Source: https://www.competitionpolicyinternational.com/cpi-eu-news-fco-facebook-quadriptych/
Timestamp: 2019-04-18 22:17:06+00:00

Document:
In early February 2019, the German Bundeskartellamt (“FCO”) announced its highly anticipated and “ground-breaking” Facebook decision. CPI EU News is pleased to present a Quadriptych of four short articles on this hot topic from a great panel of authors.
Some authors argue that the decision “ultimately pushes competition law far beyond its natural confines.” Others opine that the case “may represent an important step into European competition law’s future in digital markets.” What consequences might this case have beyond Germany?
On February 6, 2019, the German Bundeskartellamt decided its long-awaited Facebook case, kicking off what promises to be years of litigation. Next stop: Higher Regional Court of Düsseldorf.2 As the decision is not yet publicly available, what we know so far stems from three documents that the Bundeskartellamt has published so far: a press release, a background paper, and a case summary.3 For competition lawyers, this means that some reading between the lines is necessary in order to understand the essence of the case: the theory of harm it relies on. This is worth the while, as Facebook may represent an important step into European competition law’s future in digital markets.
The Bundeskartellamt takes issue with Facebook’s practice of third-party tracking, i.e. its collection of personal user data through the tracking of user behavior on other websites or applications.4 The German authority found that third-party data is made available to Facebook in a number of instances, e.g. when users use digital services that are owned by Facebook, such as WhatsApp or Instagram; when a third-party website embeds visible Facebook interfaces such as the “Like” or the “Share” buttons – even if the user does not click on any such option; and also when a website relies on Facebook Analytics without this being visible to the user. In order for Facebook to track user behavior, the user does not need to be logged onto or registered with Facebook. By combining extensive third-party data sets with the data it gathers through its own website and applications, Facebook is able to turn multi-source data into comprehensive user profiles. Users do not freely agree to this practice, as theirs is an all-or-nothing choice: Either access Facebook’s popular social networking services and accept its exploitative data practices, or be shut out from that dominant social network. In the eyes of the Bundeskartellamt, this does not represent voluntary consent.
For the Bundeskartellamt, Facebook has a special responsibility under the competition laws due to its dominant position on the German market for social networks. The case rests on the finding that Facebook abused its dominant position through the extent to which it collects, uses, and merges data in user accounts. This amounts to an exploitative abuse akin to excessive prices, with the twist that in this digital market, it is excessive data that is being collected.
At a time at which data is widely regarded as the new oil of the economy, and users pay for digital services with their personal data (and their eyeballs) rather than with money, there is a possibility that digital platforms exploit users through excessive data collection. Through amendments of its Competition Act, the German legislature has already drawn attention to the importance of data for competition law: Under Section 18(3a) of the Act, the assessment of a company’s market position in multi-sided markets should now consider access to data that is relevant to competition. In addition, the Act also recognizes in Section 18(2a) that a relevant antitrust market may exist where a service is provided free of charge in monetary terms. The Facebook decision is the first major case that navigates the question of what type of abuse merits antitrust scrutiny in the data-driven digital environment. In Europe, competition law has mostly neglected exploitative abuses in recent years. With the Facebook case, this may be set to change.
The Bundeskartellamt’s analysis of the abuse of dominance relies on the asymmetry in the bargaining power between Facebook and its users.9 Users are overwhelmingly unaware of the extent of third-party tracking and of the value of their personal data that Facebook gathers, merges and exploits commercially. Facebook, on the other hand, relies on personal user data for its commercial success, which in turn reinforces its dominant market position. By relying on this imbalance, the authority makes its case for an exploitative abuse. The authority also believes that Facebook’s data practices inflict competitive harm on advertising customers and competitors.
The German authority relies on judgments by the German Bundesgerichtshof in which the latter held contract terms to be abusive within the meaning of competition law if they violated the German Civil Code. The authority argues that this must also hold true for violations of data protection rules.13 Under European competition law, one might look to cases such as SABAM or Duales System Deutschland in order to establish benchmarks for data policies that are unfair within the meaning of Article 102(a) TFEU. These cases show that while exclusive data collection may constitute a new type of abuse, it can rely on precedent in order to flesh out the theory of harm that it relies upon.
This analysis, it would seem, can be transferred to the data exploitation that is at issue in Facebook. It is also in line with the view of the EU’s data protection advisory body, which holds that the collection of personal data may be unfair where third-party tracking goes beyond the user’s reasonable expectations.16 Under EU competition law, the respective bargaining power of users on the one side and the social network on the other, as well as the proportionality between what a user gives in terms of third-party data and what he receives in return, will need to be at the heart of any such analysis.
1 Viktoria H.S.E. Robertson is an Assistant Professor in Law at the University of Graz.
2 Facebook has already appealed the decision; Bundeskartellamt, Case Summary: Facebook, Exploitative Business Terms Pursuant to Section 19(1) GWB for Inadequate Data Processing (February 15, 2019) at 12, https://www.bundeskartellamt.de/SharedDocs/Entscheidung/EN/Fallberichte/Missbrauchsaufsicht/2019/B6-22-16.pdf?__blob=publicationFile&v=3.
