Facebook and the Bundeskartellamt’s Winter of Discontent

September 2019

CPI EU News Column edited by Thibault Schrepel, Sam Sadden & Jan Roth (CPI) presents:

Facebook and the Bundeskartellamt’s Winter of Discontent By Giuseppe Colangelo (University of Basilicata)¹

Introduction

After a three-year investigation, the German Facebook saga is not over yet. As in the well-known TV series, “winter is coming” for the Bundeskartellamt (“FCO”). On August 26, 2019, the Higher Regional Court (“OLG”) of Düsseldorf suspended the FCO’s landmark Facebook decision, expressing “serious doubts” about its legal basis.² According to the OLG, the decision lacks “meaningful findings” and relies on unconvincing arguments that are “without substance” and “meaningless.”

The OLG verdict marks the second massive setback for the FCO this year, just after the annulment of its Booking.com decision on price parity clauses.³ However, the suspension and the findings are preliminary. The President of the FCO, Andreas Mundt, announced the competition authority will file an appeal to the Federal Supreme Court (“BGH”).

The Bundeskartellamt Investigations

On February 6, 2019 the FCO found Facebook’s data policy to be abusive, claiming that, by making the use of its social networking service conditional upon users granting extensive permission to collect and process their personal data, Facebook unlawfully exploited its dominant position in the German market for social networks.⁴

According
to the FCO, due to its market position, Facebook’s users cannot switch to other
social networks with minimal effort or an equal level of satisfaction. Thus, in
designing its business model, Facebook must comply with special obligations,
one of these being that it should use adequate terms of service without
exploiting its locked-in users.

The FCO
held that Facebook failed to make its users fully aware of the fact that it
collected their personal data from sources other than the Facebook platform
and, then, merged them with data gathered on its own platform, all with the
ultimate aim of detailing their online profiles better than its competitors
could. Indeed, if a third-party website has embedded Facebook products such as
the “like” button or a “Facebook login” option, or use analytical services such
as Facebook Analytics, data will be transmitted to Facebook via application
programming interfaces (“APIs”) as soon as the user visits that third-party’s
website. Thus, through APIs, data are transmitted to, collected, and processed
by Facebook even when a Facebook user visits other websites.

Further,
according to the FCO, Facebook put its users in the position of having to
either accept the above data policy or refraining from using Facebook in its
entirety. Because of Facebook’s dominant position, even well-informed users
would not have been able to voluntarily consent to the Facebook’s data
policies, fearing the alternative of no longer being able to access Facebook.
Therefore, the FCO concluded that Facebook’s conduct violated European General
Data Protection Regulation (“GDPR”) rules by violating users’ rights to control
the processing of their personal data, and of the constitutional right to
“informational self-determination”. Against this background, the FCO considered
Facebook’s dominant position to be a key element of this privacy violation.
Hence, the FCO established a link between the established antitrust concept of
market power and traditionally distinct privacy issues related to information
disclosure and individual awareness.

To this
end, the FCO relied on the general clause of Section 19(1) of the German
Competition Act (“GWB”). According to that provision, competition law applies
in every case where one bargaining party is so powerful that it can dictate the
terms of a contract, with the end result being the abolition of the contractual
autonomy of the other bargaining party. In addition, the FCO maintained that
where access to users’ personal data is essential for a company’s market
position, the question of how that company handles personal data affects the
way in which it competes. If a dominant firm collects and analyzes user data
pursuant to exploitative terms and conditions, it also violates antitrust law
by acquiring an unfair competitive advantage over firms that adhere to the
GDPR.

In  prohibiting Facebook’s conduct, the FCO held
that individual Facebook-owned services can continue to collect data. However,
where users do not voluntarily consent to data combination between different
services, the data must remain within that service and cannot be processed in
combination with Facebook data. And in the case of data from third party
websites, both the collection of data and their combination with Facebook data
requires further voluntary consent to be obtained from users. In other words,
without users’ consent, data processing for each service must take place in
separate process. As a consequence, the FCO required Facebook to adapt its
terms of service and data processing.

