German Federal Cartel Office bans Facebook’s data policy

1. The facts and the decision

The decision was passed on 7 February 2019 following a three-year investigation. The FCO has so far only published a press release and background paper, but not the actual decision itself, which, by all accounts, is several 100 pages long. Up till now Facebook has used the data of its various services (Facebook, WhatsApp, Instagram), as well as data collected from third-party websites, on the basis of its terms and conditions, respectively a general declaration of consent. By this, Facebook was able to use data from various sources for its most important source of revenue (online advertising).

According to the FCO’s decision, Facebook is still permitted to collect and use the data of its own group’s services for each service. However, the allocation of the data to the Facebook user’s account and thus the cross-platform use of the data is now only possible with the user’s express and voluntary consent. The user’s consent is also required for the collection of data from third-party websites and its allocation to the Facebook user’s account. Within a time of 12 months, Facebook must ensure that German users have a genuine possibility of choosing whether they do or do not consent to the collection and allocation of data to their user account.

Not affected by the decision is the processing of data collected during the actual use of the Facebook service.

2. Abuse of a market-dominating position

The FCO bases its decision on an abuse of a market-dominating position of Facebook – specifically on a so-called “abusive use of conditions” within the meaning of Sec. 19 German Act Against Restraints of Competition [Gesetz gegen Wettbewerbsbeschränkungen, GWB].

The FCO establishes Facebook’s market-dominating position on grounds of its quasi monopoly position on the German market for social networks. According to the FCO’s investigations, Facebook has a user share of more than 90%. The FCO decided not to include business networks (LinkedIn, Xing), messaging services and video platforms in the market for social networks, despite a certain overlap in the business model. The FCO is therefore of the opinion that there is no noteworthy competitive pressure from other providers – especially since the announced discontinuation of Google+.

Facebook is said to exploit this dominant position to the detriment of its users in a prohibited manner by making use of the social network dependent upon it being permitted to collect, without limitation, any and all kinds of user data from third-party sources and to combine it with the Facebook account. In the FCO’s opinion, the damage is particularly the user’s loss of control: In addition to the collection of data through the group’s own services such as WhatsApp and Instagram, a great deal of data flows to Facebook from third-party internet sites and apps without this always being recognisable to the user. This happens through integrated interfaces to Facebook (e.g. a “Like” button , even if this is not activated) or through the use of the analytics service “Facebook Analytics”. The user is no longer able to autonomously dispose over his personal data and can no longer tell which data is being used from which source for which purposes.

In the FCO’s opinion, Facebook’s data processing conditions are in contravention of the European General Data Protection Regulation (GDPR). Facebook therefore neither has any justification for collecting the data from any of the other services of its own group or business tools, nor for linking this data to the Facebook accounts.

3. Data as a substantial competitive factor

How can it be that a cartel authority, the competition watchdog, has now ascended to a “data protection authority”?

Firstly, the user data has considerable economic value for Facebook. By having more data on the respective users, Facebook is able to improve its targeted advertising because, for example, the profiles are more precise and extensive. The data and, in particular, its collection and utilisation, are therefore a substantial factor for Facebook’s position in competition.

Secondly, the approach of assuming an abuse of market power on grounds of a violation of legal valuations from other areas of law is not a new concept of German antitrust law. According to the jurisprudence of the Federal Court of Justice [Bundesgerichtshof, BGH] in the matter VBL-Gegenwert (only available in German), the unreasonableness of contractual conditions can also be reviewed on the basis of legal valuations, e.g. from the law governing general business terms and conditions, whose purpose is to protect a weaker contractual party in an imbalanced contractual position. Following up on this, the FCO examined Facebook’s contractual conditions on the basis of data protection law valuations and deemed them to be unreasonable. For the cartel authority, the contractual conditions - which are unilaterally detrimental to the user - are an unjustified exploitation of Facebook’s market power and thus constitute an “abusive use of conditions” within the meaning of Sec. 19 GWB.