3 Bundeskartellamt, Bundeskartellamt Prohibits Facebook from Combining User Data from Different Sources (February 7, 2019), https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook.html; Bundeskartellamt, Background Information on the Bundeskartellamt’s Facebook Proceeding (February 7, 2019), https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook_FAQs.html; Bundeskartellamt, Case Summary, supra note 2.
4 See already Ariel Ezrachi & Viktoria HSE Robertson, Competition, Market Power and Third-Party Tracking, 42 World Competition (forthcoming 2019), pre-print version available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3272552.
5 Bundeskartellamt, Background Information, supra note 3, at 6.
6 Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR)  OJ L119/1, Recital 43.
7 Bundeskartellamt, Case Summary, supra note 2, at 11.
8 See Ezrachi & Robertson, Third-Party Tracking, supra note 4.
9 Bundeskartellamt, Background Information, supra note 3, at 5; Bundeskartellamt, Case Summary, supra note 2, at 8.
10 Gesetz gegen Wettbewerbsbeschränkungen (German Competition Act), Federal Law Gazette Nr I 2013/1750, as last amended; Bundeskartellamt, Case Summary, supra note 2, at 7.
11 Treaty on the Functioning of the European Union (TFEU)  OJ C202/47; Council Regulation (EC) No 1/2003 of December 16, 2002 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty  OJ L1/1, art 3(2).
12 Bundeskartellamt, Background Information, supra note 3, at 6.
13 Bundeskartellamt, Case Summary, supra note 2, at 7 f.
14 Case 127/73 BRT v. SABAM EU:C:1974:25, para 15.
15 Duales System Deutschland (Case COMP/34.493) Commission Decision of April 20, 2001  OJ L166/1, para 112. Upheld on appeal in Case T-151/01 Duales System Deutschland EU:T:2007:154; Case C-385/07 P Duales System Deutschland EU:C:2009:456.
16 Article 29 Data Protection Working Party, Opinion 03/2013 on Purpose Limitation (April 2, 2013) at 13, https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2013/wp203_en.pdf.
On February 6, 2019, the Bundeskartellamt (Federal Cartel Office – “FCO”) ruled that Facebook abused its dominant position as a social network in Germany by imposing exploitative business terms on its counterparties, Facebook users. The terms highlighted by the FCO allow Facebook to collect and combine data from non-Facebook services such as Facebook’s subsidiaries WhatsApp and Instagram, and from non-owned third-party sites.
The case is ground-breaking because it is the first to establish an infringement of competition law rules because practices were in conflict with data protection principles. We review this finding, and consider the potential for the approach to gain traction outside Germany.
This exploitative abuse of Facebook’s users is, however, not only a GDPR issue but relevant also for the dynamics of the market, because “the conduct of online businesses is highly relevant from a competition law perspective.”15 Social networks are, the FCO notes, data-driven products, and access to personal data of users is thus essential for a social network’s market position. On that basis, the question of how a company handles personal data is not only a data protection concern but also an economic issue, and thus one relevant for competition authorities. We return to this below.
The FCO concluded that Facebook’s processing of data from third-party sources is not required to operate the social network or to monetize the social network because, as a personal network, this could largely be based on the data obtained through the user’s interaction with the Facebook platform itself.16 The FCO therefore required Facebook to either seek effective voluntary consent from its users for the extensive data collection; or allow users to have a Facebook account without consenting to that wider collection.17 Facebook has appealed the FCO decision.
Indeed the DOJ’s head of antitrust has recently given a ringing endorsement of the principle, contrasting with an earlier absence of U.S. enthusiasm.24 As mentioned by the FCO,25 the Facebook decision also responds to recent reforms to the German Competition Act which made it explicit that access to data is a relevant factor to assess market dominance: “In particular in the case of multi-sided markets and networks, in assessing the market position of an undertaking account shall also be taken of … 4. the undertaking’s access to data relevant for competition.”26 This statutory amendment puts to rest any German debate on the issue,27 but the point is in any event beyond doubt in other jurisdictions.
Based on the available materials, the FCO has conducted an analysis of direct and indirect network effects based on the concentration of data and foreclosure of rivals. It is obvious that data collection and processing are in that respect economic activities which are relevant under competition law. The detail of that analysis will be of interest, once the full decision is available for the demonstration of market power and foreclosure effects, going beyond the loss of choice for private users resulting from Facebook’s exploitative business terms. While the headlines greeting the case have focused on the GDPR nexus, this part of the decision, based on more familiar economics, is also of great significance.
2 Our discussion is based on the materials published by the FCO to date, i.e. the FCO’s press release, background paper and summary decision: Bundeskartellamt’s press release: Bundeskartellamt prohibits Facebook from combining user data from different sources (February 7, 2019), available at https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook.pdf?__blob=publicationFile&v=2; Facebook FAQ, Background information on the Bundeskartellamt’s Facebook proceeding (February 7, 2019), available at https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook_FAQs.pdf?__blob=publicationFile&v=6.; B6-22/16 – Facebook, Exploitative business terms pursuant to Section 19(1) GWB for inadequate data processing (February 15, 2019), available at https://www.bundeskartellamt.de/SharedDocs/Entscheidung/EN/Fallberichte/Missbrauchsaufsicht/2019/B6-22-16.pdf?__blob=publicationFile&v=3.
