On February 7, 2019, Germany’s Federal Cartel Office (“FCO”) issued its long-awaited decision in the Facebook case, see press release and background paper in English here.
It qualifies Facebook’s current practice of collecting and matching data of its users from third-party services/websites, including on What’sApp and Instagram, without explicit consent as an abuse of dominance. Facebook is ordered to stop the conduct within 12 months: it must obtain explicit user consent and change the current system by offering an opt-out solution. Facebook must propose adequate solutions to the FCO within four months.
- Dominance in social networks market in Germany
Market definition
The FCO defines a separate (digital) social networks market in Germany. Professional networks (LinkedIn and Xing), messaging services (WhatsApp and Snapchat) or other social media (YouTube or Twitter) are not in the same market, because they largely satisfy complementary needs. Even if they were included, the FCO says Facebook’s market share would still be indicative of dominance – which is the case under German law with a market share exceeding 40%. The market is limited to Germany, because German users mainly use Facebook to keep in touch with users in Germany.
Dominance
Facebook has a market share of more than 90% (by user numbers). The large size of its network leads to high entry barriers. The FCO finds that switching to other social networks is difficult, so that users are locked in. Indirect network effects impede market entry – it would be difficult for a new entrant to offer services financed by advertising revenues, which requires a critical number of users. The FCO did not find multi-homing in the social networks market. In addition, Facebook has superior access to (user) data and thus a competition parameter in the market, because user data are important for the product design and allow monetarizing the services through advertising, which may create further entry barriers.
- Theory of harm – abusive t&cs due to violating data protection laws
Concept
The theory of harm is that Facebook abuses its dominant position through imposing abusive, i.e., exploitative, user terms and conditions (“t&cs”). The concept of abusive business terms is stipulated in Section 19(2) no. 2 ARC, and does not only protect companies, but generally the demand side of a market, which can include consumers like here. The FCO primarily relies on German caselaw pursuant to which violating legal principles (including civil law) can render business terms abusive.
Data protection laws violation
The FCO finds the t&cs are abusive as they violate data protection laws: they make using the social network pre-conditional upon Facebook’s vast data collection and combination, i.e., matching data from other websites or services to Facebook user accounts. Facebook collects the data from users surfing third-party websites or apps with an embedded Facebook API (application programming interface), e.g., the Facebook “Like-Button”. It then matches the data with the users’ Facebook accounts for additional data processing activities. Users do not have to click on the said button – surfing on such sites is sufficient. The FCO says that users are often unaware of this practice and have not been requested for explicit consent, which violates EU data protection laws.
Balancing of interests
In the balancing of interests exercise, required under German law, the FCO concludes that the vast data collection and matching is inappropriate as it is not necessary for Facebook in order to offer its social network services. In addition, users have no choice to opt out – even if they are aware of the practices, they can only take it or leave it. Given that they are locked in, leaving is no realistic option. The FCO weighs the user interest to have control over its personal data and the fundamental right of so-called informational self-determination higher than Facebook’s interests to collect and match the data.
- Termination of abuse through change of t&cs and system
The FCO requests that Facebook change its t&cs, including seeking explicit user consent for its data collection and matching practices and providing for an opt-out possibility: if users reject consent, they must be able to continuously use Facebook and should only be subject to very restricted data collection and matching. This also applies to the Facebook-owned services What’sApp and Instagram. The FCO argues that only with an opt-out solution any user consent can be deemed truly voluntary.
Regarding the restricted data collection and processing, the FCO mentions as example restrictions on the amount of data, purpose of use, type of data processing, additional control options for users, anonymisation, processing only upon instruction by third party providers, limitations on data storage periods, etc. The FCO obliges Facebook to offer solutions how to implement this within the next four months, so it obviously wants to have a say in how Facebook intends to implement the decision.
- Comments
P2C-side in focus
The decision is a big bang. It is first time that abuse proceedings into digital platforms concern the P2C (i.e., platform to consumer)-side of a multi-sided platform market. (The Commission’s Google cases concerned the platform’s practices vis-à-vis companies, i.e., the P2B side.)
Precedents stress need for causality
While the concept of abusive terms is not new, the reliance on violating data protection laws as the key (and maybe only) reason for finding abuse is. The quoted precedents stipulate that there must be a causal link between the company imposing an illegal clause and dominance. The currently available materials on the FCO’s decision do not really deal with this aspect, other than generally finding that consumers are locked in. Hopefully the decision can shed more light on this crucial point.
Additional theory of harm?
The background materials also allude to possible negative effects of Facebook’s practice in the online advertising market, i.e., on competitors (foreclosure due to superior data access) and online advertising customers (increased dependence on Facebook). While this could be a more common theory of harm, it is unclear to which extent the FCO effectively relies on it.
Prohibition covers intra-group exchange
It is remarkable that any data flow between Facebook-owned services (What’sApp and Instagram) and Facebook is subject to the same obligations as third-party websites: generally, a group of companies is treated as one single economic entity in abuse proceedings, which means that internal information exchange/flow is normally permissible. (And unlike in the ongoing Commission Amazon probe, the data exchanged here do not include sensitive data from customers who are also competitors.)
Far-reaching obligations: “internal unbundling”
In essence, the FCO requires Facebook to change its business model – not only in terms of consent requirements and IT firewalls. If a significant number of users refuses consent (which is unknown), Facebook cannot use their data for targeted advertising or other services in the same way as today. The FCO’s president Mr. Mundt has described this as “internal unbundling”. Potentially, this concept might serve as a blueprint for other abuse cases in digital platform markets. While it is less severe than the sometimes-voiced request to break up digital giants, it essentially serves as a functional separation and limit on conglomerate strategies.
In fact, regarding What’sApp, the decision almost seems like a partial unbundling of or imposing post-clearance remedies in the Facebook/What’sApp merger, which may cause controversy: In its clearance decision, the Commission did not consider potential conglomerate practices between the two services as a concern, given sufficient competition in the online advertising market(s). (It also noted that any potential data protection violation issues would be a matter of EU data protection and not competition law.)
Limited geographic scope
Of course, the decision is limited to Germany. Irrespective of whether one agrees with the decision, it does not seem meaningful to pursue this type of case only on a national basis. The FCO says it has closely coordinated the case with Brussels. But it seems that the Commission would not bring the FCO’s theory of harm under EU abuse of dominance proceedings.
________________________
To make sure you do not miss out on regular updates from the Kluwer Competition Law Blog, please subscribe here.
