German competition regulator demands changes to Facebook’s use of personal data
Authorities in Europe have for years discussed in theory the need to integrate data protection with consumer rights and competition law. This is the “holy trinity” required to properly protect citizens from the risks created by new technologies such as big data and machine learning. Practical progress on this integration has been slow. However, a critical new development in Germany hints that this may be about to change.
In February 2019, Germany’s national competition regulator, the Bundeskartellamt, concluded a three-year investigation into Facebook’s use of personal data and ordered the company to change its data practices for German users. The investigation and ruling marks a huge step forward for using data protection law as a standard to examine and address exploitative practices by large internet companies.
The competition authority’s investigation focused on Facebook’s terms and conditions, which enable Facebook to collect and combine user data from third-party websites and apps into the platform even where users set their internet browsers to block activity tracking. It questioned whether these terms are unfair or violate data protection provisions including the General Data Protection Regulation (GDPR), and whether this unfair or illegal data collection constitutes an abuse of dominance in the social networks market.
The Bundeskartellamt found that Facebook’s terms are contrary to data protection law as they enable Facebook to collect an almost unlimited amount of personal data from third-party sources without genuine user consent. Personal data flows automatically to Facebook whenever a user opens a web-page that has a visible Facebook plugin or that uses Facebook Analytics as a background service. Facebook users cannot opt out of this data collection and subsequent use but are instead forced to agree to the practice in order to access the platform.
The Bundeskartellamt also found that the extent to which Facebook collects, merges and uses data in user accounts amounts to an abuse of the social network’s market dominance. This was a particularly innovative finding. Before this investigation, the market category of “social networks” had not been defined nor analysed. Instead, competition authorities assessing, for example, mergers simply considered Facebook’s fiscal share of the overall advertising market, which has typically let the company off the hook for its shady data processing activities.
The ruling sends a powerful signal to Facebook that it is not beyond the reach of competition authorities’ jurisdiction. It could set an important precedent for other European competition enforcers looking to use data privacy or consumer protection to pursue dominant data-collecting companies. It may even have influence further abroad, given Senator Elizabeth Warren’s manifesto in the United States presidential election campaign to break up big tech.
By Open Rights Group