3 B6-22/16 – Facebook, p. 2.
7 Id. p.5-6. See also Facebook FAQ Background information, p. 3.
8 Bundeskartellamt’s press release: Bundeskartellamt prohibits Facebook from combining user data from different sources (February 7, 2019), p.2, https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook.pdf?__blob=publicationFile&v=2.
9 B6-22/16 – Facebook, Exploitative business terms pursuant to Section 19(1) GWB for inadequate data processing (February 15, 2019), p. 9-11, https://www.bundeskartellamt.de/SharedDocs/Entscheidung/EN/Fallberichte/Missbrauchsaufsicht/2019/B6-22-16.pdf?__blob=publicationFile&v=3.
10 KZR 58/11, VBL-Gegenwert I, 2013; KZR 47/14, VBL-Gegenwert II, 2017 and B6-22/16 – Facebook, p. 8.
11 KZR 6/15, Pechstein v. International Skating Union, 2016 and B6-22/16 – Facebook, p. 8.
12 B6-22/16 – Facebook, p. 9.
22 AT.40099, Android, unpublished. The Commission’s Google Android decision considered how Google’s different abuses contributed to a continuous flow of data for its advertising service. See, e.g. Commission fines Google €4.34 billion for illegal practices regarding Android mobile devices to strengthen dominance of Google’s search engine (July 18, 2018), http://europa.eu/rapid/press-release_IP-18-4581_en.htm.
23 Margrethe Vestager, European Commissioner for Competition, Speech at the Youth and Leaders Summit in Paris: New technology as a disruptive global force (January 21, 2019), https://ec.europa.eu/commission/commissioners/2014-2019/vestager/announcements/new-technology-disruptive-global-force_en.
24 Makan Delrahim, Assistant Attorney-General, Speech at the Silicon Flatirons Annual Technology Policy Conference at The University of Colorado Law School: “I’m Free”: Platforms and Antitrust Enforcement in the Zero-Price Economy (February 11, 2019), https://www.justice.gov/opa/speech/assistant-attorney-general-makan-delrahim-delivers-keynote-address-silicon-flatirons. See also Barry Nigro, Deputy Assistant Attorney General, Speech at the Capitol Forum and CQ’s Fourth Annual Tech, Media & Telecom Competition Conference (December 13, 2017), https://www.justice.gov/opa/speech/deputy-assistant-attorney-general-barry-nigro-delivers-remarks-capitol-forum-and-cqs.
25 Facebook FAQ, Background information on the Bundeskartellamt’s Facebook proceeding (February 7, 2019), p. 7, https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook_FAQs.pdf?__blob=publicationFile&v=6.
26 Act against Restraints of Competition (Competition Act – GWB), section 18(3a), http://www.gesetze-im-internet.de/englisch_gwb/.
27 The reform improved the application of the German Act against Restraints of Competition to the digital industry and confirmed the importance of data in that sector. Deutscher Bundestag, Gesetzentwurf der Bundesregiering: Entwurf eines Neunten Gesetzes zur Änderung des Gesetzes gegen Wettbewerbsbeschränkungen, Drucksache 18/10207 (December 7, 2016), p. 48-51, available at http://dipbt.bundestag.de/doc/btd/18/102/1810207.pdf.
29 Facebook FAQ, p. 3-4.
34 Bundeskartellamt prohibits Facebook from combining user data from different sources (Feb. 7, 2019), p. 3, https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook.pdf?__blob=publicationFile&v=2.
35 Facebook FAQ, p. 4-5.
37 Autorité de la concurrence : Avis n° 18-A-03 du 6 mars 2018 portant sur l’exploitation des données dans le secteur de la publicité sur internet, (March 6, 2018), http://www.autoritedelaconcurrence.fr/pdf/avis/18a03.pdf and Bundeskartellamt, Bundeskartellamt launches sector inquiry into market conditions in online advertising sector, (February 1, 2018), https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2018/01_02_2018_SU_Online_Werbung.html.
39 M.6314, Telefonica UK/Vodafone UK/Everything Everywhere/JV, http://ec.europa.eu/competition/mergers/cases/decisions/m6314_20120904_20682_2898627_EN.pdf.
42 Charter of Fundamental Rights of the European Union, 2000 OJ C 364/10, art. 8.
43 Preliminary Opinion of the European Data Protection Supervisor, Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy, (March 2014), https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2014/14-03-26_competitition_law_big_data_EN.pdf.
44 Alec Burnside, No Such Thing as a Free Search: Antitrust and the Pursuit of Privacy Goals, Competition Policy International [CPI] 2 (2015).
46 Khushita Vasant, German Facebook decision reverberates through European antitrust agencies, PaRR, February 8, 2019, https://app.parr-global.com/intelligence/view/prime-2782635.
