Landmark decision of German Anti-trust Authority
In a landmark decision the Bundeskartellamt (German Antitrust Authority) is prohibiting Facebook from combining user data from different sources – of its subsidiaries like Whatsapp and of other third parties.1 The decision of the Bundeskartellamt is the strongest answer ever to eminate from a European regulator to the misuse of user data by Facebook.
- The decision of Bundeskartellamt (German Anti-trust Authority)
The Bundeskartellamt found Facebook to be dominat in the market for social networks since Facebook has a market share of more than 95% of daily active users and more that 80% of monthly active users in Germany.
Facebook abuses its dominat position by collecting data from third parties. This includes the collection of data by Whatsapp and Instagram as subisdiaries of Facebook. In addition Facebook is collecting personal data from third party websites. First, Facebook is collecting personal data by using its “Like“ button. Second, Facebook is using Facebook Analytics where data is collected from third party websites without the knowledge of the users.
When asking the users for their consent for data transfer from Whatsapp to Facebook, the Bundeskartellamt found, that users have no choice to either accept the data transfer or refrain form the service of Facebook. This “take it or leave it“-approach is infringing European Data Protection Law such as Directive 95/46 and GDPR. Therefore, this consent is legally invalid.
Based on the dominat position of Facebook the Bundeskartellamt regards this infringement not only as privacy issue but equally as an abuse of the dominat position of Facebook. That derives from the fact that anti-trust law does not only prevent competitiors from an abuse by a trust but equally prevent the comsumers of the trust. This consumer prevention hinders the use of inappropriate contractual terms – so-called ‘exploitative’ business terms.
- Assessment
The decision of the Bundeskartellamt is the strongest answer ever of a European regulator to the misuse of user data by Facebook. The decision is a signal that European regulators are not willing to further accept the longstanding infringement of European Data Protection Law by Facebook. The Bundeskartellamt clearly states that Facebook is not above the law:
„…Facebook, as a dominant company, must comply with the rules and laws applicable in Germany and Europe.“
The decision goes back to a statement of the Data Protection Authority of Hamburg, which found that Whatsapp needs the consent of the users to transfer their data to Facebook.2 That derives from the fact that the transfer of personal data from one legal entity to another legal entity needs a legal basis. This principle equally applies to legal entities belonging to the same group.3
The Bundeskartellamt takes the decision of the Data Protection Authority of Hamburg as a starting point but goes far beyond the DPA, in drawing the line from Data Protection Law to anti-trust law.
What citizen in Europe can circumvent the use of Whatsapp without facing social isolation? Who can risk to refuse his consent to transfer his data from Whatsapp to Facebook?
The decision of Bundeskartellamt is about Facebook. But Goolge, Amazon and Microsoft will read it carefully. These companies will likely be regarded as equally dominant in their market.
- Conclusion
The explosive power of the Bundeskartellamt’s decision derives from the combination of Data Protection Law and anti-trust law: any infringement of privacy by a trust is a misuse of its dominant position.
This decision marks the end of the illusion that the internet is a virtual space of endless freedom cared by an invisible, virtual hand. This space has been captured by a few multinational companies. These are multiplying their profit by tracking every detail of private life of internet users. The western societies are beginning to realise that this virtual space shall be not solely governed by profit. It shall be governed by the rule of law.4
1Bundeskartellamt, press release, https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2019/07_02_2019_Facebook.html?nn=3591568
2See the confirmation of the decion of the DPA Hamburg by OLG Hamburg, press release, https://justiz.hamburg.de/aktuelles/10550476/pressemitteilung/
3Jutta-Sonja Oberlin and Lukas Lezzi, Joint Controllership within a group of entities (No. 3.2), https://dpoblog.eu/joint-controllership-within-a-group-of-entities
4House of Commons (UK Parliament), Desinformation and “fake news” – Final report on Facebook, https://www.parliament.uk/business/committees/committees-a-z/commons-select/digital-culture-media-and-sport-committee/news/fake-news-report-published-17-19/ ;
Matthias C. Kettemann, Wolfgang Kleinwächter, Max Senges, The time is right for Europe to take the lead in global internet governance, http://publikationen.ub.uni-frankfurt.de/frontdoor/index/index/docId/48008
Although I read about the decision of the Bundeskartellamt in the newspapers I first realized the comprehensive meaning of the decision by reading this article. Thanks for explaining in clear words understandable even for non-lawyers.