Concluding a three-year investigation, the German Federal Cartel Office has ordered Facebook to offer German users a data-unbundled version of its social network, which assigns to user accounts only data collected on the social network itself. Facebook may continue its current data processing practice—which is to assign to user accounts also data collected on other Facebook-owned services such as WhatsApp and Instagram and on third-party websites or services—only with regard to those German users who consent voluntarily to this practice.
On February 6, 2019, the German Federal Cartel Office ("FCO") imposed on Facebook far-reaching restrictions in the processing of user data. The FCO's order concluded its investigation into Facebook, which had started in March 2016 and had led to a preliminary assessment that was announced on December 19, 2017. According to the documents published by the FCO, as expected, the FCO did not impose a fine but only ordered Facebook to change its business practices, as described below.
At present, individuals may use the Facebook social network only if they agree to Facebook's terms of service, which stipulate inter alia that Facebook may collect, combine and assign to each user's Facebook account not only user and device-related data obtained from the Facebook website/app but also user data obtained elsewhere. The two most important data sources other than the Facebook social network are other Facebook-owned services such as WhatsApp and Instagram and third-party websites, apps or services featuring embedded Facebook links (e.g. "Like" or "Share" buttons, which trigger data flows even if not clicked) or using "Facebook Analytics" in the background.
The FCO ordered Facebook in essence to offer German users data unbundling for their Facebook user accounts. According to the FCO, Facebook may continue its abovementioned fully-fledged data combination practice only with regard to those German customers who provide their "voluntary consent" to such combination. In addition, Facebook must enable German customers to use the Facebook social network even if they refuse such "voluntary consent." If at all permissible, then the combination of Facebook accounts of users who refuse the "voluntary consent" with data obtained outside of Facebook must be restricted substantially. Facebook has four months to submit to the FCO proposals for suitable substantial restrictions and twelve months to change its business practices. In case of non-compliance, the FCO could impose substantial fines.
The FCO based its order on the finding that Facebook was dominant in the German market for social networks and that Facebook's current practice of excessively collecting, using and merging data in user accounts constituted an abuse of dominance under the German abuse control provisions.
The FCO started by characterizing Facebook's business as involving a multi-sided network market featuring four user groups (private users, advertisers, developers and publishers) but then focused on private users. The FCO delineated a separate German market for social networks for private users, which did not include professional networks, messaging services or other social media.
The FCO stated that on the thus-defined relevant market, Facebook had a market share exceeding 95 percent in terms of daily active users and was thus dominant. The FCO added that even if YouTube, Snapchat, Twitter, WhatsApp and Instagram were included in the relevant market, Facebook would still be presumed to be dominant. The FCO stated that it saw no specific indications of a dynamic or disruptive process that would call into question Facebook's market power.
To reach the finding that Facebook's data processing conduct constitutes a so-called exploitative abuse, the FCO argued in essence as follows:
- Under established case law of the German Supreme Court, not only excessive prices but also inappropriate contractual terms and conditions could constitute exploitative abuse. To measure appropriateness, any legal principle could be applied that aimed to protect a contracting party in an imbalanced negotiation position.
- Data protection law aimed at protecting individuals from having their personal data exploited by the opposite market side and sought to ensure that users can decide freely and without coercion on how their personal data is used. The right to informational self-determination was also a fundamental right under the German Constitution. Therefore, data protection laws were a suitable standard for examining exploitative abuse.
- Facebook's data collection and processing conduct constituted an exploitative abuse because it violated European data protection rules, in particular the General Data Protection Regulation (GDPR). The combination of Facebook user accounts with data collected outside of Facebook was not justified as it was neither required to fulfil contractual obligations, nor did Facebook's interests in data processing outweigh the users' interests. In addition, the consent to data processing currently given by customers was not effective because it was mandatory rather than voluntary.
- Facebook's exploitative practice harmed not only users of Facebook, who lost control of their data, but also competing social networks and advertising customers. Facebook could use the data to optimize its own social network and tie more users to it. In addition, Facebook could improve its targeted advertising offering, thus becoming indispensable for advertising customers. Finally, in the advertising market, advertising customers and competitors were faced with a dominant supplier of advertising space in social networks.
This is the first abuse of dominance finding based on data-protection rules, and the first time that data unbundling also within the same group of companies is prescribed as a remedy. Accordingly, the FCO explicitly addressed the relationship between data protection and competition law. The FCO claimed that the GDPR did not aspire to full consistency, as it explicitly stated that data protection law could also be enforced under civil law. The FCO pointed out that the German Competition Act explicitly named access to data as a potential source of market power, above all in the case of online platforms and networks. The FCO concluded that monitoring the data processing activities of dominant companies was an essential task of a competition authority, which could not be fulfilled by data protection authorities. The FCO stated that it liaised closely, in particular in view of the GDPR, with data protection authorities (including that of Ireland, where Facebook has its European headquarters), none of which had considered that they had exclusive competence. Nevertheless, the fact that the FCO has now in one particular case—and only with effect for German users—acted against alleged violations of the GDPR effectively creates EU-wide inconsistencies.
The FCO also stated that the German abuse of dominance provisions were more suitable than Article 102 TFEU to be applied to the present case because so far only the German Supreme Court had established a case-law under which constitutional or other legal principles could be taken into account in assessing abusive practices. The FCO stated that it liaised closely with the European Commission and other competition authorities. However, it remains unclear whether other authorities will follow given the particularities of the German case law.
In a broader sense, the approach of the FCO supports the more recent trend to focus in dominance situations not only on typical price-related abuses like exclusionary rebates, predatory pricing or margin squeeze but also on the abuse of non-price related contractual power. In that respect, the FCO only recently prohibited an event agency from using exclusive contracts, which it concluded with organizers of live entertainment events and advance booking offices. It further started abuse proceedings with respect to the business terms and practices of a large online retailer.
According to the FCO, Facebook has already submitted to the competent Higher Regional Court of Düsseldorf an appeal against the FCO order and an emergency request for suspension of the order including the abovementioned time limits set by the FCO of four months and twelve months, respectively.
Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.