On February 6, 2019, the German Bundeskartellamt (“FCO”) concluded that Facebook had infringed German competition law by violating the European General Data Protection Regulation (“GDPR”).2 The decision, a Russian doll of sorts, uneasily straddles the line between competition policy and data protection (which lies outside of the FCO’s competence). It ultimately pushes competition law far beyond its natural confines and takes an unduly restrictive view of various provisions contained in the GDPR.
Second, this practice allegedly violated Europe’s GDPR.5 Article 6 of the GDPR sets out a limited number of grounds upon which companies may lawfully process data. These notably include “user consent” and “necessity for the performance of the underlying contract.”6 According to the FCO, Facebook’s behavior did not fall within one of these limited justifications. Of these requirements, Facebook’s alleged failure to obtain users’ consent is perhaps most surprising. Though Facebook’s terms of service did provide for this eventuality, the FCO argued that “take it or leave it” offers could not be equated with consent.7 In other words, users’ consent was only valid if they could opt-out of some terms while maintaining access to the Facebook platform. According to the FCO, this was not the case here.
Failure to successfully appeal the decision would have important ramifications for Facebook’s business in Germany. In order to comply with the decision, Facebook must either refrain from combining data from third-party websites with user profiles, or obtain users’ “consent” to do so (presumably by giving them the option to opt out of this specific processing). The latter option seems far more likely.
Given the potential impact of these design choices on Facebook’s business model and profitability, it is no surprise that it has decided to appeal the FCO’s decision.11 In that respect, Facebook has a key advantage. Because the FCO’s decision rests on both German competition law and the GDPR, Facebook will be able to rely on both sets of provisions to sustain its appeal.
The late Justice Scalia famously warned that it is wrong to conflate the goals of regulation and those of antitrust enforcement.12 The FCO’s Facebook decision is proof, if any were need, that he was onto something. Not only does the case extend German competition law far beyond its natural limits, it also marks a wholly unnecessary foray into the intricacies of data protection regulation (which should have been left to competent data protection authorities).
For a start, the decision is bad as a matter of competition policy. There is tremendous value in being able to integrate services, such as Facebook’s, within third-party websites (notably via “like,” “share,” and “login” buttons). For instance, functions like Facebook’s secure login makes it much faster to register on third-party websites, potentially increasing competition to the benefit of consumers. It is thus eminently desirable that Facebook be allowed to earn something in return for this valuable product (potentially in the form of data).
Critics may retort that users are insufficiently informed to make these decisions, and they may well be right. But assessing whether companies’ data policies are clear and transparent is the mission of Europe’s data protection authorities, not the FCO.13 The GDPR notably requires that every member of a national supervisory authority has “the qualifications, experience and skills, in particular in the area of the protection of personal data, required to perform its duties and exercise its powers.” This is simply not the case for the FCO. In other words, the FCO is only competent to review data protection issues insofar as they have anticompetitive effects.
Which brings us to the next problem with the FCO’s decision. Though exploitative abuses (such as the one in this case) are undeniably a part of the European legal landscape, they are usually confined to behavior that is made possible by a firm’s market power. The FCO saw fit to ditch this rule in favor of a much looser requirement that Facebook’s alleged infringement of the GDPR “impedes competitors.”14 But that is true of virtually all violations of law. If one believes – as argued by Gary Becker15 – that firms disobey the law because it increases their profits, then infringements systematically affect their competitive position vis à vis rivals who abide by the law. The German FCO’s stance would mean that virtually every legal infringement by a dominant company could amount to abusive behavior. This in turn would threaten the delicate balance that these legal instruments have achieved between over and under-deterrence.16 Not to mention the fact that competition authorities are obviously not well placed to judge whether firms have violated other legal provisions.
Finally, even if Facebook’s behavior was enabled by its market position, the FCO takes an extremely narrow view of “consent.” The GDPR provides that consent must be “freely given” and that this is not the case “if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.”17 In other words, it does not explicitly preclude “take it or leave it” offers, but leaves them to the appreciation of relevant data protection authorities (who must notably determine whether data processing is “necessary” in a given case). Letting competition authorities take point on such matters threatens the coherent application of the GDPR. The FCO’s conclusion that users have not freely consented to Facebook’s terms of service, because they have no alternatives to the Facebook platform, is equally dubious. Users can share photos on Tumblr, Flickr, Snapchat, or Pinterest. They can read newsfeeds on Twitter and Google News. And they can send instant messages on Snapchat, WeChat, Telegram, Google Hangouts, Signal, and even SMS. This is not to say that these are necessarily in the same relevant market as Facebook. But it does undermine the idea that consumers are somehow coerced into joining the Facebook platform, and that this invalidates their consent to Facebook’s terms of service.
To summarize, the FCO is acting as a self-appointed enforcer of data protection rules. In doing so, it seems to have forgotten that its mission is not to monitor firms’ data collection policies but to preserve competition. Although it goes to great lengths in order to establish that these are one and the same, its decision is ultimately unconvincing. We may not like Facebook’s data processing practices, and they might plausibly infringe the highly restrictive GDPR, but it was not up to the German competition authority to make that call.
