Last 23 December 2022, the Bundeskartellamt, the Federal Cartel Office (FCO), sent a statement of objections (SOO) to Google regarding its data processing terms. This SOO follows the Bundeskartellamt’s prior designation as an undertaking with paramount significance for competition across markets under the German DMA-like provision of Section 19a GWB. Looking at the SOO and Google’s data processing terms, the Facebook data processing case automatically comes to mind. In 2019, the FCO declared that Facebook incurred in an abuse of a dominant position under its national competition law regime rules due to the lack of choice granted to its users when registering into the social network. To that end, the GDPR was used as a benchmark to measure the practice’s abusiveness (for an explanation of the case’s judicial ordeal, see a review here).
Now, the German competition authority has transposed some of its already-prepped line of reasoning out of the 2019-Facebook case to this Google case, whereas novel concepts are also considered in light of the German competition authority’s newly acquired powers under Section 19a GWB (see here a review of the new rules on digital firms in Germany).
Two Theories of Harm Cut from the Same Cloth
Great troves of data in the hands of the Big Tech digital platform are necessarily bad for competition. That was the overarching theme of the Bundeskartellamt’s 2019 decision regarding Facebook’s data processing terms. Given that end users were not given a choice to fine-tune the consent they granted for the performance of a range of online advertising services performed by Facebook on the side of their social network, an abuse of a dominant position was factored out from this scenario. The antitrust analysis was particularly eager on identifying the presence of power imbalances with Facebook’s lack of compliance with the GDPR’s provisions, especially regarding the use of inadequate and unlawful legal bases under Article 6 of the GDPR.
Recent events, namely the Irish Data Protection Commission’s final decisions against Meta regarding its data processing terms in relation to ad targeting, have confirmed that the conclusion of the German competition authority was right in spirit, but not in form. In short, Facebook’s data processing terms may not abide by GDPR rules, but that does not imply necessarily a breach of competition law rules. In the terms of AG Rantos Opinion in the pending preliminary ruling which will resolve the interplay between the interpretation of the GDPR in the antitrust framework, both spheres are co-determinant and self-sufficient to attend to the legal interests they each tend to protect (see an extensive review of AG Rantos’ Opinion here).
Despite AG Rantos’ discouraging conclusions against the Bundeskartellamt’s construed data-based theory of harm, this “new” case under Section 19a(4) GWB paves the way to a similar conclusion. According to the German competition authority’s press release, the lack of choice that the end users registering to Google’s range of services is measured against the benchmark of purely GDPR-inspired terms and principles, namely transparency, purpose-limitation, data-minimisation, and storage limitation (Article 5(1)(a), (b)(c) and (e) of the GDPR).
The novel side of the Google case relies on the consequences which will be tied up with the premises in which the abuse of a dominant position is founded. Whereas in Facebook the FCO ordered the social network to stop combining user data from different sources (due to the fact that the end user could not predict that her data -both when navigating on Facebook-owned sites and the stream of websites partnered with Facebook through its ad network- was going to be cross-used and re-used for advertising purposes), in the Google case the German competition authority strives to go a step further. For now, the press release reads that it “is currently planning to oblige the company to change the choices offered”.
The authority’s stance is no longer ascribed to a passive position prohibiting certain practices. Instead, the FCO has opted into an active attitude towards interventionism from the viewpoint of framework design. A similar posture has been recently underlying the authority’s preliminary statements regarding the analysis of leveraging in its Meta/Oculus case (see here a comment on the case’s developments).
User Choice: Lowering the Threshold of Effects
Surprisingly, however, the Bundeskartellamt advances that it is quite unconvinced with the framing of the concept of consumer choice when it comes to digital platforms and the processing of personal data. The change in criteria from the Facebook case to this preliminary assessment is quite nuanced but ground-breaking. If this shift finally makes it to the final decision against Google’s data processing terms, it will demonstrate the authority’s leeway to lower the threshold to the finding of lack of free choice on the side of the end user. An interesting question that arises (that will remain unanswered) from this metamorphosis lies on whether the changing nature of the threshold would have been unveiled if no such thing as Section 19a GWB would have emerged in the German competition law regime.
