EN Official Journal of the European Union C 286/6

Summary of Commission Decision

of 18 May 2017

imposing fines under Article 14(1) of Council Regulation (EC) No 139/2004 for the supply by an undertaking of incorrect or misleading information

(Case M.8228 — Facebook/WhatsApp (Art. 14(1) proc.))

(notified under document number C(2017)3192)

(Only the English version is authentic)

(2017/C 286/06)

On 17 May 2017 the Commission adopted a Decision under Council Regulation (EC) No 139/2004 of 20 January 2004 on the control of concentrations between undertakings (1), and in particular Article 14(1) of that Regulation. A non-confidential version of the full Decision can be found in the authentic language of the case on the website of the Directorate-General for Competition, at the following address: http://ec.europa.eu/comm/competition/index_en.html

I. INTRODUCTION

1. Facebook, Inc. (also referred to as ‘the Notifying Party’) is a provider of websites and applications for mobile devices (‘apps’) offering social networking, consumer communications and photo/video sharing functionalities. Facebook, Inc. also provides online advertising space. In particular, it offers the social networking platform, ‘Facebook’ (‘FB’), the consumer communications app, ‘Facebook Messenger’ (also referred to as ‘FBM’) and the photo and video-sharing platform, ‘Instagram’ (‘IG’). In the EEA, Facebook, Inc. operates via its wholly owned subsidiary Facebook Ireland Limited. Together, Facebook, Inc. and Facebook Ireland Limited are collectively hereinafter referred to as ‘Facebook’.

2. WhatsApp Inc. is a provider of consumer communications services via the mobile app, ‘WhatsApp’ (‘WA’). It does not sell advertising space, or the user data which it collects. WhatsApp Inc. has been a subsidiary of the Notifying Party since 6 October 2014.

3. The acquisition by the Notifying Party of sole control over WhatsApp Inc. within the meaning of Article 3(1)(b) of the Merger Regulation, which was reviewed by the Commission under case M.7217 — Facebook/WhatsApp and unconditionally cleared by decision of 3 October 2014, is hereinafter referred to as the ‘Transaction’. The Notifying Party and WhatsApp Inc. are jointly referred to as the ‘Parties’.

II. INFRINGMENTS

4. Recital 5 of the Commission Regulation (EC) No 802/2004 (2) (‘the Implementing Regulation’) states that: ‘It is for the notifying parties to make a full and honest disclosure to the Commission of the facts and circumstances which are relevant for taking a decision on the notified concentration.’

5. Article 3(1) of the Implementing Regulation provides that the notifications ‘shall be submitted in the manner prescribed by Form CO as set out in Annex I’ and Article 4(1) of that Regulation provides that the information contained in notifications ‘shall be correct and complete’. Annex I of the Implementing Regulation (Form CO) requires the following declaration to be signed by or on behalf of all the notifying parties: ‘The notifying party or parties declare that, to the best of their knowledge and belief, the information given in this notification is true, correct, and complete, that true and complete copies of documents required by Form CO have been supplied, that all estimates are identified as such and are their best estimates of the underlying facts, and that all the opinions expressed are sincere.’ (3)

6. Pursuant to Article 14(1) of the Regulation (EC) No 139/2004 (‘the Merger Regulation’), the ‘Commission may by decision impose on the persons referred to in Article 3(1)b, undertakings or associations of undertakings, fines […] where, intentionally or negligently: (a) They supply incorrect or misleading information in a submission, certification, notification or supplement thereto, pursuant to Article 4, Article 10(5) or Article 22(3). (b) They supply incorrect or misleading information in response to a request made pursuant to Article 11(2)’.

7. Within this legal framework and on the basis of the evidence contained in the case file, the Commission considers that with respect to the possibility to automatically match FB user identities (‘IDs’) with WA users' mobile phone numbers, Facebook, Inc. has: (a) at least negligently supplied incorrect or misleading information in a notification pursuant to Article 4 of the Merger Regulation in the context of Case No. M.7217 — Facebook/WhatsApp, and (b) at least negligently supplied incorrect or misleading information in response to a request made pursuant to Article 11(2) of the Merger Regulation in the context of case No. M.7217 — Facebook/WhatsApp.

a. Facts

8. Both before and after the notification related to case M.7217, the Commission asked questions to the Notifying Party in relation to the possibility to automatically match FB and WA accounts.

9. Specifically, during the prenotification phase, the Commission raised the issue of whether ‘[p]ost-acquisition, [the Notifying Party was] planning to link/match in any way customers' profiles on WhatsApp with these customers' profiles on Facebook (e.g. by linking customers' mobile numbers from WhatsApp to these customers' Facebook accounts)’ (4).

