Germany hits Facebook at heart of its business model

Germany’s probe is based on national law and may not be more broadly applicable across Europe.

The German competition authority on Thursday ordered that Facebook stop combining users’ data in a first major strike at the heart of the company’s business model.

In a landmark decision, the Bundeskartellamt ruled that users will now need to give their consent to allow the social network to combine data from their WhatsApp and Instagram accounts, and from third-party websites with their Facebook data.

The case strikes at the company’s business model because Facebook gathers user data from its suite of apps and through external websites to create targeted user profiles, which it then sells to advertisers. Competition regulators are increasingly looking at ways to assign value to such data as a corporate asset.

The order comes on top of a series of recent privacy scandals troubling the social media giant. The Cambridge Analytica revelations that broke less than a year ago showed how Facebook data was misused for political targeting that allegedly influenced the Brexit vote and 2016 U.S. presidential election. But despite this increased attention on Facebook’s ethics, the way the social media company earns its money was never directly under fire — until now.

“Today data are a decisive factor in competition … the attractiveness and value of the advertising spaces increase with the amount and detail of user data,” said Andreas Mundt, president of the Bundeskartellamt.

The battle over Facebook’s data use is far from over. Attention now turns to the courts, where it remains to be seen whether this novel probe by the Bundeskartellamt will survive a challenge.

The authority found Facebook to be Germany’s dominant social network, with 95 percent of the country’s daily active users and more than 80 percent of monthly active users. It did not consider the company to compete head-to-head with the likes of Twitter, YouTube or Snapchat.

Facebook will need to implement the decision over the next 12 months. The company announced it would challenge the ruling before the Higher Regional Court of Düsseldorf, but did not specify whether it will use its right to request that the court suspend the order. Although there is a high threshold for such a request, a top German competition lawyer said he would advise Facebook to do so.

According to Darach Connolly, competition lawyer at Van Bael & Bellis, the significance of Germany’s case against Facebook lies in the fact that “it is the first time a major competition enforcer in the EU has relied on the failure to meet data protection principles as the constituent element of a competition law offense.”

Although the Bundeskartellamt’s full decision has not been published yet, several lawyers criticized the authority’s novel approach.

Facebook summarized its arguments in a response co-authored by its head of data protection, Yvonne Cunnane, and director of competition, Nikhil Shanbhag: “The Bundeskartellamt underestimates the fierce competition we face in Germany, misinterprets our compliance with the General Data Protection Regulation and undermines the mechanisms European law provides for ensuring consistent data protection standards across the EU.”

Thomas Höppner, a competition lawyer for Hausfeld, said that the German probe was partially based on specifics of German competition law, which made it less significant for other authorities in the EU, including the European Commission.

The European Commission’s reaction to the German approach was lukewarm. A spokesperson said it “took note” of the decision and is “closely following” the work of the Bundeskartellamt.

“The European legislator has made sure that there is now a regulation in place that addresses this type of conduct, namely the General Data Protection Regulation,” the spokesperson said.

The EU’s GDPR specified companies should seek “freely given, specific, informed and unambiguous” consent to use personal data for commercial purposes. Companies have been struggling to implement the requirements since GDPR was adopted in 2016, and are under the gun of privacy watchdogs since the GDPR entered into force in May 2018.

Other major platforms that generate income from online ads, including Google and Amazon, will be closely watching the case, as will any platform that uses the data it receives.

“This decision is likely to attract the attention of other companies, such as Google, who already have data protection cases pending against them on similar issues of ‘forced’ consent and deceptive data collection. These companies now have the additional threat of competition law to make them change their behavior,” said data protection lawyer Thibaut D’hulst.

Laurens Cerulus contributed reporting. 

This article is from POLITICO Pro: POLITICO’s premium policy service. To discover why thousands of professionals rely on Pro every day, email [email protected] for a complimentary trial.

Click Here: liverpool mens jersey