This article is written by Niharika Agrawal, from IFIM Law School. This article analyzes the legal perspective behind the German competition regulator that prohibited Facebook from combining user data from WhatsApp and Instagram.

Introduction 

The German Federal Cartel Office (Bundeskartellamt or FCO) in its landmark judgment delivered on 6th February 2019, has imposed certain restrictions on Facebook from combining the users’ personal data with its owned services such as WhatsApp and Instagram without the voluntary consent of the users. Following this decision, Facebook is under obligation to modify all the terms and conditions of the service for the users who are based in Germany. This has also dimmed the line between data protection laws and competition law. This decision has an important perspective as it focuses on Facebook’s complete mechanism of personal data with respect to both data protection and competition law aspects. This article includes the legal perspective of the entire action taken by the Bundeskartellamt and the consequences of such a decision upon Facebook.  

Case summary

In Germany, Facebook.com was first available to its users in 2008. Its user base has been increasing continuously worldwide. In 2018 the number of daily active users in Germany was 23 million, while 32 million users were classified as monthly active users. It blooms and manages different digital products, networked services, and smartphone applications. It has millions of users in the entire world. It also has the provision for private users to access through the website www.facebook.com or via mobile application. Such private Facebook.com use is on the terms of registration by signing into a user profile. With the help of all the personal information that the users have provided, separate personal accounts are created for each user. Based on this account, the user gets access to other private and commercial users. Such order of appearance is based on the user’s interest. Along with private users, business entities, associations, or business individuals can get access to Facebook.com to produce content on the social network in order to increase their organizations. These social networking sites offer a variety of further functionalities, e.g. a job board, an app center, or event organization. 

Till date, the individuals were able to access the social network by agreeing to the terms and conditions of services which stated that Facebook is allowed to gather the data even outside the facebook website that is on the internet or on any of the mobile applications and can assign this data to other related Facebook user accounts. Due to this, other Facebook-owned websites, applications, and also third-party websites and smartphones including Facebook were able to merge or combine all the data collected and assign it to the user’s Facebook profile. Such arrangement of data sources in specific enabled Facebook to build a unique database on each individual user. 

There are two ways in which third-party sources are generated. 

1. Firstly, if the source is created by utilizing the corporate services owned by Facebook which includes WhatsApp and Instagram. 
2. Secondly, if the user data is generated by the use of third-party websites and applications. 

Third-party sources include Facebook-owned services such as WhatsApp and also third-party websites and applications. If the third-party website has fixed “Facebook Business Tools,” such as the “Like” button, “Facebook login,” or the analytical services, like “Facebook Analytics,” then the user’s data gets transmitted to Facebook through “Application Programming Interfaces” (APIs) even when the user calls up or install that third-party website for the very first time. As per the terms and conditions of Facebook, such user data can be used and merged with the data from the user’s Facebook account. This arrangement continues even if users have blocked web tracking in their browser or device settings. According to FCO, these terms and conditions are neither justified under data protection principles nor are they appropriate under competition law standards. Hence millions of such operations were observed on German websites and applications. 

These combinations of data sources for building a unique database on each user by Facebook led FCO to initiate proceedings. The FCO commenced its case against Facebook Inc. USA, the Irish subsidiary of the company, and Facebook Germany GmbH, Hamburg. According to the authority speculation, due to particular terms and conditions of service on the operation of users’ data, Facebook has misused its probably dominant position in the market for social media and has violated data protection provisions. Later, however, it was observed that Facebook use of unlawful conditions represents an abusive imposition of unfair conditions on users. Hence the FCO examines the extent of the connection between the possibly dominant position and the use of such clauses. Upon this, the FCO president Andreas Mundt stated that “Dominant companies are subject to special obligations. These include the use of adequate terms of service as far as these are relevant to the market. For advertising-financed internet services such as Facebook, user data are hugely important. For this reason, it is essential to also examine under the aspect of abuse of market power whether the consumers are sufficiently informed about the type and extent of data collected.”

The FCO also observed that if there exists a connection between such infringement and the market dominance and also since data protection boundaries set forth in the General Data Protection Regulation (“GDPR”) were exceeded, then it constitutes a huge violation of competition law. 

