Executive Summary of the Preliminary Opinion of the European Data Protection Supervisor on privacy and competitiveness in the age of big data
Date: 2014-03-26
Institutions: European Data Protection Supervisor
Subjects: competitiveness, consumer protection, data protection, electronic commerce, protection of privacy








C_2014225EN.01000601.xml










16.7.2014   


EN


Official Journal of the European Union


C 225/6





Executive Summary of the Preliminary Opinion of the European Data Protection Supervisor on privacy and competitiveness in the age of big data
(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)
(2014/C 225/07)
SUMMARY
EU approaches to data protection, competition and consumer protection share common goals, including the promotion of growth, innovation and the welfare of individual consumers. In practice, however, collaboration between policy-makers in these respective fields is limited.
Online services are driving the huge growth in the digital economy. Many of those services are marketed as ‘free’ but in effect require payment in the form of personal information from customers. An investigation into the costs and benefits of these exchanges for both consumers and businesses is now overdue.
Closer dialogue between regulators and experts across policy boundaries can not only aid enforcement of rules on competition and consumer protection, but also stimulate the market for privacy-enhancing services.
1.   Introduction









1.


The digital economy holds many advantages for consumers and citizens. Online services offer unprecedented scope for social connections, innovation and efficient problem-solving. At the same time, users of these services disclose masses of information about themselves. The volume and variety of data generated cannot be handled by traditional data mining and analysis technologies, but control of this information is now increasingly possible thanks to the development known as ‘big data’ (1). Extracting value from big data has become a significant source of power for the biggest players in internet markets. Not all big data is personal, but for many online offerings which are presented or perceived as being ‘free’, personal information operates as a sort of indispensable currency used to pay for those services. As well as benefits, therefore, these growing markets pose specific risks to consumer welfare and to the rights to privacy and data protection.












2.


EU principles and rules on data protection, competition and consumer protection have been designed to promote a thriving internal market and to protect the individual. Greater convergence in the application of these policies could help meet the challenges posed by the big data economy. However, to date, policies have tended to develop in parallel with little interaction on subjects of common concern (2). Moreover, EU policy makers and regulators have until now typically focused on markets for products and services traded in exchange for money. As consumers and businesses both adapt to and propel constant changes in technology, there is an onus on policymakers and regulators to keep pace, as reflected in the recent political commitment to the ‘completion’ of the ‘Digital Single Market’ (3).












3.


The EDPS promotes a ‘data protection culture’ in EU institutions and bodies where data protection principles find expression in all relevant areas of policy and law (4). As a contribution to that aim, this preliminary Opinion seeks to stimulate a dialogue between experts and practitioners, including EU institutions and national regulatory authorities from the competition, consumer protection and data protection fields. The EDPS will then reflect on the views and ideas arising from this exercise in a follow-up Opinion and include recommendations for action.












4.


Chapter 2 of this Opinion begins by outlining trends in the digital economy and the role of personal data in the age of big data. Chapter 3 addresses the relevant aspects of EU rules on data protection, competition and consumer protection. Chapter 4 presents an analysis of the interrelations between the three policy areas:






—


how the control of personal information contributes to market power in the digital economy and the implications for data protection;










—


the risks to the consumer posed by concentrations and the abuse of market dominance where firms process massive amounts of personal data; and










—


how the growth of a vibrant market for privacy–enhancing services (5) can be encouraged by strengthening informed consumer choice.




The importance of joined-up thinking, enforcement and cooperation between supervisory authorities at international, EU and national level is also emphasised (6).












5.


In conclusion, Chapter 5 looks ahead to possible policy responses, and invites the Commission, national supervisory authorities, advocacy groups and legal practitioners to engage in a broader and deeper discussion on this matter. At the start of each section, bullet points and cross references aim to guide the reader through the key arguments and intersections between the three areas of EU law. A summary of these interfaces is presented in the Annex to this document.




5.   Conclusion: further investigation and discussion required


The rapidly expanding online market or markets… increasingly touch all aspects of business. Making sure competition works effectively in these markets will be a major priority… the growing collection, processing and use of consumer transaction data for commercial ends …is proving an increasingly important source of competitive advantage [which could be] an increasing source of consumer detriment.

(From Beesley Lectures speech by David Currie, chairman of UK Competition and Markets Authority, 7.11.2013).








85.


This preliminary Opinion has explored and considered the possible convergences and tensions between three areas of EU law, against the fast evolving backdrop of big data. Although privacy and the protection of personal data are public interests and fundamental rights recognised in the Treaties, the lack of interaction in the development of policies on competition, consumer protection and data protection may have reduced both the effectiveness of competition rules’ enforcement and the incentive for developing services which enhance privacy and minimise potential for harm to the consumer. In the digital economy personal information represents a significant intangible asset in value creation and a currency in the exchange of online services. This has potentially far-reaching implications for the interpretation of key concepts including transparency, market dominance, and consumer welfare and harm.












