Data has become a key resource. Its collection and processing allow businesses to optimize their operations. With ever-evolving technologies and tools that allow for more effective data collection and processing regulation is becoming increasingly paramount. Egypt addressed this need by implementing data security and privacy laws starting in the late 2010s. Considering increasing antitrust and merger control enforcement in Egypt, a closer look at the intersections between data privacy and competition law in Egypt is warranted. The aims of data privacy and competition regulations overlap to a degree as both regimes aim to protect consumer rights. However, the two regimes may also conflict. This client brief explores the intersection of data privacy and competition law in Egypt and its effects.
Personal data protection law
The law defines 'personal data' as any data related to a natural person. It establishes a framework for the collection, processing, and storage of personal data. The law mandates that data controllers obtain explicit consent from individuals before processing their personal data, except in specific circumstances. Individuals are granted rights to access, correct, erase, and object to the processing of their data. Cross-border data transfer is subject to regulatory approval, ensuring that recipient countries uphold adequate data protection standards. Non-compliance can result in significant penalties.
The Personal Data Protection Centre (PDPC) is the regulatory authority responsible for overseeing compliance, issuing licenses, and handling complaints. The PDPC has the authority to conduct investigations, impose sanctions, and provide guidance to organizations on best practices for data protection.
Competition law
Egypt's competition law seeks to promote and protect competition in the market by prohibiting anti-competitive agreements, abuse of dominant positions, and economic concentrations that may impede competition. The law also applies to transactions and behavior abroad that affect competition in Egypt. The law empowers the Egyptian Competition Authority (ECA) to investigate and take actions against entities engaging in practices that harm consumer welfare or distort market dynamics.
Intersection of data protection and competition law
As Egypt's digital economy expands, the convergence of data protection and competition law becomes increasingly significant. Personal data has emerged as a critical asset in the digital marketplace, with companies leveraging consumer data to tailor services, enhance user experiences, and gain competitive advantages. However, despite data protection and competition laws sharing some common purposes—to protect consumers—and complementing each other in some ways, the two regimes conflict in some instances.
Data protection regimes seek to prevent misuse of data in a manner that conflicts with the data subject's preferences or consent. In doing so data protection regulations limit data collection and processing. This approach can conflict with competition law as it may create barriers to entry. Businesses seeking to enter a data-heavy market may face difficulties building necessary databases due to data collection restrictions. This can disadvantage them against established businesses that already hold large databases and are trusted by consumers due to their familiarity. Also, implementing necessary data protection processes will be burdensome to start ups and small businesses. With data becoming an increasingly important resource, limiting access to it would put smaller players at a disadvantage, thereby reducing competition. This conflict between data protection and competition regulation is to date not addressed by Egyptian law. Moreover, inter agency cooperation remains limited. Hence, undesirable effects caused by this conflict between competition and data protection regulations cannot be adequately mitigated.
Data as a good and source of market power
Data is an economic resources. Access to it provides businesses with significant advantages. For instance, firms with substantial user databases can produce detailed consumer profiles, enabling them to engage in targeted advertising that small competitors cannot match, reinforcing their market power. They might also use data to engage in price discrimination, charging different users different prices based on personal data, which can harm consumer welfare. Additionally, companies can implement data-driven exclusionary practices, such as denying competitors access to essential datasets or platforms, thereby raising barriers to entry. In some cases, firms may even share sensitive data with rivals to coordinate strategies or fix prices, which constitutes collusion. These practices can lead to reduced innovation, fewer choices, and higher prices for consumers. While primarily a competition issue, these practices can be more effectively addressed through joint efforts by data protection and competition authorities. To date the ECA and the PDPC have not conducted joint investigations of this nature.
Data portability: not quite there yet
The Egyptian Personal Data Protection Law does not include comprehensive data portability regulations as other data privacy laws like the EU's General Data Protection Regulation (GDPR). However, it does grant individuals some rights to control their collected data. Like the right to approve or decline data collection (and to withdraw the approval), to access said data, and to request correction or deletion of some or all data. These rights grant individuals some control over their data. Still, they are not sufficient to adequately address lock-in effects. Without robust data portability rights customers face difficulties when switching service providers, causing customers to more frequently stay with current providers. This establishes barriers for market entry. Hence, data portability rights that serve to empower individuals by allowing them broader capacity to take ownership of their data also serve a function in competition regulations. From a competition regulations perspective data portability rights enable fair market entry conditions and consumer choice. The lack of robust data portability rights in Egypt, therefore, not only impacts data protection but also competition in the country.
Data as a subject in merger control
Mergers and acquisitions involving companies possessing substantial amounts of personal data can raise concerns about reduced competition and consumer choice. The consolidation of data resources may enable the merged entity to exert undue influence over the market, potentially leading to monopolistic behaviors.
The Egyptian merger control regime focuses on traditional indicators like revenue and value of sales. This system is less equipped to catch transactions where data-driven business models are involved.
Products or services of some digital businesses may appear free. However, effectively customer pay with their data. Consequently, these companies may not appear dominant when considering their monetary turnover alone. Considering different forms of remuneration or considering different metrics such as active user data may be necessary to adequately evaluate their market power. Furthermore, the combined datasets of parties to an economic concentration could significantly reduce competition. For example, by enabling the parties to conduct predictive analytics that rivals cannot match. In its current state the Egyptian merger control regime is not equipped to address these issues.
The status quo of regulatory coordination
Effective enforcement of both data protection and competition laws requires coordination between regulatory bodies. Collaboration between the PDPC and the ECA is essential to address issues where data practices impact competition. As of today, there is little evidence of the two authorities cooperating. Still, the intersection of data protection and competition law in Egypt is an evolving area of law that requires careful consideration and coordination of sometimes conflicting regulatory aims. Despite the limited cooperation, businesses with exposure to Egypt will have to adapt strategies that comply with both regimes.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