Legal analysis

Violation of market power based

FCO made a detailed analysis while determining the relevant market. During its analysis, it has examined Facebook’s business model and a unique feature of multi-sided network market service without any monetary fees. On the basis of the concept of demand-side substitutability, the FCO defines the product market as a private social network market that includes private users as the relevant opposite market side. Germany is that one relevant geographic market. Along with this the FCO also found out that Facebook contains a dominant position in the German market for social networks of private users and is consequently subject to abuse control under German competition law.

Violation of dominant position is dependent upon the extent to which Facebook gathers, combines, and utilizes the user’s personal data in their Facebook accounts. The important component of social networks and their business model is the data that is assigned to a particular service user thinks it to be collected and used only to a certain extent. Nonetheless, the users were unaware of the fact that private use of the network is subjected to Facebook, which is able to gather unlimited and any type of user data from the third party source and allocate it to the user’s Facebook personal account. This also enables them to use such data for other numerous data processing processes. 

As per the assessment of market share, it is considered that the time spent on the use of social networks is an essential element of the competitors’ actual market position. According to the recent amendment in the German Competition Act, 1958, the company market power is not only based on the assessment of its market share but also depends upon access to competitively relevant data, economies of scale based on network effects, the behavior of users who can use several different services or only one service, and the power of innovation-driven competitive pressure. These direct network effects make it difficult for the users to switch to another social network. 

As a result, this geographic Germany-wide market was used predominantly in order to connect peoples in the users’ own country, special nation user habits, and lack of opportunities for supply-side substitution. 

Facebook as market-dominant position

In Germany, Facebook.com was first available to its users in 2008. Its user base has been increasing continuously worldwide. In 2018 the number of daily active users in Germany was 23 million, while 32 million users were classified as monthly active users. The market share of Facebook is more than 95% of daily active users and more than 80% of monthly active users. Facebook carries a  dominant position in the national market for social networks for private users as per the view of Section 18(1) together with (3) and (3a) GWB. On the basis of an overall assessment of all factors of market power, the scope of action in this market is not completely controlled by the competition. 

Services provided by other social networking sites such as Snapchat, Youtube, Twitter, or any professional networks such as LinkedIn and Xing, etc. only provide the party service of a social network and due to this, they are excluded from the relevant market. However, Facebook and its group of subsidiaries which includes Instagram and WhatsApp achieve the highest market shares that ultimately are indicative of a monopolization process. Direct network effects of Facebook’s business model are the strong element of market dominance which also creates difficulties for the users to switch to another social network. Competitors such a StudiVZ and SchülerVZ, Google+ have experienced a continuous decrease in the user-based market shares and hence left the market.  The strong identity-based network effects lead to a lock-in effect that attracts the users and prevents them from switching. Recent functionalities do not reduce the consequences of Facebook’s incompatibility with others. 

Observing the market dominance position of Facebook, FCO President opined Andreas Mundt that: “As a dominant company Facebook is subject to special obligations under competition law. In the operation of its business model, the company must take into account that Facebook users practically cannot switch to other social networks. In view of Facebook’s superior market power, an obligatory tick on the box to agree to the company’s terms of use is not an adequate basis for such intensive data processing. The only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent.”

Violation of data policy

Utilizing and applying Facebook’s data policy, which enables Facebook to gather user device-related data from third-party sources of Facebook and then to combine it with data collected on Facebook account, leads to violation of a dominant position on the social network market in the form of exploitative business terms under the general clause of Section 19(1) GWB. Considering data protection law in accordance with the General Data Protection Regulation (GDPR), the functioning of Facebook is an inappropriate term that may cause harm to both private users and competitors.  

Upon examination by the FCO, it was observed that Facebook data policy needs compulsory voluntary consent of the user to collect and combine the data with the third-party websites and applications, and hence, non-compliance to this has led to abuse of dominant market position. Due to the terms and conditions of Facebook, the users do not have sufficient control over the mechanism of the data and its assignment to their Facebook account. Such violation terms and conditions can be held as abuse under German Competition law, however, such scope of qualitative abuse is not well defined. To deal with this the FCO considered section 19 which applies to the cases where one contractual party has powerful control so that it is able to order the terms of the contract to the other party. It protects the parties from an unbalanced negotiation position against the contract terms that violate constitutional rights or any provisions under civil law.

The FCO further examined that Facebook’s extensive processing of personal data from outside sources and with Facebook-owned tools is a violation of European data protection requirements as it is subjected to the affected user’s consent. It is also derived that Facebook has the dominant market position, the users are obligated to give consent to the terms and conditions, only pursuant to concluding the contract. This process is not considered as the free consent of the user under the GDPR. Therefore, Facebook was asked to no longer merge any data in any comprehensive manner unless there is the voluntary express consent of the user.

