IS THE GDPR NON-COMPLIANCE OF FACEBOOK AN ABUSE OF MARKET POWER?

20 February 2019

The ink on the French data protection authority’s decision in the Google-case is not even dry and the German antitrust authority has already imposed sanctions against the other ’giant’ Facebook because of its unlawful data processing activities. I suppose you wonder what is the connection between the data protection and the economic competition? Well, read our short article and you will know the answer.

1. Why was the German antitrust authority competent in the case?

As mentioned in the foreword, at first sight it is a little odd that the German antitrust authority acts in the case of the US-company Facebook which rather concerns data protection related questions.

However, the German antitrust authority is competent to act in all cases where a competition restraint could have an effect in Germany. Indeed, Facebook’s market behaviour has effects in Germany, in addition Facebook has a German subsidiary, thus the authority is competent.

Further, the antitrust authority has taken into consideration that the data processing practices of such a relevant economic operator as Facebook, could be relevant not only for the data protection authorities but also for the antitrust authorities. The German antitrust authority, in fact, considers it an important task to monitor the data processing activity of market leaders and strongly cooperates with the data protection authority.

2. How does Facebook use our personal data?

The subject of the examination were basically the terms of service of Facebook. It is hardly news that the users need to agree in the terms of service in order to be able to use Facebook. Thus, among others the user shall accept that Facebook collects his data from external sources, such as third-party webpages, mobile applications and to assign those data the user’s Facebook account.

Obviously, nobody is surprised that Facebook uses that data that the user shares on the Facebook or which otherwise could be get about him because of his Facebook activities. A well-informed user probably also expects that the pictures posted by him on the Facebook-owned Instagram are assigned to his Facebook account.

What is probably unknown for the majority is that Facebook also collects data about us from third-party webpages which embedded a “Like” or “Share” button or are using the Facebook Analytics. The shocking thing is that the visitor does not even need to click on the “Like” button, the data will be transmitted to Facebook when the user calls up the webpage.

3. Why is Facebook considered as a market leader?

While it is appalling that Facebook collects from everywhere and then combines by all means possible our data, this would not really be relevant from competition point of view, if Facebook was not a market leader.

This seems pretty obvious in the light of the activity of Facebook, considering for example that in Hungary all similar providers (eg. IWIW) were shut down, but the German authority supported his statement with comparative data and numbers.

Facebook has 2,3 billion monthly active users worldwide, out of which 1,5 billion people use Facebook on a daily basis. Regarding the German “social media” market, however there are some webpages and applications which offer partly similar services as Facebook (eg. YouTube, Snapchat, Pinterest), in the reality these platforms do not substitute Facebook.

Examining narrowly the relevant market, Facebook has a market share of more than 90%, having 32 million monthly and 23 million daily active users. Besides Facebook, there are only some smaller service providers on the social media market, but their market share is marginal.

4. Why is the infringement of the GDPR an abuse of market power?

The antitrust authority thinks that in the light of Facebook’s privacy policies it can be established that his data processing practices infringe the GDPR. Facebook does not have a valid legal basis to collect data from third-party webpages and to assign those data to the user’s account.

Indeed, the user does not have a real choice: if he would like to use Facebook, he shall give his consent to the data processing for the above mentioned purpose, which makes the consent invalid since it is not freely given.

The German antitrust authority is on the opinion that that contract terms used by a market leader that make the possibility of the usage of the service dependent from the user’s wide consent to the processing of his personal data, shall be regarded as exploitative contract terms.

Although it is a fact that Facebook’s exploitative terms do not cause direct financial loss to the user, he suffers damages because he loses control over the processing of his data and will be a “subject” of a data processing which he could not have foreseen.

5. What is the obligation of Facebook based on the decision?

Instead of a punitive sanction, the German authority rather imposed „corrective” sanctions. That means, that for the time being, he has not fined Facebook, but imposed restrictions on him setting out how he should terminate his exploitative practices.

Facebook can continue to collect data from platforms which he owns, like Instagram or WhatsApp, but he can only assign those data to the user’s account if the user has freely consented to it. From third-party webpages Facebook can only collect data if he obtains the user’s freely given consent.

The consent in this case will only be regarded as freely given if the usage of Facebook is not subject to the provision of the consent.

The decision is not yet final thus Facebook can pursue remedies against it. If the decision will be final and yet Facebook does not comply with the obligation, he will face competition fines even higher than the data protection fines.