10. After the notification, during the Phase I investigation, the Commission received the paper by a third party complainant (the ‘Third Party Paper’). The Third Party Paper contained statements related to the possibility of Facebook aggregating user data between Facebook and WhatsApp using a ‘gateway’ between the Facebook and WhatsApp ‘platforms’ enabling cross-platform messaging, ‘without [the user] having to take any action’, or by ‘federating’ users' profiles with ‘a minimum user interaction required to grant Facebook access to the Whatsapp [sic] user ID (phone number)’. By the request for information (‘RFI’) of 18 September 2014, the Commission requested the Parties to ‘explain and substantiate whether [the Third Party Paper] accurately represent[ed] the technical ability (and incentive) of Facebook to integrate WhatsApp post-merger’ as well as to ‘provide any other comments [it] consider[ed] relevant’. (5)

11. In the response to the RFI of 18 September 2014 (submitted on 23 September 2014), the Notifying Party stated that ‘[t]he matching [of WhatsApp and Facebook users] would need to be done manually, by the users themselves — Facebook users would have to enter, validate and update their mobile phone numbers or WhatsApp users would need to register with Facebook and create Facebook IDs and profiles.’ (6) Moreover, the Notifying Party stated that ‘The issue is whether Facebook knows the one thing about the user (other than name) that WhatsApp also knows – the user's current mobile phone number(s). Nothing else in a user's Facebook profile will enable matching, and WhatsApp stores very little user data beyond the mobile phone numbers in the user's handset's native address book. The Paper baldly asserts that “[t]heir [sic] is minimum user interaction required to grant Facebook access to the WhatsApp user ID”. This is simply not true. Because it is not possible to “match” Facebook IDs with each WhatsApp mobile phone number ID associated with the individual user on an automated basis, the matching would need to be done manually, by users’. (7) Similar statements were included in the notification form (‘Form CO’).

12. At the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel were exploring ways to match IG and FB users. For this purpose, they were discussing the possibility to match users based on ‘Phone IDs’ and had already identified the ‘Phone ID Matching Solution’, which lies at the core of the user matching approach pursued by Facebook in connection with the update of WhatsApp's terms of service and privacy policy released in August 2016.

13. However, the availability of the Phone ID Matching Solution in 2014, and particularly at the time of the review of the Transaction, differed according to the type OS at issue (that is, iOS v. Android OS).

14. With respect to Android OS devices, at the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel had identified a mechanism to implement the Phone ID Matching Solution without having to change the applications' publisher.

15. With regard to iOS devices, at the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel were aware of the possibility of implementing the Phone ID Matching Solution by changing the applications' publisher.

16. Furthermore, although the efforts undertaken by Facebook personnel towards achieving user matching were specifically aimed at matching FB and IG accounts, the Phone ID Matching Solution and the mechanisms needed to implement it on the different OSs are potentially applicable to any application belonging to Facebook. Indeed, at the time of submitting the Form CO and the response to the RFI of 18 September 2014, Facebook personnel considered implementing the Phone ID Matching Solution to automatically match users across FB and WA once WhatsApp Inc. would be acquired by Facebook, Inc.

17. In addition, while Facebook's efforts were specifically aimed at matching FB and IG accounts for de-duplicating purposes, the Phone ID Matching Solution and its implementing mechanisms can equally be used to match users across Facebook apps for other purposes (e.g. for advertising purposes), but not for the purposes of enabling cross-platform integration or messaging.

b. Assessment

18. The Commission considers that the information provided in the Form CO and in the response to the RFI of 18 September 2014 was incorrect or misleading within the meaning of Article 4(1) of the Implementing Regulation and Article 14(1) of the Merger Regulation. This is beause, despite the availability of these automated matching solutions, during the investigation related to case M.7217 Facebook, Inc. stated that user matching between FB and WA would either (i) have to be done manually by FB/WA users, and would therefore be insufficient and unreliable; or (ii) require Facebook to significantly re-engineer the apps' code.

19. The Commission also considers that Facebook, Inc. acted at least negligently in supplying the incorrect and misleading information. Indeed, the Commission notes that at the time of the review of the Transaction and, in particular, when submitting the Form CO (on 29 August 2014) and the response to the RFI of 18 September 2014 (on 23 September 2014), Facebook, Inc. was aware or should have been aware that automated matching between a user's FB and WA accounts was or would have been possible. Moreover, Facebook, Inc. had been explicitly informed about the importance of supplying correct and not misleading information and warned about possible fines.

III. DECISION TO IMPOSE FINES

20. Article 14(1) of the Merger Regulation states that, in case of intentional or negligent infringement of the procedural obligations provided for in the subparagraphs (a) to (f) ‘[t]he Commission may by decision impose on the persons referred to in Article 3(1)b, undertakings or associations of undertakings, fines not exceeding 1 % of the aggregate turnover of the undertaking or association of undertakings concerned within the meaning of Article 5’.

