By Robert Bateman
Germany’s top court last month confirmed a decision by the nation’s Federal Cartel Office restricting how Facebook combines personal information across its platforms — including WhatsApp and Instagram — and collects data using tracking technologies.
The case shows how competition law can be used to curb big tech’s data-harvesting operations, opening a second front against privacy violations — alongside the E.U.’s General Data Protection Regulation (GDPR).
“The GDPR provides a robust toolkit for regulating the uses of personal data.”
Heather Burns, tech policy specialist, Scotland.
Legal and tech experts tell Digital Privacy News that GDPR, while theoretically powerful, has an enforcement problem — and that antitrust bodies are taking an increasingly active role to supplement the work of overburdened privacy regulators.
“The GDPR provides a robust toolkit for regulating the uses of personal data,” said Heather Burns, a tech policy specialist in Glasgow, Scotland. “The issue… is whether Facebook and Google are exploiting those rules to their own advantage.”
A Facebook representative told Digital Privacy News of the June 23 ruling: “The Federal Court of Justice’s decision relates to the preliminary proceedings on the Court’s stay order. The main proceedings, before the Court of Appeals, are ongoing and we will continue to defend our position that there is no antitrust abuse.
“There will be no immediate changes for people or businesses who use our products and services in Germany,” Facebook said.
Taking on Girth
Burns and other observers argued that firms could avoid complying with GDPR because of their size and power, which far outweighed those of the EU’s privacy regulators.
Consequently, she saw competition regulators, including the U.K.’s Competition and Markets Authority, taking an increasingly active role in preventing tech corporations from “using their market dominance to make the world an unhappier place.”
Elizabeth Renieris, privacy lawyer and fellow at Harvard University’s Berkman Klein Center for Internet and Society, broadly agreed.
“I would argue it’s not a failure of GDPR’s substance, but rather a failure of its enforcement procedures,” Renieris told Digital Privacy News, citing the difficulties of coordinating and pursuing large volumes of GDPR investigations across the E.U. using its “one-stop-shop” mechanism.
“It’s not a failure of GDPR’s substance but rather a failure of its enforcement procedures.”
Elizabeth Renieris, Harvard University.
“What is noteworthy about this case is that it gives activists a second attack vector to undermine the surveillance-capitalist business model of companies like Facebook and Google.”
Privacy and competition laws are “complementary,” Renieris argued, because “the overarching market conditions that lead to interferences with our individual data-protection rights also impede our freedom and autonomy.”
One Advocate’s Quest
The Facebook judgment was particularly welcomed by Alexander Hanff, cofounder of the Sweden-based consultancy Think Privacy.
“I have been lobbying the E.U. Commission for the past five years to include privacy as one of the aspects they consider with regards to competition investigations,” Hanff told Digital Privacy News.
He claimed that “all the large U.S. tech giants” were subject to ongoing complaints and investigations under GDPR, but they continued to process user data despite “significant legal questions surrounding whether or not that data was collected and is being processed lawfully.
“It is not right that giant tech corporations” can share data “to exploit the fundamental rights and freedoms of E.U. citizens.”
Alexander Hanff, Think Tank consultancy, Sweden.
“It is not right that giant tech corporations are able to share data across companies in order to exploit the fundamental rights and freedoms of E.U. citizens,” he said.
The Facebook ruling is a sign that competition regulators are willing to intervene to protect E.U. citizens’ privacy, though Hanff argued that more must be done.
“I would encourage more member-state competition and antitrust regulators … to step up their activities in these areas and commit to strong enforcement of not just data-protection rules but competition rules as well.”
Robert Bateman is a writer in Brighton, U.K.
Sources (external link):