GDPR has been in effect since May 2018. The data processing policies under GDPR stated that Facebook has no proper and effective reasoning for collecting data from other sources. The processing of data is neither required to fulfill contractual obligation nor does a balancing interest. Hence, Facebook does not obtain any voluntary consent for its processing of the affected data. The consent of the user would have been only effective if the provisions of the Facebook.com service were not subject to this consent.  

Judgment

1. The Bundeskartellamt has terminated the conduct of the data processing policy that Facebook imposes on its users and its corresponding implementation in accordance with Section 19 (1) GWB. 
2. The termination includes the terms of processing personal data as stated in the terms of service and explained in the data and cookie policies unless they involve the collection of user and device-related data from other corporate services and Facebook Business Tools without the users’ consent and also their combination with Facebook data for purposes related to the social network. 
3. The necessary changes and to adapt its data and cookie policies need to be made accordingly within a period of twelve months. In addition to that Facebook has been given a deadline of four months to present an implementation road map for the adjustments.
4.  The time limits can be suspended by an emergency appeal to the Düsseldorf Higher Regional Court. 

Facebook has already appealed against this decision to the Düsseldorf Higher Regional Court and requested that the suspensive effect of the appeal be restored.

Data protection and Competition Law

Social networks are data-driven products. Hence, access to the personal data of users is an essential element for the market position of a company. Along with this, the protection of its users’ personal data is an important factor in terms of data protection authorities and competition authorities. Therefore, FCO is investigating both market positions of the huge data collectors on the data processing side within the scope of the inquiry sector into online advertising. The legislators have considered the fact that in the digital economy the collection and processing of data and the appropriate terms and conditions represent an entrepreneurial activity that is very important for competition. Access to data in all the scenarios related to online platforms and networks is known as a relevant factor for market dominance under Section 18(3a) GWB.

Continuance of access to the data processing activities of dominant position entities is an essential work of competition authority that cannot be carried forward without data protection officers. In such cases, the competition authority takes into account the data protection principle specifically for examining whether the terms and conditions that are framed for the processing of data are appropriate. Hence, in this way, there is a connection between competition law and data protection law. 

Consequence 

1. Facebook-owned services such as WhatsApp or Instagram can continue to collect data for their services only in the manner and to the extent of the users’ voluntary consent.
2. For third-party sources, voluntary consent by the user is required for their collection of data. 
3. Without the consent of the user, Facebook cannot merge the data in a comprehensive manner and data processing must generally take place in an internally separated process. 
4. If Facebook continues to collect the data from outside and combines it without the consent of the user, then the processing of such data would be substantially restricted. 

Conclusion

As per the decision given by the FCO, Facebook has to adapt and change the terms and conditions of services that are imposed on its users in Germany and the data processing conditions. This decision has created a significant impact upon the users as well as on the two important laws that are data protection law and competition law. The ultimate aim of this decision is the protection of the personal data of the users and keep them in safe hands. The consumers’ voluntary consent is very important in every aspect and in any field. They carry the right to privacy which needs to be protected by laws. 

 References

1. https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2019/07_02_2019_Facebook.html
2. https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook_FAQs.pdf?__blob=publicationFile&v=6
3. https://www.linklaters.com/it-it/insights/publications/2019/april/facebook-bundeskartellamt-s-landmark-decision
4. https://www.mondaq.com/germany/data-protection/791408/germany39s-federal-cartel-office-prohibits-facebook-from-combining-user-data-from-different-sources#_edn21
5. https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2016/02_03_2016_Facebook.html
6. https://www.bundeskartellamt.de/SharedDocs/Entscheidung/EN/Fallberichte/Missbrauchsaufsicht/2019/B6-22-16.pdf?__blob=publicationFile&v=3

---

Students of Lawsikho courses regularly produce writing assignments and work on practical exercises as a part of their coursework and develop themselves in real-life practical skills.

LawSikho has created a telegram group for exchanging legal knowledge, referrals, and various opportunities. You can click on this link and join:

https://t.me/joinchat/L9vr7LmS9pJjYTQ9

Follow us on Instagram and subscribe to our YouTube channel for more amazing legal content.