ECJ: Federal Cartel Office may also take into account data protection

Meta Platforms Ireland operates the online social networks Facebook, Instagram and WhatsApp in the European Union. By logging into Facebook, users agree to the General Terms of Use and therefore to the guidelines for the use of data and cookies. These allow the collection of data on user activities even outside these services and assign them to Facebook accounts of the users concerned. This “off-Facebook data” concerns data about the visit of third-party websites and apps as well as other meta-online services. This enables the personalization of commercial communication sent to users.

In 2019, the German Federal Cartel Office prohibited this practice of making Facebook use dependent on consent to the processing of off-Facebook data for advertising purposes as an abuse of a dominant position. Against such decision, Meta filed an appeal with the Düsseldorf Higher Regional Court. The Higher Regional Court first referred to the ECJ the question of whether national competition authorities may take data protection provisions into account and how certain GDPR provisions apply to social networks.

Far-reaching significance for fair competition of online social networks

The ECJ states that, when examining whether a dominant position is being abused, it may be necessary for national competition authorities to examine whether regulations other than those under competition law, such as the GDPR, are being violated as well. In this context, however, the determination of a violation of the GDPR was limited to the procedure under competition law and did not replace a decision by the competent data protection authorities. At the same time, according to the principle of loyal cooperation, possibly already existing related decision or investigation by the competent supervisory authority must be taken into account.

Particularly controversial was the collection of so-called “sensitive data”, i.e., information on racial and ethnic origin, political opinions, religious beliefs or sexual orientations, the processing of which is generally prohibited under the GDPR. In this context, it was disputed whether the processing of such data could be permissible by way of exception if the data subjects had obviously made it public. Although the Düsseldorf Higher Regional Court has yet to decide on this matter, the ECJ already clarified that the mere use of websites or apps as well as the entry of sensitive data on these websites/apps per se must in no way be interpreted to the effect that the data is obviously to be make public within the meaning of the GDPR. Rather, the decision to make the relevant data publicly accessible to an unlimited number of persons must be explicitly expressed.

For non-sensitive data, on the other hand, data processing could be lawful even without explicit consent if the disputed practice of data processing was indispensable from an objective point of view in order to fulfill the main object of the contract between the platform and its users.

ECJ expresses general doubts about the disputed business practice

Although this was not the specific subject of the proceedings, the ECJ also expressed general doubts about the practice in its ruling. In particular, the ECJ found that the personalization of advertising for the platform’s financing cannot justify the data processing as a legitimate interest of Meta, unless the users’ consent has been obtained.

With regard to the implications under competition law, the ECJ concludes that a dominant position on the market for social networks did not per se preclude effective consent within the meaning of the GDPR. However, it was generally capable of impairing users' freedom of choice and creating a clear imbalance between users and the platform. Therefore, it was also important for the examination under competition law whether the consent was actually given effectively, in particular voluntarily, which must be verified by the respective operator.

Decision has a positive effect for consumers

Andreas Mundt, President of the German Federal Cartel Office, welcomed the ECJ’s decision: “The ruling is an excellent signal for antitrust enforcement in the digital economy.” The reason, he said, is that data is a crucial factor in establishing market power and the use of very personal data can also be abusive under antitrust law. Mundt anticipates far-reaching effects on the business models of the data business and a continued close cooperation with data protection authorities.

In the matter, the pending proceedings before the Düsseldorf Higher Regional Court will now be continued before the German Federal Cartel Office’s decision from 2019 can become legally binding. Nevertheless, Meta and the Federal Cartel Office are already in talks about implementing the decision, for which Meta had created an essential prerequisite with the introduction of the account overview only at the beginning of June.

For users of meta services, this will not yet entail any concrete effects. What is clear, however, is that the competition authorities will also take a closer look at the importance of data privacy in competition in the future. However, it remains to be seen whether this will result in a general change in business models and whether data protection problems will be completely eliminated.

The ECJ’s corresponding press release is available here ==> 

The German Federal Cartel Office’s associated report is available here ==>