1 Dirk Auer is a Senior Fellow in Law & Economics at the International Center for Law & Economics (ICLE), and a Guest Lecturer at UC Louvain and EDHEC Business School. ICLE is a nonprofit, nonpartisan research center based in Portland, OR. ICLE has received financial support from numerous companies and individuals, including Facebook, as well as several of its competitors. Unless otherwise noted, all ICLE support is in the form of unrestricted, general support. The ideas expressed here are the author’s own and do not necessarily reflect the views of ICLE’s advisors, affiliates or supporters. Please contact the author with questions or comments at dauer@laweconcenter.org.
data processing, Feb. 6, 2015, case summary available at https://www.bundeskartellamt.de/SharedDocs/Entscheidung/EN/Fallberichte/Missbrauchsaufsicht/2019/B6-22-16.pdf?__blob=publicationFile&v=3 (the full decision has yet to be published).
3 See Facebook, case summary, p.2-3. This functionality is sometimes referred to as “Facebook Business Tools.” https://www.facebook.com/help/analytics/1474296822878427. Facebook also obtained data from a tool called “Facebook Analaytics,” the functioning of this tool is not made clear in the decision.
4 See Facebook, FAQs, p.3 available at https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Pressemitteilungen/2019/07_02_2019_Facebook_FAQs.pdf;jsessionid=34DA54FD65BDB5B83BAF8B47F20C9ADF.1_cid362?__blob=publicationFile&v=6.
5 See Facebook, case summary, p.7.
6 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), O.J. L. 119/1 (hereafter “GDPR”), art. 6, 1. (a) and (b).
7 See Facebook, case summary, p.1.
11 See Karin Matussek & Stephanie Bodoni, “Facebook to appeal Germany crackdown,” The Independent, Feb. 8, 2019, available at https://www.independent.ie/business/world/facebook-to-appeal-germany-crackdown-37794625.html.
12 Verizon Communications Inc. v. Law Offices of Curtis V. Trinko, LLP, 540 U.S. 398 (2003).
13 See GDPR, art. 51.
14 See Facebook, case summary, p. 11.
15 See Gary S. Becker, Crime and Punishment: An Economic Approach, 76 Journal of Political Economy, 169-217 (1968).
16 For a discussion of optimal deterrence, see, e.g. William M. Landes, Optimal Sanctions for Antitrust Violations, 50 University of Chicago Law Review, 652 (1983).
17 See GDPR, recitals 42 & 43.
The BKA’s decision was highly anticipated as the first major abuse of dominance case addressing the interface between data protection and competition law. As it is adopted purely under German law, this article will focus on the wider EU law and competition policy implications of the approach adopted by the BKA.9 In doing so, it will tackle the fundamental question as to whether privacy standards are relevant to the competitive assessment of unilateral conduct under Article 102 TFEU, discussing, first, exploitative theories of harm, and, then, exclusionary theories of harm. Finally, conclusions will be drawn.
It is often said that Article 102 TFEU explicitly prohibits exploitative abuses and that, therefore, this is the law in the European Union.12 This is, of course, not the case. The text of Article 102 allows for an interpretation of the prohibition of abuse of dominance that includes exploitative abuses but does not so require. The case law has interpreted the prohibition of “unfair” prices or trading conditions as including exploitative abuses13 but, equally, the case law considers predatory pricing as a form of “unfair” prices.14 A price or a trading term may be “unfair” because of its effect on competitors rather than unfair because of its effect on customers. In any event, the case law is now clear that so-called excessive prices or excessively onerous trading conditions can be an abuse of dominance purely because of their effect on customers.15 The category of exploitative abuses has thus been created in EU law.
This is true of exclusionary abuses as it is true of exploitative abuses. An exploitative abuse does not, technically, involve a restriction of the process of competition but is still the result of the exercise of market power unconstrained by effective competition. While there is no restriction of competition as such, the harm addressed is still competitive harm in the form of prices significantly and persistently above the competitive level or, more rarely, trading conditions significantly and persistently more onerous than those that would prevail under conditions of effective competition.31 Whereas as regards exclusionary conduct it may be argued that the behavior of the dominant undertaking can be behavior that a non-dominant undertaking can also engage in, the same cannot be said as regards exploitative abuses.
For example, pricing below cost to harm a rival is conduct that may be carried out by a non-dominant firm. This does not mean that predation cannot be an abuse of dominance when carried out by a dominant undertaking. On the other hand, an exploitative abuse can, by definition, only be carried out by a dominant undertaking because the exploitation that Article 102, as interpreted by the case law, prohibits is not any exploitation of customers by a business but only the exploitation consisting in a particularly severe form of exercise of market power. Therefore, exploitative conduct caught by Article 102 is only exploitation caused, or made possible, by the fact that the undertaking engaging in such conduct is dominant.32 A non-dominant undertaking must be, therefore, unable to carry out that very same conduct – or at least unable to carry it out profitably. If a price for a given product can be profitably charged by a non-dominant undertaking, that price cannot be exploitative within the meaning of Article 102. By the same token, a mere breach of the GDPR, however serious and however extensive, that can be profitably committed by any firm, can never be an exploitative abuse.
