BIG DATA & ANTITRUST

One Way Ticket to Luxembourg - Facebook v. Bundeskartellamt at the ECJ

A landmark competition-privacy case has been sent to the  European Court of Justice. The Higher Regional Court in Düsseldorf has decided that the GDPR-related concerns on the much-expected Bundeskartellamt v. Facebook dominance dispute shall be interpreted by the ECJ before a final ruling is set in German Courts.

By Mario Tavares Moyrón & Petar Pešić

April 14, 2021

“We have very good reason to do away with anachronistic laws and norms, as they can lead to unfairness and to the delay of progress. That is why Zuckerberg hinting that privacy had become obsolete was so significant. Since then, wanting to reassure users and keep up with competitors who are more serious about privacy, Zuckerberg has changed his tune and in 2019 claimed that ‘the future is private’. Just one month later, however, Facebook’s lawyer argued in court that users had ‘no privacy interest’, because by the sheer act of using the platform they had ‘negated any reasonable expectation of privacy’. 

-Carissa Véliz, Privacy is Power

The middle of the year 2020 was coming to an end when the Federal Court of Justice (Bundesgerichtshof) of Germany confirmed the Federal Cartel Office’s (Bundeskartellamt) decision on Facebook dominance. The company quickly appealed the ruling, to be referred to the Higher Regional Court (Oberlandesgericht) of Düsseldorf. After analyzing the substantial arguments of the case, the Competition Chamber of the Oberlandesgericht has recently decided to send the dockets to the European Court of Justice (ECJ) for a formal interpretation of the European Regulations at stake. 

In light of the above, it is worth a step back to remember the context of this dispute and have a short recap to  see why it is now a matter of resolution for the ECJ.

Summary of the case

In February 2019 the German competition authority determined that Facebook was holding a dominant position in the social network’s market. As a consequence, the referred Office imposed a series of guidelines to prevent the company from abusing its powers in the relevant market, such as restrictions to the data processing activities, which, according to the Bundeskartellamt, compelled users to allow broad access to their data for further exploitation, without the user’s previous, informed and explicit consent.

The Bundeskartellamt was not aiming to financially punish Facebook but rather intended to establish ex-ante measures against possible abuses of dominance that also impacted the scope of the data protection legislation. In specific, those from the General Data Protection Regulation (GDPR). These measures required an action plan for Facebook to amend its data processing practices in order to enhance its users' privacy rights.

Facebook quickly challenged the decision from the Bundeskartellamt and asked for interim relief from execution of the decision before the Düsseldorf’s Oberlandesgericht, where its judges granted an injunction to the effect that the company could omit the action plan ordered by the competition authority. In consequence, the Bundeskartellamt appealed the ruling, which forwarded it to the chambers of the Federal Court of Justice in Karlsruhe. And as anticipated in the introduction, on June 23rd of 2020, the federal judges confirmed the decision of the Bundeskartellamt. 

Now, again, it was the turn of the Higher Regional Court in Düsseldorf.

Initial legal assessment by the German Competition Authority

The German competition watchdog was of the idea that Facebook systematically abused its market power, reducing the options of products offered to its users as a result of systematically displaying undemanded targeted advertisements. According to the results of the Bundeskartellamt’s  3-year investigation, Facebook created profiles of its users built from the analysis of personal data and online behavior, without having properly fulfilled the regulatory requirements to collect such data.

The Bundeskartellamt considered that the data handled by Facebook allowed not only to generate highly targeted advertisement but also to strengthen the entry barriers to the social media market through network and lock-in effects.

Under its own interpretation of the GDPR, the Bundeskartellamt noted that users could not provide their consent freely, in an informed way, and with clear and specific purposes to authorize the combination of data. Facebook was conditioning the use of the social network to the acceptance of the terms of use.

Although Facebook disclosed the purposes of processing personal data on its privacy policy, together with the legal basis for such purpose, it did not provide an alternative (opt-out) for the user to refuse the combination of data.

Furthermore, the combination of data was not disclosed, neither only sourced from the Facebook page or app, but also by other interfaces connected to Facebook and third-party websites integrated through plugins, such as the Like button or the Share option. Additionally, the latter is a possible trigger for leaking users’ personal data.