86.


A comprehensive response to these challenges requires more time for investigation, reflection and discussion, but might include any or all of the following:






—


raised awareness among consumers, service providers and regulators of current and future technological developments in relevant markets in the digital economy and the implications for competitiveness, consumer welfare and choice and innovation around privacy-enhancing services;










—


effective guidance on the application of privacy, competition and consumer protection rules for online services, in particular those promoted as ‘free’ services, which takes into account the views of customers and competitors and evidence of customer preferences and concerns;










—


cooperation between authorities in investigation and enforcement, for example in identifying scenarios and possible standards for measuring market power in the digital economy, and consultation on investigations into individual cases; and










—


a review of competition legislation for 21st century digital markets, including its interfaces with other areas of law and possibilities for productive interaction with other relevant authorities.
















87.


Personal information has prompted and sustained growth in the digital economy. Individual consumers should be able to enjoy a fairer share of the fruits of that growth. Competition and data protection authorities are increasingly recognising this as a pivotal challenge in building trust and accountability across the digital economy. Data protection presents a unique opportunity to give individuals the tools to protect themselves and to make the enforcement of competition and consumer protection rules more effective.












88.


The next step is to explore the scope for closer coordination between regulators to achieve these aims. This coordination should not be restricted to Europe but rather reflect the global reach of companies in the digital economy. The EDPS looks forward to facilitating this discussion.





Done at Brussels, 26 March 2014.

Peter HUSTINX

European Data Protection Supervisor





(1)  Big data ‘refers to gigantic digital datasets held by corporations, governments and other large organisations, which are then extensively analysed using computer algorithms’; Article 29 Working Party, Opinion 03/2013 on purpose limitation, p. 35. According to an alternative definition, big data means ‘datasets whose size is beyond the ability of typical database software tools to capture, store, manage, and analyse’; McKinsey Global Institute, ‘Big data: The next frontier for innovation, competition, and productivity’, June 2011. In this preliminary Opinion ‘big data’ is used as shorthand for the combination of massive personal data collection and analytics on high variety, high volume datasets.

(2)  This preliminary Opinion develops the themes outlined by the EDPS at a seminar in Brussels on 13 June 2013 https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/Publications/Speeches/2013/13-06-13_Speech_CB_Brussels_EN.pdf. Related discussions took place in 2010 at the 32nd International Conference of Data Protection and Privacy Commissioners in Jerusalem. Moreover, Commission Vice-President Joaquin Almunia gave a speech on ‘Competition and privacy in markets of data’ in November 2012 (http://europa.eu/rapid/press-release_SPEECH-12-860_en.htm). In February 2013 at the New Frontiers of Antitrust 4th International Concurrences Conference, following a roundtable discussion on the subject ‘Personal data: Will competition law collide with privacy?’, the Commission Director-General for Justice called for greater consideration to be given to the interaction between data protection and competition law; Françoise Le Bail entitled ‘Protection de la vie privée et des données personnelles: l’Europe à l’avant garde’, Concurrences Revue des droits de la concurrence: Competition Law Journal: Demain la concurrence New Frontiers of Antitrust Colloque l Concurrences, No 2-2013. A similar debate in the United States has been ongoing in particular since the Federal Trade Commission decision on the Google DoubleClick merger (see footnote 76) and the dissenting opinion of then Commissioner Jones Harbour http://www.ftc.gov/sites/default/files/documents/public_statements/statement-matter-google/doubleclick/071220harbour_0.pdf; for an update on Ms Harbour’s analysis see her essay ‘The Transatlantic Perspective: Data Protection and Competition Law’, in Data Protection Anno 2014: How to Restore Trust? eds. Hijmans, H. and Kranenborg, H., 2014, pp. 225-234.

(3)  The European Council in October 2013 committed to ‘complete the Digital Single Market’ by 2015 including ‘the right framework conditions for a single market for Big Data and Cloud computing’, by developing e-government, e-health, e-invoicing and e-procurement, by the acceleration of e-identification and trust services, e-invoicing and payment services, and by the portability of content and data; http://www.consilium.europa.eu/uedocs/cms_data/docs/pressdata/en/ec/139197.pdf. The EDPS has issued an Opinion on the EU umbrella policy programme of Digital Agenda for Europe; https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2013/13-04-08_Digital_Agenda_EN.pdf

(4)  See EDPS Strategy 2013-2014: ‘Towards excellence in data protection’; https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/Publications/Strategy/13-01-22_Strategy_EN.pdf. In addition to Opinions regularly issued in response to legislative proposals or policy documents adopted by the Commission or other institutions or bodies under Article 28.2 of Regulation (EC) No 45/2001, and as part of his role of advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data under Article 41(2), the EDPS may decide to issue advice on his own initiative with a view to contributing to debates on legal and societal developments that may have a major impact on the protection of personal data. For example, see the EDPS Opinion on the relationship between cloud computing and the data protection legal framework (OJ C 253, 3.9.2013, p. 1). Similar advice on other areas of concern may be issued.

