Facebook data ruling in Germany: What does it mean for Australia? - Data Protection

Last week, the German competition regulator, the Bundeskartellamt (BKA), released a decision prohibiting certain types of collection and use of user data by Facebook.

The decision was taken under the German rules on abuse of a dominant position (the equivalent to Australia’s misuse of market power prohibitions in s.46 of the Competition and Consumer Act 2010 (Cth) (CCA)).

The decision is relevant for companies active in Australia against the background of the ACCC’s Digital Platform Inquiry, although making an equivalent misuse of market power case in Australia on these facts could, in our view, be challenging.

Facebook’s business model and terms

In Germany today, Facebook only permits users to use its platform if they consent to Facebook collecting their data, not only from their interactions on Facebook, but also from their use of:

other Facebook-owned platforms (including WhatsApp, Instagram); and
third-party websites and apps which have Facebook Business Tools embedded, including ‘like’ buttons, ‘Facebook login’ and ‘Facebook Analytics’.

All data collected on the Facebook platform, by Facebook-owned services and from third-party websites can be combined with, and assigned to, a Facebook user account.

Key findings

The BKA found that Facebook has a dominant position in the German market for social network services – a market in which its market share exceeds 90% and, the BKA found, there are no close substitutes and high barriers to entry. The Australian position is similar and in its Digital Platform Inquiry Preliminary Report (Preliminary Report), the ACCC made a similar finding that Facebook has a degree of market power in relation to social media and other markets.

The BKA found that Facebook did not obtain an effective consent for its processing of users’ data.

Given Facebook’s market power, a ‘tick-in-the-box’ to agree to the company’s terms of use was not considered adequate, and was found to breach the European Union’s (EU) General Data Protection Regulation’s (GDPR) rules requiring specific consents for the intensive processing of user data. For the BKA, the user’s choice could not be classified as a voluntary consent. The only choice the user currently has is to accept the comprehensive combination of data, or to refrain from using Facebook.

That limited choice available to users was said to constitute an abuse of dominance because of users’ ‘loss of control’ over their data. Users were said to be unable to control how their personal data is used, or to know which data, from which sources, is combined for which purposes (e.g. ad profiling/targeting). Because of the combination of data, users are also not able to properly assess the significance (and therefore value) of the data they have shared with Facebook.

The BKA determined that making the use of Facebook’s service conditional upon users granting such an extensive permission amounted to an ‘exploitative’ abuse.

Additionally, the BKA found an exclusionary effect on Facebook’s competitors. Facebook can use user data and profiles to optimise its own service and tie more users to its network, to the detriment of other providers of social network services. Facebook was said to be indispensable for advertising customers in Germany (and Australia – according to the ACCC’s Preliminary Report).

What must Facebook change?

The BKA acknowledged that not all collection, use or combining of data is impermissible and imposed no fine on Facebook in the circumstances. Instead, it required that Facebook implement practical solutions to reduce the potentially exploitative effects of its user terms.

Following the decision, Facebook has 12 months within which to amend its:

terms of service and data and cookies policies (so that users have the ability to either grant or refuse consent to their data from external sites and apps being combined with their Facebook account data); and
data processing practices (to ensure data sets are not combined in circumstances where the user has not provided consent).

If users do not consent, Facebook may not exclude them from the platform.

Facebook may be able to continue combining user data without consent if the processing is sufficiently limited (in terms of use types, amounts of data collected and purpose) and users are provided with additional ‘control options’, such as data anonymization and limitations on storage periods. Facebook has the option to propose additional user control options to the BKA, and has four months in which to do so.

If Facebook fails to take these actions, within the required timeframes, it may face substantial fines.

What are the potential implications for Australia?

The BKA’s decision is interesting for companies active in Australia, although making a misuse of market power case in Australia on these facts could be challenging.

First, the decision advances two main propositions, which suggest only a narrow fact pattern in which an abuse/misuse of market power would likely be found:

Depending on its extent, the collection, use or merging of data in a user account may breach prohibitions on the misuse of market power. Whether this activity is ‘exploitative’ of users turns on whether user consents are voluntary and informed. If consents are validly obtained, there appears no, or limited, scope for an abuse to be found.
Data protection provisions may serve as a standard for examining ‘exploitative’ abuses related to collection, use or merging of data. If terms of service, and the manner and extent to which platforms collect and use data, violate data protection rules, that might constitute an exploitative abuse. If that is right, it stands to reason that where companies comply with data protection principles, their conduct ought to be presumptively permissible.

Second, there are a number of major differences between Australian misuse of market power law and practice and the German rules under which the BKA drew its conclusions in this matter. These are:

Facebook appears to have breached each of the EU GDPR, the German rules on unfair contract terms and a constitutionally conferred right to ‘informational self-determination’.
The threshold for establishing an abuse is substantially lower in Europe than Australia. Here, a complainant would need to demonstrate the likelihood of a substantial, rather than potential, lessening of competition to succeed in an action.
The information available does not clearly show that Facebook acted with an anti-competitive purpose.
It is unclear how and whether the BKA was able to identify a specific user cohort who were ‘exploited’ by Facebook’s conduct, beyond assuming that for some German consumers control over their data is an important factor in using social networks. While it could readily be accepted that when asked “do you want to retain control of how your data is collected and used?”, most people will respond affirmatively, a more appropriate question such as “would you prefer to have more control over your data or more personalised, better quality (and free) services?” will inevitably require a more nuanced consideration and answer.
It is unclear whether this type of ‘exploitation’ of users would constitute a misuse of market power under Australian law, unless a complainant established, by reference to evidence, the anticompetitive effects of a platform’s capture of a broad range of data, or was able to persuade a Court that it conferred a material competitive advantage.

Third, when faced with similar facts in Australia, the ACCC has notably not sought to bring a market power case – or even suggest that one may be possible in the Preliminary Report. This is despite the fact that the Preliminary Report found that:

Facebook has a degree of market power;
platforms understate the extent of data collection and overstate level of consumer control; and
bundled consents and complex privacy policies may prevent valid and meaningful user consents.

Instead, the ACCC has proposed a raft of privacy-related policy recommendations to bring Australian data protection legislation closer to the EU GDPR, which Facebook’s terms and policies breached.

Our view is that this reflects the difficulties in making a market power case on these facts under Australian law.

That said, the BKA’s decision points to a theory of harm that directly connects data privacy practices and anticompetitive effects and suggests that a broadly equivalent case cannot be ruled out under Australian law. The ACCC has separately given some indication in its Preliminary Report that requiring overly broad consents as a condition of use may amount to an unfair contract term under the Australian Consumer Law in some circumstances.

The BKA decision appears to be part of a broader, global trend of regulators examining the business practices of global digital platforms and sharing information and theory to further policy and enforcement goals. The BKA said that it worked closely with international regulators and data protection agencies on the decision, a trend we anticipate will continue. Since the decision was taken, the Austrian, Dutch and Italian competition regulators have noted the decision with interest, suggesting further discussions around these issues at the EU level.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.