In June 2020, the German Federal Supreme Court (Bundesgerichtshof) upheld the 2019 interim decision of the Federal Cartel Office (Bundeskartellamt) ordering Facebook to stop collecting data about its users without their consent when they use apps and visit websites outside Facebook’s social network.Importantly, the Federal Supreme Court confirmed that Facebook’s data collection was an abuse of its dominance in the (German) market for personal social networks, overruling an earlier decision of the Düsseldorf Court of Appeal (Oberlandesgericht Düsseldorf).
This piece, available here, explores the relevance of the case – and the courts’ different decisions – from a number of perspectives.
Section II describes the Facebook case, up to the Supreme Federal Court’s judgment.
In February 2019, the Bundeskartellamt found that Facebook was dominant on the market for social networks, and had abused this position by imposing terms of service allowing it: (i) to collect its users’ personal data (and data related to their terminal devices) from outside the actual social network, and (ii) to assign these data to individual user accounts. The decision only targeted the collection of what the Bundeskartellamt coined “Off-Facebook” data, i.e. those data collected on websites and apps outside Facebook social network, including both services owned by Facebook (Instagram, WhatsApp etc.) and third-party websites. Facebook’s contractual terms were found not to provide any legal basis for the processing of this personal data under Art. 6(1) GDPR. According to the Bundeskartellamt, users were subject to an abusive take-it-or-leave-it situation which made them lose control over their personal data and harmed competition.
On appeal, the Dusseldorf Court of Appeal granted interim relief to Facebook, clearly indicating that the infringement decision would likely be annulled in the main appeal. Among other findings, the Düsseldorf court held that there was no causal link between Facebook’s market dominance and its contractual terms – other companies adopted similar data collection terms and conditions, which meant that Facebook’s “abusive” terms of service were not a result of market dominance. The Dusseldorf Court of Appeal further held that no exploitative abuse arose, since users freely and willingly agreed to the terms of service and were free to abstain from using the social network altogether. The Court of Appeal did not elaborate on the alleged violation of GDPR requirements, arguing that this was not relevant for the case at hand.
Section II also describes the Supreme Federal Court’s judgment.
The Federal Supreme Court overruled the decision of the Düsseldorf court and upheld the Bundeskartellamt’s interim measure – but on very different grounds from those originally set out by the competition authority. Instead of putting data protection issues at the forefront, the Federal Supreme Court focuses squarely on competition policy considerations.
According to the Federal Supreme Court, the social network can operate with ‘‘On-Facebook’ data alone. There is a significant number of users who would like to use Facebook without the higher degree of personalisation (and the higher data price) that goes with the processing of ‘‘Off-Facebook’’ data. Since they have no choice, these users are forced to agree to the only package made available by Facebook – i.e. many users must use and ‘‘pay’’ for a service they do not want.
In holding that this amounts to an abusive practice, the Federal Supreme Court relies on a theory of harm called ‘‘aufgedrangte Leistungserweiterung’’, i.e. ‘‘imposed extension of services’. Under this theory of harm, Facebook abuses its market dominance by making all (private) users agree to terms of service that allow Facebook to collect ‘‘Off-Facebook’’ data and merge that data with user accounts without their further consent. This leads to two harms to competition: users lack choice and are forced to supply more data than they wish to while bring forced to use a product they may not want in its entirety; and it becomes more difficult for (potential) Facebook competitors to compete for advertising contracts.
Sections II and III describe the Supreme Federal Court’s reasoning, which is lengthy for an interim decision.
The Court starts by contextualizing the economic role of the personal data provided by users to Facebook, which allows the court to treat data as a price.
The Court then disagrees with the Dusseldorf court on the need for a causal link between market power and abuse. Instead of a causal nexus, the Federal Supreme Court considers that one must assess the overall effect of business conduct on competition. Consequently, it does not matter if other, nonmarket-dominant companies are able to impose the same terms of service on their users. Instead, what matters is if that a practice by a dominant company damages competition. The Federal Supreme Court finds that Facebook’s use of its terms of service impedes competition in the social network markets (since it reinforces existing network effects) and on the advertising side as well (by giving Facebook advantages not available to its competitors).
A crucial part of the decision is the final balancing of all interests involved in the case at hand, based on the factual findings. First, the Supreme Court finds that competition is harmed both vertically and horizontally: vertically, a certain number of users must pay for an extended service they do not actually want, and, horizontally, competition is impeded on the advertising market. Second, for many users, Facebook is an essential forum used to exchange views and opinions, and to participate in public debates. Under certain circumstances, even private entities offering services to the general public (such as Facebook) can be indirectly bound by human rights contained in the German constitution. As a result, when balancing the interests involved, particular attention must be paid to the (national) constitutional right to informational self-determination (Recht auf informationelle Selbstbestimmung) as well as the GDPR’s requirements (such as consent and contractual necessity). In order to safeguard the right to personal data protection, users must be protected from an overly far-reaching commercial exploitation of their personal data when communicating online. This holds true even though Facebook is a private entity.
Section III comments on the decision.
The author focuses on three dimensions of the Supreme Federal Court’s judgment.
