German anti-trust watchdog investigates Facebook over privacy infringements
German regulators are stepping up privacy enforcement a notch, again: Stakes have been raised today on how compliance with data protection regulations is enforced. The Federal Cartel Office (“FCO”) published a press release this morning that says the office has opened cartel proceedings against Facebook. The reason given is an initial suspicion that Facebook abuses its dominant position in the market by using terms and conditions infringing data protection law. Such behaviour may have anti-trust implications which the FCO will now examine, along with the underlying privacy questions. The proceedings concern Facebook’s U.S., Irish and German entities.
Pressing anti-trust questions
What is the relevant ‘market’? Will it be online networks, the advertisement market therein? In the past, the European Commission has regarded social networks as a market, but has not provided an exact definition.
Is Facebook dominating this market?
Is there a ‘connection’ between Facebook’s market-dominating position and the network’s terms and conditions? Think of this as causality – will the focus be on an action (Facebook can use unlawful terms and conditions because it is dominating the market) or the result (use by the dominant market player is exceptionally detrimental to competition)?
The privacy angle
If you are a privacy professional, the questions that have been growing in the back of your mind may be: The FCO’s press release appears to presume the unlawfulness of the terms and conditions – well, ARE they? Do they infringe users’ privacy rights? If there is such a suspicion, under the data protection laws of which jurisdiction – Germany or Ireland – will the FCO decide this question? The FCO’s press release speaks of users profiles used for advertisement – what impact can the investigations have on online profiling (at which the Hamburg DPA is dealing an indirect hit by investigating Google’s unification of terms across services)?
There is another interesting hint at the end of the release: “The FCO carries out the investigation in close cooperation with the competent data protection commissioners, consumer protection associations, the European Commission and the competition authorities of the other EU Member States.” This opens the door for speculations such as: Will DPAs provide data protection expertise? What is the role of consumer protection associations who are active privacy litigants and whose powers to file lawsuits against companies have just been upgraded? May there be investigations in other Member States as well, perhaps concerning other industries and other market players?
Next step
The FCO will now be busy gathering information. We will keep you updated on the proceedings.
English press release