This does not mean that a breach of the GDPR or, more broadly, substandard levels of data protection, can never be an exploitative abuse. For example, in the Facebook case, it can be argued that, when the basis for the processing of data is the data subject’s consent, a dominant undertaking is capable of extracting consent of such a scope that a non-dominant undertaking would not be able to obtain. This is, of course, a matter of evidence in each individual case. However, it is significant that Article 7(4) of the GDPR provides that, “when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.” This suggests that the fact that the performance of a contract is conditional on unnecessary consent is considered problematic regardless of the dominant position of the data controller. Whether or not the data controller is dominant, making the performance of a contract conditional on unnecessary consent is an indication that consent is not freely given.
In conclusion, an exploitative abuse theory such as that apparently applied in the Facebook case would not have a solid basis under EU competition law. While, at first sight, it might appear that the case law and the Commission have applied a broad proportionality test to the assessment of trading conditions under Article 102, what is always necessary under EU law is that the harm caused by such trading conditions is competitive harm in the form of a particularly severe form of exercise of market power. In light of the published material, it does not appear that the BKA has met this test.
It is not clear whether this exclusionary theory of harm does translate, in the decision, in a finding of exclusionary abuse. In light of the published Case Summary, FAQ, and Press Release, probably not. If it did, however, this would be a solid basis for intervention under EU competition law.
Obtaining data in breach of the GDPR cannot be described as normal competition or competition on the merits. And if the effect of such unlawful conduct is to foreclose actual and potential competitors from the relevant social network or online advertising markets to the detriment of consumers, then the conduct under review can, in principle, be abusive.
Second, unlawful conduct that strengthens or protects a dominant position is, again in principle, likely to cause consumer harm. Consumer harm is not only direct harm to consumers but also harm that results from a restriction of an effective competitive process.36 The foreclosure of competitors on the relevant social network or online advertising markets, thereby protecting or strengthening Facebook’s market power on either or both markets, is likely to cause consumer harm. Such consumer harm is distinct from the harm caused by a possible breach of the GDPR. The harm caused by a breach of the GDPR is the processing of data without the required legal basis and, in particular, without a freely given consent. The harm caused by foreclosure, on the other hand, would consist in the higher prices, lower quality, and reduced innovation resulting from Facebook’s dominance. An element of such competitive harm may well be substandard levels of privacy protection. But then this harm would still be different for a mere breach of the GDPR because it would have been caused by foreclosure rather than simply by Facebook’s breach of the GDPR. A parallel with the analysis of prices may be instructive. Unless they are a means to exclusion, like in a constructive refusal to supply scenario, high prices under Article 102 could be one of three things: (a) purely manifestation of dominance, which is not prohibited; (b) in exceptional circumstances, an exploitative abuse if they are significantly and persistently above the competitive level; (c) consumer harm resulting from an exclusionary abuse. Under an exploitative theory of harm, substandard levels of privacy protection would fall under (b). Under an exclusionary theory of harm, they would fall under (c).
Third, conduct that is unlawful under other legal rules may well constitute abusive exclusionary conduct. In AstraZeneca, the dominant undertaking had made misleading representations to patent offices in Belgium, Denmark, Germany, the Netherlands, the United Kingdom, and Norway, and before national courts in Germany and Norway.37 These representations led, in certain circumstances, to the granting of exclusive rights to which the dominant undertaking was not entitled (at all or for the period for which they were granted).38 It was clear that, by its conduct, the dominant undertaking had obtained the grant of exclusive rights to which it was not entitled and which could be annulled.39 This means that conduct that brings about an unlawful consequence40 for which there is an alternative remedy under EU (or national law), can still be an abuse of dominance. A fortiori this applies to conduct that misleads or forces data subjects into providing too much data to a dominant undertaking. Such conduct not only brings about an unlawful consequence (personal data is acquired in breach of the GDPR) but the conduct itself (not obtaining valid consent as a legal basis for the processing of the data) is unlawful. Indeed, it is surprising that it is sometimes disputed that conduct unlawful under other rules can also amount to an abuse of dominance. Of course, conduct unlawful under other rules cannot automatically, as a general principle, be also an abuse of dominance. All the ingredients of the abuse must be present, including not only dominance but also the anti-competitive effect (for example, foreclosure of as efficient competitors). But it seems obvious that if the behavior of the dominant undertaking also breaches other rules, such as the GDPR, this is a strong indication, or perhaps even conclusive evidence, that such behavior is not competition on the merits.
Fourth, it is conceivable – although this is a matter of proof in each individual case – that unlawfully obtaining data that actual or potential competitors are unable to obtain, by reason of their smaller scale, their more limited or no “vertical” or “lateral” integration, and, last but not least, their compliance with the law, could make entry more difficult or impossible. This does not depend on whether data are an “essential facility” – a concept that is quite difficult to apply to data, save perhaps in very exceptional circumstances. It is sufficient, in light of the general foreclosure test, that the “data asymmetry” that the unlawful conduct creates hinders “the maintenance of the degree of competition existing in the market or the growth of that competition,” that is, that the “data asymmetry” has a likely foreclosure effect.