On one side, the analysis of Facebook’s data processing terms vis-à-vis compliance with the GDPR resolved in favour of a lack of consumer choice. In the competition authority’s own terms, the lack of free choice was determined by “deciding whether users have options available and can thus decide for themselves what level of data protection they want, or whether they only accept data processing because they would otherwise be unable to avail themselves of a particular service” (para 883). In short, and borrowing Ibáñez Colomo’s illustrative differentiation between rules and standards, the benchmark that the Bundeskartellamt instrumentalised is one of likelihood: alternative scenarios are considered and the authority must show why the scenario leading to anti-competitive effects is more likely than alternative ones (for instance, para 43 of Tetra Laval).
On the other side, the German competition authority’s preliminary assessment regarding Google’s data processing terms points otherwise. In this sense, the threshold to find an infringement of the prohibition of an abuse of a dominant position would entail that “choices offered must not be devised in a way that makes it easier for users to consent to the processing of data across services than not to consent to this”.
Following the previous approach, the threshold of effects is that of capability: anti-competitive effects are a plausible prospect considering the nature and context of the practice of the digital firm. In this sense, the FCO would not have to choose whether alternative options are catered for the user in terms of data processing, but instead on whether anti-competitive effects would be plausible and mainly not against logic and experience.
The Interplay with DMA Designation
The last preoccupying strand of the (3-pages-long) FCO’s press release revolves around the expected overlap of the application of Section 19a GWB with the Digital Markets Act (DMA) (see here on a broad summary of these overlaps with other Member States’ competition law regimes).
As a primer, the Bundeskartellamt exerts the first sign of good faith: these proceedings do not touch upon EU competition law and are only based on the assessment of German competition law. However, the overlap of these proceedings with some of the DMA’s provisions, such as Articles 5(2) or 6(1), still stood in the way.
Not to worry, the German competition authority argues, “while the DMA also includes a provision which addresses the processing of data across services, this applies only if so-called core platform services, which still have to be designated by the European Commission, are involved”. Thus, the authority (transitorily) takes it upon itself to defend the DMA’s objectives and purposes whilst the European Commission designates those core platform services which will be captured under the regulatory instrument.
Up until then, irrespective of the fact that the DMA’s rules have entered into force since November 2022 and their start of application on the 2nd of May 2023, the FCO may well be the guardian of the essences of contestability and fairness issues arising in the German Google online market regarding its core platform services.
Although surprising, this line of reasoning would be coherent, and the German FCO has done exactly that before. When? In the mentioned Facebook data processing case! Before the GDPR’s provisions were applicable in May 2018, the Bundeskartellamt had started scrutinising Facebook’s prior conduct in line with its substantive mandates (given that the GDPR entered into force in May 2016). However, the press release’s paragraph finishes off by stating that “the present proceeding based on the national provision under Section 19a GWB partially exceeds the future requirements of the DMA”.
Hence, the FCO’s competence is not questioned up until the DMA’s provisions come to be applicable, but when they do, Section 19a GWB is considered under the realm of competition law (and not under the same objectives of the regulatory instrument), so that the unifying legal basis under Article 114 TFEU does not apply to the German competition law regime.
However, the Bundeskartellamt cannot have it both ways: either the DMA overlaps with Section 19a GWB or it does not, whether it is before or after that the EU-wide regulatory instrument becomes applicable in May 2023. The pervasiveness of the DMA’s legal basis (Article 114 TFEU) looms in the debate, although those arguing against the artificial incorporation of the positive integration mechanism into the digital space seem to have the upper hand (to that end, see Lamadrid de Pablo and Bayón -and myself!-).
Outlook
The Bundeskartellamt’s approach towards its (new) sanctioning proceedings against Google’s data processing process is a bold move in terms of advancing the authority’s enforcement when it comes to digital platforms with paramount significance. Nonetheless, it also builds up on the flawed – and not yet definite – reasoning of its previous Facebook decision: a breach of the GDPR’s rules equals a power imbalance between the dominant platform and the end user that, in turn, equals the fact that the user cannot exercise freely (in the broadest terms) her choice to fine-tune the undertaking’s processing terms.
According to the FCO’s press release, it attempts to go even further by lowering the threshold of effects and not without triggering some debate regarding its overlap with the DMA. The mix of these preliminary strands of thought coming from the authority in the form of a brief explanation of the statement of objections that it has issued to Google may turn into another Odyssey towards privacy vis-à-vis antitrust integration or into a Pyrrhic attempt to demonstrate its capacity to act on the fact that a great trove of data must entail a fabled business model.
________________________
To make sure you do not miss out on regular updates from the Kluwer Competition Law Blog, please subscribe here.
