11 February 2019
Last week, the German competition regulator, the Bundeskartellamt (BKA), released a decision prohibiting certain types of collection and use of user data by Facebook.
The decision was taken under the German rules on abuse of a dominant position (the equivalent to Australia’s misuse of market power prohibitions in s.46 of the Competition and Consumer Act 2010 (Cth) (CCA)).
The decision is relevant for companies active in Australia against the background of the ACCC’s Digital Platform Inquiry, although making an equivalent misuse of market power case in Australia on these facts could, in our view, be challenging.
In Germany today, Facebook only permits users to use its platform if they consent to Facebook collecting their data, not only from their interactions on Facebook, but also from their use of:
All data collected on the Facebook platform, by Facebook-owned services and from third-party websites can be combined with, and assigned to, a Facebook user account.
The BKA found that Facebook has a dominant position in the German market for social network services – a market in which its market share exceeds 90% and, the BKA found, there are no close substitutes and high barriers to entry. The Australian position is similar and in its Digital Platform Inquiry Preliminary Report (Preliminary Report), the ACCC made a similar finding that Facebook has a degree of market power in relation to social media and other markets.
The BKA found that Facebook did not obtain an effective consent for its processing of users’ data.
That limited choice available to users was said to constitute an abuse of dominance because of users’ ‘loss of control’ over their data. Users were said to be unable to control how their personal data is used, or to know which data, from which sources, is combined for which purposes (e.g. ad profiling/targeting). Because of the combination of data, users are also not able to properly assess the significance (and therefore value) of the data they have shared with Facebook.
The BKA determined that making the use of Facebook’s service conditional upon users granting such an extensive permission amounted to an ‘exploitative’ abuse.
Additionally, the BKA found an exclusionary effect on Facebook’s competitors. Facebook can use user data and profiles to optimise its own service and tie more users to its network, to the detriment of other providers of social network services. Facebook was said to be indispensable for advertising customers in Germany (and Australia – according to the ACCC’s Preliminary Report).
The BKA acknowledged that not all collection, use or combining of data is impermissible and imposed no fine on Facebook in the circumstances. Instead, it required that Facebook implement practical solutions to reduce the potentially exploitative effects of its user terms.
Following the decision, Facebook has 12 months within which to amend its:
If users do not consent, Facebook may not exclude them from the platform.
If Facebook fails to take these actions, within the required timeframes, it may face substantial fines.
The BKA’s decision is interesting for companies active in Australia, although making a misuse of market power case in Australia on these facts could be challenging.
First, the decision advances two main propositions, which suggest only a narrow fact pattern in which an abuse/misuse of market power would likely be found:
Second, there are a number of major differences between Australian misuse of market power law and practice and the German rules under which the BKA drew its conclusions in this matter. These are:
Third, when faced with similar facts in Australia, the ACCC has notably not sought to bring a market power case – or even suggest that one may be possible in the Preliminary Report. This is despite the fact that the Preliminary Report found that:
Instead, the ACCC has proposed a raft of privacy-related policy recommendations to bring Australian data protection legislation closer to the EU GDPR, which Facebook’s terms and policies breached.
Our view is that this reflects the difficulties in making a market power case on these facts under Australian law.
That said, the BKA’s decision points to a theory of harm that directly connects data privacy practices and anticompetitive effects and suggests that a broadly equivalent case cannot be ruled out under Australian law. The ACCC has separately given some indication in its Preliminary Report that requiring overly broad consents as a condition of use may amount to an unfair contract term under the Australian Consumer Law in some circumstances.
The BKA decision appears to be part of a broader, global trend of regulators examining the business practices of global digital platforms and sharing information and theory to further policy and enforcement goals. The BKA said that it worked closely with international regulators and data protection agencies on the decision, a trend we anticipate will continue. Since the decision was taken, the Austrian, Dutch and Italian competition regulators have noted the decision with interest, suggesting further discussions around these issues at the EU level.
The content of this publication is for reference purposes only. It is current at the date of publication. This content does not constitute legal advice and should not be relied upon as such. Legal advice about your specific circumstances should always be obtained before taking any action based on this publication.