First, the judgment establishes that data can amount to a payment (counter-performance). This reflects the position adopted by Directive (EU) 2019/770 on contracts for the supply of digital content and services, which also distinguishes between data as counter-performance and data processing ‘‘for the purpose of supplying the digital content or digital service’’. The decision is an example of how this distinction is problematic, as the two categories necessarily overlap: Off-Facebook data can be used to personalise and improve Facebook’s main service; and it would be surprising if On-Facebook data did not have commercial value for Facebook. Further, whether the data is of one type or another will typically depend on the analysis of individual contractual relationships. This analysis will also be relevant to determine whether consent was given under GDPR. As things stands, it is difficult to define the tipping point between data as a contractual necessity and data as a counter-performance – a difficulty that bleeds into, but is distinct from, debates about the applicable consent rules on data processing under the GDPR.
The second dimension concerns the different approaches to user autonomy under data protection and competition law. The German Federal Supreme Court’s reliance on competition law principles is to be welcomed. Basing its decision on the ‘aufgedrangte Leistungserweiterung’ theory of harm, the Court did not have to decide whether or not acceptance of Facebook’s terms of service amounts to consent for the purposes of the GDPR.
Despite this, the Court’s decision can also be seen as a welcome promotion of user autonomy from a data protection perspective. By relying on data protection legislation – such as the right to informational self-determination, consent requirements under the GDPR, etc. – the Court made clear that the data protection regime played an indirect, yet significant part of the decision. The Court’s finding that Facebook is not only dominant but also plays a major role for public discourse lends support to the idea that consent cannot be said to have been freely given through mere acceptance of the terms of service. As a rule of thumb, it is safe to assume that the GDPR’s requirements on consent aim at protecting the weaker party when the other has significantly more power. A minori ad maius, this holds particularly for market-dominant companies. The Court’s finding that Facebook is dominant and plays a major role for public discourse also lends support to the idea that consent was not freely given by Facebook’s users merely through their acceptance of Facebook’s terms of service. Overall, the two legal regimes can be applied coherently despite their different objectives (protection of competition v. protection of personal data), as both provide certain protection against an unjust imbalance of power.
Finally, a third dimension concerns human rights. The Court finds that Facebook provides a forum for communication which is essential for participation in public debates, and that this means that Facebook is to some extent (indirectly) bound by the human rights provided in the German constitution. The Court’s reliance on constitutional law allowed it to consider both Facebook’s role as a medium for public communication and the users’ right to protection of their personal data during its balancing of interests. The full implications of this line of reasoning are yet to be uncovered. In a competition law context, this decision might, at least in theory, pave the way to rethinking the essential facilities doctrine.
This paper clearly describes and explains the Facebook case in Germany, while also engaging in a thoughtful discussion of the issues it raises. Since I am unable to read German, I have to rely on comments such as this to understand the case. And some of what I read confuses me – not because of the outcome of the case, but because of the reasoning adopted by the various instances.
For example, the discussions on causation that I have read in comments of these decisions/judgments feel odd to me. From some papers, one gets the sense that the judgments approach causation as amounting to a requisite link between market power and the ability to impose anticompetitive general contractual terms – i.e. it is a factual matter. This might make sense under the terms of the specific theory of harm adopted by the German authorities, which I do not fully understand. However, more often than not commentators seem to be saying instead that there is a generic requirement under competition law for a link between market power and the abusive conduct. While this is a topic on which the law could be clearer, it is nonetheless settled law that the same conduct will be lawful if adopted by a company without market power, but unlawful if adopted by a dominant undertaking. In other words, there is no necessary link between the possession of market power and the ability to adopt the problematic business conduct. This seems to me to be the position adopted by the Supreme Federal Court.
Another topic that is also not clear to me is the role that data protection – or constitutional rights – play in the various courts’ findings. According to the author, there is a commonality between data protection and competition laws in that both seek to protect weaker parties, and this justifies reliance on data protection rules when bringing competition cases. This is, shall we say, not the dominant understanding about what competition law seeks to achieve, at least outside Germany.
In any event, I had come to believe that reliance by the Supreme Federal Court on constitutional rights to data self-determination and on data protection rules provided mainly rhetorical support to a legal argument squarely focusing on restrictions to consumer choice. More specifically, constitutional and data protection considerations could be relevant to determine (the factual issue of) whether consent was freely given by the parties, with the absence of consent serving as a trigger for the application of a theory harm based on the abusive imposition of general contractual terms. From this (and other) articles, it seems I was mistaken and that constitutional rights and data protection played a much more important role.
The relevance of data protection and constitutional rights to the decision is particularly apparent from the prominence given in legal commentary to the Supreme Court’s reasoning on the balancing of interests. I assumed that this discussion was not about competition law at all, but instead on whether the imposition of an interlocutory injunction on Facebook while the decision is under appeal is justified or not. After all, “balance of interests” evaluations are common when dealing with interlocutory injunctions, and I am not aware of what role such an exercise can play in determining whether business conduct is anticompetitive. However, this piece – like others I have read, such as the one reviewed below – seem to assume that the balancing of interest is important for the determination of whether a competition infringement took place in the first place. It is unclear to me why this is so. Maybe it has something to do with the competition authority and courts’ assessment of whether user consent can be said to have been freely given, or maybe it has to do with how one defines consumer choice as a competitive parameter, but I really cannot tell.
This leads me to a generic comment on the papers I have read covering this case. As a rule, they fail to distinguish between the elements of the judgments that concern the existence of a competition infringement and those that determine whether an interlocutory injunction should be imposed. Maybe this is just a coincidence, but I cannot help but wonder whether the confusion does not stem from the judgment itself – which was, after all, widely perceived as prejudging the final outcome of Facebook’s appeal against the infringement decision itself.