GERMAN FCO FORCES FACEBOOK TO CHANGE ITS DATA COLLECTION POLICY

Facebook's collection and combining of data from third party websites and apps (including WhatsApp and Instagram) deemed abusive. 

On 7 February 2019, after almost three years of investigation, Germany's Federal Cartel Office ("FCO") issued its long awaited decision on Facebook's data collection practices.

The FCO found that Facebook has a dominant position on the German market for social networks, and abused this position by making use of the Facebook social network conditional upon the user consenting to what FCO president Andreas Mundt referred to as Facebook's "practically unrestricted" collection of data from third party websites and apps (including services owned by Facebook such as WhatsApp and Instagram) and linking that data to the user's Facebook account.

The decision prohibits this conduct and orders Facebook to change its terms of service. This is an interventionist and far reaching decision: Andreas Mundt stated that "with regard to Facebook's future data processing policy, we are carrying out what can be seen as an internal divestiture of Facebook's data". The decision has not yet been published, but the FCO has issued a background paper (here) and a press release (here). Facebook has announced that it will appeal. 

Conduct under scrutiny

In March 2016, the FCO opened proceedings against Facebook for alleged abuse of dominance on the German market for social networks. The FCO's concerns centre on Facebook's practice of collecting user data from third party websites and apps (including Facebook owned services such as WhatsApp and Instagram) and combining this data with data from the user's Facebook account.

Whenever a third party website or app contains an embedded Facebook product (such as the "like" button, a "Facebook login" option, or an analytical service such as "Facebook Analytics"), data will be submitted to Facebook immediately when the user accesses the third-party website or app. This may be the case even if users do not click on the Facebook product and even if they have blocked web tracking in their browser or device settings.

This form of data collection and combination is based on Facebook's terms of service. Users need to consent to this in order to use the Facebook social network. The FCO found that such consent was not voluntary and therefore was insufficient: FCO President Andreas Mundt commented that "In view of Facebook's superior market power, an obligatory tick in the box to agree to the company's terms of use is not an adequate basis for such intensive data processing."

The conduct thus relates to the collection and processing of data from third party sources including Facebook-owned sources such as WhatsApp and Instagram. Collection and processing of user data exclusively on the Facebook social network was not within the scope of the investigation.

Exploitative business terms

The FCO found that Facebook has a dominant position on the German market for social networks (rejecting, for example arguments that services such as YouTube should be in the market as, despite some overlaps, they were not sufficiently similar).

The FCO concluded that the conduct outlined above was an abuse of this dominant position. There are two particularly interesting aspects of this finding:

First, the FCO concluded that this was an "exploitative abuse": the imposition of exploitative business terms. Historically, findings of exploitative abuse are relatively rare (other examples include excessive pricing).

Second, the FCO took into account data protection principles. It based this approach on case-law of the German Federal Supreme Court according to which any legal principle (e.g. civil or constitutional law) that is aimed at protecting one party from an unbalanced negotiating position may be taken into account when determining whether business terms are exploitative. The FCO considered that data protection law is aimed at protecting individuals from undue processing of their data by the opposite market side and therefore could be taken into account.

The FCO found that there was no effective justification under the data protection rules (in particular the General Data Protection Regulation ("GDPR")) for Facebook's practice of collecting and processing data from other Facebook-owned sources or third party sources. The FCO considered that this is neither required in order to fulfil contractual obligations nor does a balancing of interests result in the conclusion that Facebook’s interests in data processing outweigh the users’ interests.

The FCO also found that Facebook did not obtain any effective consent for its processing of the data. The FCO's president Andreas Mundt said in a press release (here) that "[t]he only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent." 

FCO finds harm for consumers and competition

The FCO identified harm for consumers in the loss of control of the users over how their personal data is used. The user can hardly foresee the extent to which the combination of data increases the importance of individual data. Further, due to Facebook's alleged market power, users cannot avoid such use of their data. The FCO considers this loss of control to be an infringement of German constitutional law.

The FCO identified harm for competition, on the user side of the market as the combination of data allows Facebook to optimise its own service and bind additional customers to its service, thereby increasing so called "identity based network effects" and "lock-in effects" to the detriment of other social networks. In addition, on the advertising side of the market, the FCO found that Facebook can use the data to improve its targeted advertising, making its social network indispensable for more and more advertising customers, to the detriment of advertising customers and competitors.

No fine but a roadmap for Facebook's data collection policy going forward

Given that the proceedings against Facebook are administrative proceedings (as opposed to criminal proceedings), the FCO has not imposed a fine. However, the FCO may still impose a fine if Facebook does not comply with the FCO's order.