21. As stated above, the Commission considers that Facebook, Inc. at least negligently supplied incorrect or misleading information in the Form CO in violation of Article 14(1)(a) of the Merger Regulation and Article 4(1) of the Implementing Regulation as well as in a response to an RFI pursuant to Article 11(2) of the Merger Regulation in violation of Article 14(1)(b) of the Merger Regulation. The Commission considers that these two submissions constitute two separate infringements of procedural obligations contained in the Merger Regulation and the Implementing Regulation, that those infringments are not time-barred, and that, therefore, fines should be imposed on Facebook, Inc. for these two infringements in accordance with Article 14(1)(a) and Article 14(1)(b) of the Merger Regulation. (8)

22. As regards the determination of the appropriate level of the fines to be imposed on Facebook, Inc., according to Article 14(3) of the Merger Regulation ‘[i]n fixing the amount of the fine, regard shall be had to the nature, gravity and duration of the infringement’.

23. As regards the nature of the infringments committed by Facebook, Inc., the Commission considers that they are of serious nature. A company's obligation to provide correct and non-misleading information in a merger investigation is essential for the Commission to review mergers effectively. Therefore, the provision of incorrect or misleading information in the Form CO or in replies to RFIs is in itself a serious infringement because it prevents the Commission from having information necessary for it to assess a transaction that has been notified to it.

24. As regards the gravity of the two infringements committed by Facebook, Inc., the Commission considers that the incorrect or misleading information was supplied at least negligently. The Commission also notes that, albeit relevant, the incorrect or misleading information provided by Facebook did not have any impact on the outcome of the Commission's clearance decision in Case M.7217.

25. As regards the duration of the infringements, the Commission considers that the provision of incorrect or misleading information is by nature an instantaneous infringement, which is committed in the very moment the incorrect or misleading information is supplied to the Commission. In this case, the Commission considers that Facebook, Inc. committed two infringements in two specific instances, namely on 29 August 2014 (when the Form CO was notified) and on 23 September 2014 (the date of the response to the RFI of 18 September 2014).

26. In addition, the Commission considers that the cooperative behaviour showed by Facebook in the course of the current proceedings can be considered as a mitigating factor in the determination of the amount of the fines. In June 2016, Facebook proactively approached the Commission, and then it acknowledged the essence of the facts and the infringements of Article 4(1) of the Implementing Regulation and Article 14(1) of the Merger Regulation, allowing administrative efficiencies in these proceedings. The Commission has not identified aggravating circumstances.

27. Finally, the Commission takes into account the need to ensure that fines have a sufficiently deterrent effect.

IV. CONCLUSION AND PROPOSAL

28. In view of all that precedes, the Decision concludes that: (a) With respect to the possibility of matching FB IDs automatically with WA users' mobile phone numbers, Facebook, Inc. at least negligently supplied incorrect or misleading information: i. in the Form CO in case M.7217 — Facebook/WhatsApp, and ii. in the response to the RFI of 18 September 2014 pursuant to Article 11(2) of the Merger Regulation in case M.7217 — Facebook/WhatsApp. (b) Given the circumstances of this case, the following fines should be imposed on Facebook, Inc.: i. EUR 55 million for the infringement falling within Article 14(1)(a) of the Merger Regulation and Article 4(1) of the Implementing Regulation, and ii. EUR 55 million for the infringement falling within Article 14(1)(b) of the Merger Regulation.

(1) OJ L 24, 29.1.2004, p. 1.

(2) Commission Regulation (EC) No 802/2004 of 21 April 2004 implementing Council Regulation (EC) No 139/2004 on the control of concentrations between undertakings (OJ L 133, 30.4.2004, p. 1).

(3) Implementing Regulation, Annex I, Form CO relating to the notification of a concentration pursuant to Regulation (EC) No 139/2004, Section 11.

(4) Fourth Set of Pre-Notification Questions, question 5.

(5) RFI of 18 September 2014. This RFI was sent by the Commission's services, to the Parties' legal representatives on 18 September 2014 at 7:12 PM CET by email titled ‘M.7217 — Facebook/WhatsApp — Request for Information’, and contained the following statement: ‘Please note that this is a formal request pursuant to Article 11(2) of Council Regulation (EC) No 139/2004 (the “Merger Regulation”). You will not receive any separate letter or fax Please note that Article 14 of the Merger Regulation provides for penalties up to 1 % of the aggregate turnover of the undertaking concerned for supplying incorrect or misleading information as a response to a request pursuant to Article 11(2) of the Merger Regulation.’ In the email the Commission also explained that the question had risen as ‘[i]n the course of the market investigation, [the Commission had] received [a] submission from a third party regarding the options for technical integration between Facebook and WhatsApp’, i.e. the Third Party Paper, which was attached to the RFI of 18 September 2014.

(6) Response to the RFI of 18 September 2014, p. 1. Similar statements were included in the Form CO, paragraphs 304-309.

(7) Response to the RFI of 18 September 2014, p. 5. Similar statements were included in the Form CO, paragraphs 304-309.

(8) The Commission considers that Facebook, Inc., but not WhatsApp Inc., is liable for both infringements as the relevant information lied in Facebook's sphere of influence.