The Decision of the Higher Regional
Court of Dusseldorf

The OLG of
Düsseldorf dismantled the entire reasoning of the FCO decision, holding
that the contested data policy did not give rise to any relevant competitive
harm. The OLG rejected both the existence of an exploitative abuse to the
detriment of Facebook’s users and an exclusionary abuse to the detriment of
actual or potential Facebook competitors.

With regard to the alleged exploitative abuse, the OLG held that FCO did not carry out sufficient investigations into “as-if-competition” (i.e. the counterfactual situation) and, as a result, made no meaningful findings on the issue of what would have occurred under “competitive” conditions.⁵ The FCO failed to assess the counterfactual, hence it could not argue that Facebook’s terms and conditions deviate from those that a company in a competitive market would impose.

Further, the OLG found the FCO’s allegation that Facebook’s business terms resulted in a loss of users’ control over their data and a violation of a constitutionally protected right to informational self-determination unconvincing.⁶ Indeed, the contested data processing was carried out with the user knowledge, and there was no evidence to support the contention that Facebook obtained user consent through coercion, pressure, exploitation of a weakness of will, or other unfair means. As the OLG put it, “[t]he fact that the use of the Facebook network is linked to the consent to the use of additional data does not mean a loss of control on the part of the user and does not constitute a predicament for the user. It merely requires weighing up the benefits of using a social network financed through advertising (which hence is free) against the consequences associated with the use of the additional data by Facebook.”⁷ Users can undertake such balancing without being unduly influenced, and do so completely autonomously, according to their own preferences and values.

According to the OLG, the FCO was “merely discussing a data protection issue, and not a competition problem.”⁸ Facebook’s alleged abuse of market power was based only on the assumption that its data policy was contrary to data protection law. However, even if Facebook’s contested policy did breach data protection rules, that would not necessarily also constitute an infringement of competition law. An abuse of dominance, under both EU law (Article 102 TFEU) and German law (Section 19 GWB), requires anticompetitive conduct, and hence damage to competition.⁹ Indeed, under competition law, dominant undertakings bear a special responsibility only not to damage competition, not to comply with the entire legal system by avoiding any violation of the law.¹⁰

In sum, the OLG held that a causal link between dominance and abusive conduct, or at least the anticompetitive effects of given conduct, is absolutely necessary. The FCO failed to connect Facebook’s alleged market dominance and the alleged infringements of data privacy rules.¹¹ Through its reasoning, the Court introduced a distinction between “behavioral” and “normative” causality.¹² According to the latter, an abuse of a dominant position can be assumed whether it leads to a structural weakening of competition at the expense of current or potential competitors. In such cases, a connection between abuse and market power is regarded as sufficient in the sense of causality of results. This type of assessment typically relates to exclusionary abuses. Such normative causality is not sufficient for exploitative abuses since they do not affect the market structure, hence their effects on consumers are unrelated to dominance.

The OLG held that Facebook’s conduct did not constitute an exclusionary abuse either. Indeed, the OLG held that the FCO’s conclusion that Facebook’s processing of the contested data increased entry barriers for Facebook’s rivals was “not comprehensible.”¹³ It is not self-evident to what extent the processing of additional data should make it difficult or impede market entry by Facebook’s rivals. Although the OLG did not rule out that Facebook’s processing of additional data may secure its market position, as it is is financed by advertising (and the scope and quality of the user data are relevant for generating advertising income), whether a market entry barrier actually exists or is reinforced requires “closer review and more detailed demonstration.”¹⁴

According to the OLG, the FCO also failed to provide reliable information on the extent to which the use of data could enable Facebook to increase advertising revenues to finance its social network. This analysis would be indispensable because the key for successful market entry is not generating the highest possible advertisement income, but quickly gaining a sufficient number of users.¹⁵ The OLG also noted a “drastic lack of reasoning” concerning the risks of Facebook leveraging dominance from the market for social networks to another market for online advertising for social media.¹⁶

Back to the Basics

From the outset of the German Facebook investigation, commentators raised concerns about the commingling of data protection law with antitrust law.¹⁷ To be clear, no one contests the commercial importance that user data holds for digital platforms, or that privacy constitutes an increasingly important component of non-price competition. The critical point pertains to the gap between the objectives of privacy and competition law, respectively.