Fifth, this exclusionary theory of harm has the advantage that it does not encroach upon the powers of data protection regulators and does not “merge” competition law into data protection law, thus keeping the two legal tools, and enforcement mechanisms, distinct and complementary, as they should be as a matter of policy and as they have been envisaged by the EU Legislature. While the conduct reviewed under Article 102 and under the GDPR would still be partially the same, the overlap is limited to an element of the anti-competitive behavior, that is, the failure to obtain a valid consent from end users. However, Article 102 TFEU would require, in addition, not only proof of dominance but also proof of foreclosure detrimental to consumers. And the consumer harm addressed would be – as explained earlier – clearly distinct from the harm that the GDPR aims at addressing.
The Facebook decision of the BKA could have brought some clarity to the role that privacy standards play in competition analysis. Instead, at least on the basis of the limited material published so far, it does precisely the opposite. It blurs the boundaries between competition enforcement, data protection and consumer law, depriving competition policy of its distinct identity. Some commentators will say that data protection and privacy standards should be a competition concern and that competition policy should evolve to be able to deal with the challenges posed by the digital economy. Put in this way, the argument is convincing.
This article shows that privacy standards can indeed be relevant to the competitive assessment of unilateral conduct, both under an exploitative theory of harm (in those jurisdictions that adopt this approach) and under an exclusionary theory of harm. However, the “harm” that competition law can address is only harm to “competition.” A mere breach of the GDPR by a dominant undertaking is not harm to competition even if the firm in question has a stronger bargaining power vis-à-vis the end users than other firms that could commit similar breaches.
The remedies for breaches of the GDPR are at hand and equivalent to competition remedies. A supervisory authority established under the GDPR has the power, inter alia, to order firms to bring their operations into compliance with the GDPR41 and to impose fines of up to 4 percent of the total worldwide annual turnover of the preceding financial year.42 If dominant undertakings, as well as breaching the GDPR, also manipulate privacy standards in a way that is either a particularly severe form of exercise of market power amounting to an exploitative abuse or exclusionary of actual or potential competitors so as to constitute an exclusionary abuse, then, subject to the principle of ne bis in idem,43 they would also breach competition law but not simply because they are dominant and they breached the GDPR but because, by breaching the GDPR or manipulating privacy standards, they have brought about the district, specific harm to competition that Article 102 prohibits.
1 Professor of Law, King’s College London.
2 The decision is adopted only under Section 19(1) of the German Competition Act (“GWB”) and not under Article 102 TFEU. Section 19(1) prohibits “the abuse of a dominant position by one or several undertakings.” Section 19(2) sets out an illustrative list in terms that are different to Article 102(a) – (d). It may be doubted whether the conduct would not have an effect on trade between Member States so that the BKA was under an obligation to apply Article 102 as well. In any event, since national competition law may prohibit conduct that is not an abuse under Article 102, the issue is largely theoretical in the actual case. This approach, however, may raise significant issues in terms of consistency of application of EU competition law as Article 3 of Regulation 1/2003 was enacted precisely for the purpose of preventing Member States from applying their national competition law only in order not to take a position under EU law, thus escaping the safeguards applicable when a national competition authority adopts a decision under EU competition law.
3 Case Summary, Facebook, Exploitative business terms pursuant to Section 19(1) GWB for inadequate data processing, B6-22/16, February 15, 2019, https://www.bundeskartellamt.de/SharedDocs/Entscheidung/EN/Fallberichte/Missbrauchsaufsicht/2019/B6-22-16.pdf?__blob=publicationFile&v=3, accessed on 6 March 2019, p. 7 (“Case Summary”), p. 1.
4 Case Summary, pp. 5 – 7.
5 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)  OJ L119/1 (“GDPR”).
6 Case Summary, pp. 10 – 11.
7 Case Summary, pp. 11 – 12.
8 Case Summary, p. 12.
9 At the time of writing, the text of the decision had not been published. This article is based on the Case Summary, as well as on the BKA’s Press Release of 7 February 2019 and on a document titled “Facebook FAQ’s,” of the same date, all available at the BKA’s website, accessed on 6 March 2019. The author is aware that without the benefit of reading the full text of the decision, it is not possible to engage in full with the analysis of the BKA in what is, clearly, a complex and novel case. This is why this article looks at the broader implications of this type of approach and is not a comment on the decision itself or the actual analysis of the BKA in the case.
10 Case Summary, p. 7.
11 Case Summary, p. 8.
12 See, e.g. V. Rose & D. Bailey (eds.), Bellamy & Child, European Union of Competition Law (Oxford, OUP, 7th edition, 2013) 815-816.
