On 7 February 2019, the German antitrust authority (Bundeskartellamt, the FCO) ruled against Facebook combining user personal data from different sources, saying it was exploiting its position as a dominant social media company in violation of the EU data protection laws.
The FCO said that Facebook abused its market dominance in:
- collecting, merging and using personal data; and
- failing to provide a choice to its customers to prevent collection of their data.
Consequences of the German antitrust authority’s decision
Facebook can no longer combine the personal data gathered from its own website, Facebook-owned services (like WhatsApp and Instagram) with personal data gathered from third-party websites through the “Like” or “Share” features of a user’s Facebook account.
Combining of personal data collected from different sources, according to the FCO, requires a user’s voluntary consent, if one takes account of Facebook’s dominant position in the market for private social networks. The FCO emphasised that Facebook is therefore not permitted to force its users to consent to the collection of their data from different sources under the Facebook terms of use.
According to Andreas Mundt, President of the FCO, Facebook, as a consequence of its dominant position, must not abuse its dominance. This means that Facebook, as a dominant company, is subject to “special obligations under competition law”, and therefore Facebook “must take into account that Facebook users practically cannot switch to other social networks.”
Voluntary consent to combining data from different sources
Voluntary consent requires that the user has a choice to deny Facebook access to certain data without losing access to Facebook’s services. The only real choice the user had is either to accept the comprehensive combining of its data, or to refrain from using the social network altogether. This constitutes “bundling” ( on a “take it or leave it” basis), which, according to the FCO, constituted an abuse of Facebook’s dominant position in the market for private social networks.
Therefore, the FCO concluded, the use of Facebook’s services must not be subject to a user’s “mandatory consent to their data being collected and combined in this way.” It emphasised that:
“ … personal data is nowadays an essential competitive factor. Especially for Facebook, personal data is the essential factor for establishing its dominant position. The attractiveness and value of the advertising spaces increase with the amount and detail of user personal data. As a market-dominating company, Facebook must, therefore, comply with the laws applicable in Germany and Europe, especially in relation to the collection and processing of personal data.”
The decision, of course, does not concern Facebook’s processing of personal data generated from its own website, which the FCO acknowledged is a legitimate core business model for data-based social networks like Facebook.
Is the decision final?
Facebook is reported to have said that it rejects the decision and that it intends to appeal within the one-month frame before the decision becomes final. If the decision is upheld, Facebook will be required to allow users to give their specific consent to the combination of data collected from other Facebook-owned sources and from third-party websites.
Our take
This is not a decision of a data protection supervisory authority, but it is widely influenced by the GDPR which also discourages bundling of consents and requires freely given consent. The German antitrust authority used typical antitrust arguments from bundling decisions. The decision has some similarity to the arguments made by CNIL in the French decision against Google (see Data Protection Report, First multi-million Euro GDPR fine: Google LLC fined €50 million under GDPR for transparency and consent infringements in relation to use of personal data for personalized ads).
From now on, online businesses which undertake large-scale data collection and processing should consider whether activities relating to the collection, combination and use of personal data from different sources could also constitute market dominance under anti-trust laws.
