
Regulation ("GDPR").
The German competition authority opened an investigation against
Facebook in 2016 to inquire whether Facebook was abusing its
dominant position in the market for social networks through the
imposition of "misleading" data protection policies to
its users. In a decision rendered on February 7, 2019, the German
competition authority considered that Facebook's data
processing terms, enabling the collection, merger, and use of user
data without valid consent, constitute an abuse of a dominant
position justifying "far-reaching restrictions" on
Facebook.
Data Constitutes the Economic Value of Social Networks
The German competition authority found that the sources of the data collected by the social network are two-fold: (i) data collected through the use of Facebook-owned services, such as WhatsApp or Instagram, and/or (ii) data collected by third party websites embedding Facebook's products, such as websites comprising Facebook's "like" button. Once the data is collected without valid consent from end-users, Facebook allocates them to the users' Facebook accounts and exploits said data in various ways that are financially attractive. The German competition authority considered that such practice allows Facebook to create a unique database associated with each individual user and thus, expands Facebook's market power. Given that social networks are data-driven products, the authority also considered that access to such data is an important factor for competition in the market.
The Prohibition of Exploitative Data Processing Terms
The competition authority held that "Facebook's users are oblivious as to which data from which sources are being merged to develop a detailed profile of them and their online activities. On account of the merging of the data, individual data gain a significance the user cannot foresee." The theory of harm focuses on the fact that "users are no longer able to control how their personal data is used." In essence, the German competition authority took issue with the fact that Facebook is collecting user data from third party websites when these websites implement a Facebook "like button"—even if the user has not given his consent for this and is not using these services or has actively objected to web tracking. Consequently, it found that Facebook was abusing its dominant position and that the abuse is characterized by Facebook's data processing terms, which are "exploitative business terms" under German competition law due to their content and the manner in which Facebook processes the users' data.
Data Subjects Constitute the Opposite Market Side Under German Competition Law
As a result, for each source of data collection undertaken in Germany, the competition authority imposed Facebook to either receive users' voluntary consent to assign said data to their Facebook accounts, or to considerably restrict its collection and combining of data.
Facebook to Appeal
Facebook has announced that it will appeal the decision of the
German competition authority. According to Facebook, the German competition
authority underestimates the fierce competition Facebook is facing
in Germany. Facebook also claims that the authority misinterprets
Facebook's compliance with the GDPR and undermines the
mechanisms European law provides for ensuring consistent data
protection standards across the European Union. This is because the
GDPR authorizes data protection authorities—and not
competition authorities—to determine whether companies are
complying with their GDPR obligations.
Four Key Takeaways
- The German competition authority's investigation of Facebook found that the company was abusing its dominant market position with its data protection policies.
- The decision noted that certain practices allow Facebook to create a unique database associated with each individual user, thus expanding Facebook's market power.
- The German competition authority also took issue with the fact that Facebook is collecting user data from third party websites when these websites implement a Facebook "like button"—even if the user has not given consent, is not using these services, or has actively objected to web tracking.
- While adopting and enforcing unfair data processing policies may potentially violate both competition law provisions as well as European data protection laws, the decision of the German competition authority concerning Facebook will likely be the first round of a longer legal battle, as the company has stated it will appeal the ruling.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.