(5)  Privacy-enhancing technologies have been defined by the Commission as ‘a coherent system of information and communication technology measures that protect privacy by eliminating or reducing personal data or by preventing unnecessary and/or undesired processing of personal data without losing the functionality of the information system.’‘Promoting Data Protection by Privacy Enhancing Technologies (PETs)’, COM(2007) 228 final. In this document, the term ‘privacy-enhancing services’ is used to refer to customer services which have been designed on the basis of such technology.

(6)  This includes liaison within and between the Global Privacy Enforcement Network, International Competition Network as well as deeper collaboration between EU authorities and the US Federal Trade Commission.


ANNEX
Data protection, competition and consumer protection in the EU: A comparative overview









 


Data protection


Competition law


Consumer protection


Interfaces in digital economy




Legal framework








—


CFR Arts. 7 and 8










—


TFEU 16












—


TFEU 101-106












—


CFR 38










—


TFEU Arts. 12 and 169












—


Core EU values and economic mission








Relevant secondary legislation








—


Directive 95/46/EC










—


Regulation (EC) No 45/2001










—


Directive 2002/58/EC










—


General Data Protection Regulation (under negotiation)












—


Regulation (EC) No 1/2003 (Modernisation)










—


Regulation (EC) No 139/2004 (Mergers)












—


Directive 93/13/EEC (unfair contract terms)










—


Directive 98/6/EC (price indication)










—


Council Directive 2005/29/EC (unfair commercial practices)










—


Directive 2006/114/EC (misleading advertising)










—


Regulation (EC) No 2006/2004 (cooperation between authorities)










—


Directive 2011/83/EU (Consumer Rights)












—


Rules for promoting sound functioning of the internal market.










—


Rules for ensuring protection of individual consumers








Scope of application








—


All data controllers established in the EU or using equipment situated in the EU. Provisions scalable according to the nature and volume of data processed.










—


(To be extended under GDPR to cover any data controller offering goods or services to or monitoring behaviour of data subjects residing in the EU)












—


Any economic activity which ‘may affect trade between Member States.’










—


Dominant undertakings have ‘special responsibility’ to avoid distortions to competition.












—


All goods and services supplied or consumed in the internal market.












—


Impact on individuals in the EU of economic activity which concerns the internal market








Data control and relevant markets








—


Compatible purposes for data processing












—


Definition of relevant market and substitutability of products and services






 








—


Defining relevant markets fuelled by personal data










—


Measuring digital market power








Transparency and choice








—


Rights to information and to access data in an intelligible form










—


Freely-given, specific, informed and unambiguous consent










—


Right to data portability












—


Tying and bundling of services










—


Preventing competition through refusal to supply an essential facility












—


Clear and intelligible information on prices and products












—


Common understanding of value of personal data










—


Ownership of own data through exercising data portability








Prevention of harm








—


Data minimisation










—


Confidentiality and security of processing












—


Notion of consumer welfare










—


Exploitative pricing of services










—


Theory of harm to consumers in mergers










—


Exemptions to state aid rules












—


Notion of ‘good faith’ in contracts










—


Prohibition of misleading claims about products and services












—


Data protection a factor of consumer welfare










—


Use of privacy-promoting remedies in competition decisions










—


Allowing competitors to collaborate on developing privacy-enhancing services








Supervision, enforcement, sanctions remedies








—


Independent national authorities










—


EU wide cooperation through Article 29 Working Party and (under negotiation) consistency mechanism










—


Right to a judicial remedy for violation of rights










—


Right to receive compensation










—


Administrative sanctions as a proportion of a company’s annual turnover (under negotiation)












—


Enforcement through national competition authorities and the Commission for the EU










—


Authorities cooperate through European Competition Network










—


Sanctions for infringement of anti-competitive agreements of up to 10 % of total turnover










—


No harmonisation of rights to judicial remedy for consumers












—


National authorities only










—


CPC Network identifies common enforcement priorities each year with coordinated compliance checks and sector specific projects










—


No common EU approach to investigation of breaches of consumer law except for ‘intra-Community infringements’










—


Rare for authorities to secure compensation for breaches of consumer law












—


Dialogue and cooperation on cases where competition, consumer welfare and data protection concerns overlap.








Abbreviations:
CFR: Charter of Fundamental Rights of the European Union
TFEU: Treaty on the Functioning of the European Union