13 Case 27/76 United Brands Company and United Brands Continentaal BV v. Commission, , ECR 207, para 248; Case 66/86 Ahmed Saeed Flugreisen and Silver Line Reisebüro GmbH v. Zentrale zur Bekämpfung unlauteren Wettbewerbs e.V.,  ECR 803, para 43; Case 127/73 Belgische Radio en Televisie e société belge des auteurs, compositeurs et éditeurs (BRT) v. SV SABAM e NV Fonior,  ECR 313, para 15; Case 395/87 Ministère public v. Jean-Louis Tournier,  ECR 2521, para 34; Joined cases 110/88, 241/88 and 242/88 François Lucazeau and others v. Société des Auteurs, Compositeurs et Editeurs de Musique (SACEM) and others,  ECR 2811, para 25.
14 Case 62/86 AKZO Chemie BV v. Commission,  ECR I-3359, paras 70 – 72; Case C-333/94P Tetra Pak International SA v. Commission (Tetra Pak II),  ECR I-5951, paras 41 and 44.
15 Case 27/76 United Brands, para 183.
16 Case 27/76 United Brands, para 250; Case C-52/07 Kanal 5 Ltd and TV 4 AB v. Föreningen Svenska Tonsättares Internationella Musikbyrå (STIM) upa,  ECR I-9275, para 28; Case 26/75 General Motors Continental v. Commission  ECR 1367, para 12. See also R. Nazzini, The Foundations of European Union Law: The Objective and Principle of Article 102, pp. 275-282 and R. Nazzini, “Abuse Beyond Exclusion: Exploitation and Discrimination Under Article 102 TFEU,” in B. Hawk (ed.) 2012 Fordham Competition Law Institute (Huntington NY, Juris 2013) 459-472.
17 Case 127/73 BRT v. SABAM, para 6; Case 395/87 Tournier, para 34.
18 Case 127/73 BRT v. SABAM, paras 3 – 4.
20 Ibid. paras 9 – 10.
21 Ibid. para 11. See also Case 395/87 Tournier, para 43.
22 Tetra Pak II  OJ L72/1, recitals 106 – 145, upheld on appeal in case T-83/91, Tetra Pak International v. Commission,  ECR II-755, paras 210 – 214 (further appeal dismissed in Case C-333/94P Tetra Pak II).
23 Tetra Pak II, recital 146 and Case T-83/91 Tetra Pak International, para 135.
24 Tetra Pak II, recital 106 – 107.
25 Der Grüne Punkt – Duales System Deutschland  OJ L166/1.
29 Case Summary, p. 10.
30 Case Summary, p. 8.
31 R. Nazzini, The Foundations of European Union Law: The Objective and Principle of Article 102 (Oxford, OUP 2011), pp. 97 – 100. In relation to prices, see Case C-177/16 Biedrība ‘Autortiesību un komunicēšanās konsultāciju aģentūra – Latvijas Autoru apvienība’ v. Konkurences padome ECLI:EU:C:2017:689, para 61 and Whal’s opinion in the same case ECLI:EU:C:2017:286, para 106.
32 On the argument that exploitative abuses need strong limiting principles if they are not to become an unstructured form of random market intervention, see R. Nazzini, The Foundations of European Union Law: The Objective and Principle of Article 102, pp. 275-282 and R. Nazzini, “Abuse Beyond Exclusion: Exploitation and Discrimination Under Article 102 TFEU,” in B. Hawk (ed.) 2012 Fordham Competition Law Institute (Huntington NY, Juris 2013) 459-472.
33 Case Summary, p. 11.
34 Case Summary, p. 11.
35 Case C-209/10 Post Danmark A/S v. Konkurrencerådet ECLI:EU:C:2012:172 (Grand Chamber), para 24.
36 Case 6/72 Europemballage Corp and Continental Can Co Inc v. Commission  ECR 215, para 26; Case C-280/08 P Deutsche Telekom v. Commission  ECR I-9555, para 176; Case C-52/09 Konkurrensverket v. TeliaSonera Sverige AB  ECR I-527, para 24.
37 Case C-457/10 P AstraZeneca v. Commission ECLI:EU:C:2012:770, paras 18, 93 and 96.
38 Ibid. paras 105 – 112.
39 As had happened in Germany: ibid. para 109.
40 Ibid. paras 96 and 111.
43 Which may be relevant in certain circumstances although, if the approach suggested in this article is adopted, data protection infringements and competition infringements should be quite distinct both in law and in fact, as the harm addressed by competition law and the ingredients of an competition infringement would be clearly different from the harm and the ingredients of a data protection breach: see R. Nazzini, “Parallel Proceedings in EU Competition Law: Ne Bis in Idem as a Limiting Principle,” in B. van Bockel, Ne Bis in Idem in EU Law (Cambridge, Cambridge University Press, 2016) 131 – 166 and R. Nazzini, “Fundamental Rights beyond Legal Positivism: Rethinking the Ne Bis in Idem Principle in EU Competition Law,” (2014) 2 Journal of Antitrust Enforcement 1 – 35.

References: art 3
 v. 
 v. 
 art. 8
 art. 6
 v. 
 V. 
 art. 51
 V. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.