Against this background, the FCO’s decision has raised the specter of parties using concerns surrounding “big data” as an opportunity to pave the way for a new wave of cases where privacy violations are dressed up as antitrust violations. Indeed, in examining whether Facebook’s data policy was appropriate pursuant to the GDPR, the FCO acted as a self-appointed enforcer of data protection rules, finding the existence of a privacy violation previously undetected by any data protection authority, and interpreting data protection rules in a restrictive way that goes far beyond the limits of its legal competence. Further, by placing a special privacy responsibility on dominant firms, the FCO’s approach is rooted in the idea that virtually every legal infringement by a dominant firm could amount to an antitrust violation.¹⁸

For these
reasons, the decision of the OLG is welcome. By stating that that under both EU
and German law, damage to competition is required for an antitrust
infringement, and recalling that dominant undertakings carry a special
responsibility only as regards competition, the Court has set competition
enforcement back on track.

However,
the Facebook saga is not over, as the FCO has lodged an appeal with the Federal
Supreme Court. So, stay tuned for the next episode.

1 Ph.D.; LL.M. Jean Monnet Professor of EU Innovation Policy; Associate Professor of Law and Economics, University of Basilicata; Adjunct Professor of Markets, Regulations and Law, and of Legal Issues in Marketing, LUISS and Bocconi University; TTLF Fellow, Stanford University and University of Vienna; giuseppe.colangelo@unibas.it; giuseppe.colangelo1975@gmail.com

2 OLG Düsseldorf, August 26, 2019, Case VI-Kart 1/19 (V).

3 OLG Düsseldorf, June 4, 2019, Case VI-Kart 2/16 (V).

4 Bundeskartellamt, February 6, 2019, Case B6-22/16. For a critical analysis, see G. Colangelo & M. Maggiolino, Antitrust über alles. Whither competition law after Facebook?, 42 World Competition 355 (2019).

5 OLG Düsseldorf, supra note 2, 7.

6 Id. 9.

7 Id. 9.

8 Id. 10.

9 Id. 11.

10 Id. 12.

11 Id. 16.

12 Id. 17-18. One may wonder whether this distinction is consistent with the European Court of Justice (“CJEU”) caselaw. While Continental Can (CJEU, February 21, 1973, case 6/72, para. 27) and Hoffman-La Roche (CJEU, February 13, 1979, case 85/76, para. 91) suggested that there is no requirement to show a causal link between the dominant position and its abuse, in Tetra Pak II (CJEU, November 14, 1996, case C-333/94 P, para. 27) the Court held that Article 102 presupposes a causal connection. See R. Nazzini, The Foundations of European Union Competition Law, Oxford University Press, 2012, 178, arguing that Article 102 is a prohibition of conduct that is socially undesirable because it is carried out by dominant undertakings, thus a causal link must exist between dominance and competitive harm.

13 Id. 30.

14 Id. 30.

15 Id. 31.

16 Id. 32.

17 G. Colangelo & M. Maggiolino, Data Accumulation and the Privacy-Antitrust Interface: Insights from the Facebook case, 8 International Data Privacy Law 224 (2018); id., Data Protection in Attention Markets: Protecting Privacy Through Competition?, 8 Journal of European Competition Law and Practice 363 (2017).

18 Colangelo & Maggiolino, supra note 3. See also D. Auer, The FCO’s Facebook Decision: Putting Privacy Before Competition, 3 Competition Policy International 1 (2019); G. Manne, Doing double damage: The German competition authority’s Facebook decision manages to undermine both antitrust and data protection law (2019) https://truthonthemarket.com/2019/02/08/doing-double-damage-bundeskartellamt-facebook/.

Click here for a PDF version of the article