The Competition Authority resorted to substantiate this case following a civil law doctrine from the Federal Court of Justice on “abusive commercial terms”. According to the referred doctrine, an abusive commercial term would be there when one of the parties to a contract had unbalanced power during the negotiation and leveraged it to prevent the other party from any bargaining capacity. As a consequence of the lack of contractual autonomy, constitutional rights (such as informational self-determination, in the case of relevance) of the disadvantaged party of the negotiation could be undermined, hence requiring the involvement of the Court.

In light of the above, the Competition Authority considered that when investigating companies like Facebook, competition watchdogs should assess their data processing activities to test their level of compliance with privacy laws, as their ultimate purpose is to safeguard a right constitutionally acknowledged.

Why was the dispute referred to the ECJ Chambers?

The ECJ acts as the final interpreter of the EU Law and as such is the right addressee in cases where courts of Member States need to decide on a matter related to the Union Law. In those situations, national courts may refer such queries -as is the case with the GDPR- to the ECJ for further clarification.

When it comes to this dispute, the final list of questions is yet to be published. However, Düsseldorf’s Oberlandesgericht was emphatic on the fact that the core of the case was by no means settled yet after the Bundesgerichtshof decision. The central question being: are competition authorities allowed to use antitrust law as a tool to enforce data protection regulation or do they exceed their competence in doing so? Another query that could be expected to be rendered to the Chambers relates to the bundling of the social network users’ data from the various resources harvested by Facebook without consent. 

Other elements to be set are related to the procedural aspect of the case and include whether the right entities of Facebook were targeted during the proceedings and whether Facebook was granted a fair hearing.

Data protection regulation has been a sort of a no-go for competition law. Many experts argue that there is a frontier between antitrust and data protection that should not be crossed, even if these areas of law get to interact within many technology-related cases. 

Wrap-up before a Court’s ruling

The case has already proven to be groundbreaking. The German Parliament (Bundestag) recently introduced an amendment to the Act against Restraints of Competition, which now establishes the Bundesgerichtshof as the first and last instance of appeal to Bundeskartellamt’s decisions. This will likely speed up the process of deciding on similar disputes. 

As it concerns Facebook, the company has been systematically bundling all of the data gathered from its users, using its platforms and third-party sources to strengthen profiles, which matches the company’s business model driven towards advertising. In essence, they use this practice to increase their revenue by offering advertisers better personalization and performance of their campaigns. On the other side of the pond, questions arise as to whether acquisitions of Whatsapp and Instagram by Facebook were mistakenly cleared from antitrust concerns. 

If we are looked at as consumers and we take that the goal of the EU competition law is to strive for consumer welfare and to promote a “highly competitive social market economy” as stated in the Treaty on the Functioning of the EU, then we must wonder if this practice is harming consumers or not. Privacy threats included. What we are getting as consumers is an ever-increasing amount of ads for our “free” use of Facebook’s platforms. 

Facebook increases its revenue using our data, that we must opt to surrender if we wish to use their services, and every possible competitor has driven away from this industry because of network effects. It is hardly plausible that a new entrant to the market can offer similar advertising services as Facebook does, because they simply cannot gather that much data. 

What is interesting is that we still perceive Facebook as a social media company, although their business model revolves around advertising. If they would be seen as advertisers, would their business model and their approach to collection and use of data be seen as exploitative practice? In any case, consumers expect to see the European Court of Justice focusing on the substance of the case and providing clear answers. This dispute has already taken years to decide and a tortoise approach to such highly important cases, is hampering the effectiveness of an eventual decision. By the time this case finally gets resolved, we might realize that the practice that was in the focus of this case has become obsolete. 

What is still true is that this can become the next landmark case to be used as reference for matters related to the intersection of the data protection  and competition law. Whether this will be the case, only time will tell. 

Mario is a legal counsel based in Paris. He underwent his graduate studies in Regulation of New Technologies, Data Privacy, and Fintech. His work experience has been focused on TMT, Contract Law, Compliance for Financial Institutions, Privacy, and Competition Law. He Co-leads the Institute’s Big Data & Antitrust cycle.

Petar is a qualified lawyer from Serbia working in the IT industry. He has completed his LLM degree at the University of Cambridge, specializing in the area of Competition/Antitrust Law. During undergraduate studies at the University of Nis, Serbia, he was participating in numerous Moot Court Competition, of which most notable results were 1st place at the Trans-European Moot Court Competition before the European Court of Human Rights in Strasbourg, France, and Price E. Monroe Media Law Moot Court. He previously completed a traineeship in a reputable Serbian law firm and worked in the Legal Team in the iGaming industry. His areas of interest include AI, IT Law, and Human Rights.