Member Article

In its decision from February 7, 2019, the Bundeskartellamt prohibited Facebook from the further processing of user data which it has generated from so-called third party sources. In order to make use of these personal data in future, Facebook will need the consent of the data subject as defined by the General Data Protection Regulation (GDPR). It remains to be seen whether this will be granted by the majority of users.

1. Facebook currently collects personal data about the behavior of users on the Internet and merges this data with the respective Facebook user accounts. By doing so, Facebook is able to create detailed profiles of its users which contain their respective preferences and interests. Above all, this enables the placement of personalized advertising.

2. According to its privacy policy so far, Facebook users have been forced to agree to this form of data collection. If they withheld their consent, they were denied access to Facebook.

3. The Bundeskartellamt has now objected to this practice from the point of view of antitrust law and requested Facebook to refrain from such data processing or to make it compliant with GDPR, in particular to obtain effective consent. This affects in particular the generation of data from third party companies who have integrated so-called “Facebook Business Tools” in their websites and apps, for example, the “Like” button. The migration of data from Facebook-owned companies, especially WhatsApp or Instagram, is also affected. However, the data that Facebook users upload themselves onto their own account (comments, photos, etc.,) are not affected.

4. The Bundeskartellamt sees the starting point in antitrust law in the dominant position of Facebook in the market for social media in which there are no significant competitors. An abuse (by imposing unfair conditions) of this dominant market position would be that users would not have a free choice as to whether to accept the collection of data on third party sites or not. As long as Facebook refuses the use of the platform should consent not be given, there is no voluntary consent.

5. Facebook must now request explicit and voluntary consent from its users or considerably limit or anonymize the amount of data generated on third party sites. The company has twelve months to implement these requirements. To what extent the users will agree to this remains to be seen.

PRACTICAL EFFECTS

Although the decision of the Bundeskartellamt only legally affects Germany, it will also have an impact on Facebook’s business model throughout Europe. Since, according to its own statements, the Bundeskartellamt has coordinated with the European Commission and the national data protection and cartel authorities, it is hardly conceivable that Facebook's contested practice can simply be continued in other member states. Facebook will contest the decision of the cartel office in court. The court proceedings will, however, take several years and have no suspensive effect, i.e. the decision must be implemented now.

As a result, it should be noted that the authorities can prosecute data protection violations made by market dominating companies not only under data protection law but also under antitrust law. This could be of concern also to Google, whose dominating market position was only recently identified by the Commission, and many other companies that are dominant in their respective markets; the presumption rule for dominance in antitrust law is 40 percent of the market share.