It has ordered Facebook to adapt its terms of service and data processing. In particular, it has outlined a number of criteria where, in the absence of the user's voluntary consent, it may be necessary for Facebook to limit data collection/processing to a significant extent.

In this context, the FCO distinguishes Facebook owned services from third party services. In future:

• Whilst WhatsApp or Instagram may still collect data for each of their own services (without any need to amend its terms of service in this regard), Facebook may only combine this data with data from a user's Facebook account with the user's voluntary consent (as further explained below).
• As regards data from third party websites or apps Facebook may only collect and combine this data with the user's voluntary consent. Hence, with regard to third party services, Facebook needs to amend its terms of service both in relation to collection and combination of data.

Critically, in order for consent to be "voluntary", the FCO considers that Facebook cannot make use of the Facebook social network conditional upon such consent. In other words, consent is not deemed "voluntary" if the user is faced with the choice of either accepting the terms or not use Facebook's service at all. If the user does not grant such consent, Facebook is extremely restricted in the extent to which it can use the data. 

Next steps

Following the decision, Facebook is required to adapt its terms of service and data processing accordingly. Facebook will now have to develop possible solutions and submit these to the FCO within four months. The FCO will then assess whether the proposed solutions meet its requirements.

Facebook has already rejected the FCO's findings (see blogpost here) and announced that it will appeal. 

Comment and broader implication for digital companies

The FCO's decision raises important questions on the boundaries between competition law and data protection law. This goes in hand with the question of whether there is room for competition authorities to also enforce data protection law principles. The FCO – as this case has shown –clearly answers this question in the affirmative. It considers that it has a distinct responsibility with regard to data processing by dominant companies which – in its view – cannot be fulfilled by data protection officers/agencies. It notes for example that "Where access to the personal data of users is essential for the market position of a company, the question of how that company handles the personal data of its users is not only relevant for data protection authorities, but also for competition authorities." It also flags that it "closely cooperated with data protection authorities in this case which explicitly supported the authority’s proceeding".

It remains to be seen whether a similar approach will be taken by other competition authorities in Europe. Some commentators doubt whether the FCO's approach could be transferred to other jurisdictions, given its basis in German case-law. That said, the FCO has been in close contact with the European Commission and other national competition authorities during the proceedings. EU Competition Commissioner Margrethe Vestager has said that the Commission will study the FCO's decision with "great interest" (see here). The Austrian competition authority is reported to have stated that it "will evaluate how Facebook will behave in the near future”. Other competition authorities have also expressed interest in the decision. The European Data Protection Supervisor, Giovanni Buttarelli, considers the decision to be a "Big step towards coherent enforcement in the digital economy" and cautions that "This case is the tip of the iceberg - all companies in the digital information ecosystem that rely on tracking, profiling and targeting should be on notice" (here).

In relation to Germany, the FCO has been closely scrutinising companies in the digital sector. This decision is of significant importance for dominant data-heavy digital companies since it may further reduce their freedom of action.

Of particular practical importance is furthermore that the FCO adopted a very narrow market definition, both in terms of product (social networks) and geographic scope (national). Such an approach clearly helped the FCO substantiate its case against Facebook. Yet, narrow market definition increases the number of companies at risk of being found to be dominant and thus place a "special responsibility" – compliance burden – on those companies not to abuse that position.

More generally, digital companies are well advised to follow the activities of the FCO very closely. For several years, the FCO has shown increased activity in this area. This includes various initiatives such as the publishing of several working papers, including a joint paper with the French competition authority on Competition law and Data (here) and a working paper on market power of platforms and networks (here) as well as the launch of a sector enquiry into online advertising (here). Similar initiatives are supported by the German Ministry of Economics, which commissioned a study on "the modernisation of the control of abusive behaviour by companies with market power" (here) and in 2018 launched a "Commission Competition Law 4.0" (here) tasked with developing recommendations for further reform of German and European competition law. The commission will focus on policy questions arising in the context of the continuous development of the data economy, the spreading of platform markets and "industry 4.0". On 8 February 2019, the "Working Group on Competition Economics" – an initiative by the FCO – also discussed the need for modernisation of abuse of dominance in view of the "increasing market power of large digital platforms" (here).

In light of the FCO's Facebook decision, companies are advised to exert caution when gathering/processing user data. However, this decision is only one piece of the wider – and ongoing – picture of increased legislation/enforcement in the digital sector in Germany. This is likely to influence developments in other jurisdictions and therefore companies should monitor developments and seek to contribute to the development of policy.