4. The breaches of data protection law require more detailed discussion

The starting point for the application of Sec. 19 GWB was infringements of the applicable data protection law of the GDPR. However, these are not more specifically described in the previous publications of the Federal Cartel Office. The Federal Cartel Office has mentioned its close cooperation with data protection authorities. For the data protection experts the two points of attack therefore come as no surprise. European data protection authorities have criticised Facebook’s announced intention to use the databases of WhatsApp and Instagram, and, especially in the light of Facebook’s announcement to the contrary when it took over these enterprises, have demanded that these enterprises obtain an express declaration of consent from users for this. The integration of data from third parties via “social plug-ins” such as the „Like button” is the subject matter of disputes. A decision of the ECJ is expected soon on this issue. The key question according to the opinion of the Advocate General in this connection is, amongst others, the question of a sufficient legal basis as well as the need for express consent. In data protection law, a suitable legal basis for processing personal data must exist. For this reason, pursuant to the GDPR (and the previous data protection law) various alternatives exist, in particular the processing of data on grounds of legitimate interests pursuant to Art. 6 (1) letter (f) GDPR.

To be noted in this respect is that Recital (47) GDPR fundamentally acknowledges direct advertising (which is what we are dealing with here) as such a legitimate interest. Only in cases where this statutory criterion does not suffice (because of prevailing interests of the data subjects), can Facebook be ordered to obtain a declaration of consent. Insofar as consent pursuant to Art. 6 (1) letter (a) GDPR is then deemed mandatory, this in turn gives rise to various questions, in particular questions as to the scope of the information, i.e. whether the transparency is sufficient, how expressly such consent must be given and whether a consent to advertising can be linked to other declarations and is nevertheless voluntary, especially according to the criterion of Art. 7 (4) GDPR.

The answer to these questions and the Federal Cartel Office’s legal assessment are awaited with great anticipation. However, this gives rise to new and previously unanswered questions concerning jurisdictions and competences. Why has the Federal Cartel Office reached a decision on a factual matter that is currently being handled in proceedings before the ECJ? What are the various roles and competences of the Federal Cartel Office, the data protection supervisory authorities and the consumer protection associations (in our last ITC Newsletter we reported on the jurisprudence inter alia of the Higher Regional Court [Oberlandesgericht, OLG] of Hamburg (only available in German) on the question of whether breaches of data protection are capable of being cautioned). How can a binding and uniform jurisprudence on data protection be created in future in the light of the various channels of legal recourse for these different proceedings (cartel senate at the OLG Düsseldorf for decisions of the Federal Cartel Office, recourse to the administrative courts against decisions of the supervisory authorities, recourse to the civil courts against cautions)? Especially in view of the fact that Facebook has already announced its intention to file an appeal against the decision, the question of the need for submission to the ECJ with respect to the interpretation of the GDPR will be arising very soon.

5. Practical consequences

Ultimately, the FCO has not made a dogmatic paradigm shift in antitrust law with its Facebook decision. The only new feature is the attachment to the legal valuations of the GDPR (and not to the law governing general terms and conditions in particular, as was previously practised). The decision nevertheless has practical consequences.

Firstly, the abusive use of conditions, which has been more of an exotic back burner in practice to date, could become “socially acceptable”. In future, the cartel authorities and courts could take a more frequent look at disparities in general business terms and conditions. Enterprises in strong market positions should therefore check their contractual conditions for the presence of any clauses strongly in their own favour – and that is to say not only regarding data processing, but also regarding other contractual conditions.

Furthermore, the Facebook decision could also encourage the cartel authorities of other countries to take a similar course and give greater consideration in future to data protection (or principles from other areas of law). Because of the cross-border aspects of the case, the FCO has collaborated closely with other cartel authorities, including the European Commission. This indicates that there could be a certain consensus between the cartel authorities as regards the outcome of the case.

In terms of data protection, this means even greater confusion over competences and greater ambiguity when interpreting the GDPR, which can probably only be resolved through corresponding decisions of the ECJ. In future, enterprises operating in Germany will not only have to bear in mind 17 different data protection supervisory authorities and consumer protection associations with their practice of issuing cautions, but also the FCO as a “supervisor of data protection”.

Facebook has already announced its intention to appeal against the decision of the FCO. It remains to be seen whether the competent High Regional Court of Düsseldorf will share the opinion of the cartel authority.

Back to list