Today, the German federal competition authority prohibited Facebook from combining user data with data from its other services (WhatsApp, Instagram etc.) and third party webpages. The authority also questioned the legality of the consent to this processing, which is a condition to using Facebook. What impact will this have on Facebook and other companies, which based their business model on processing of their users’ personal data?
The Bundeskartellamt addressed the practices of Facebook related to collection, combination and use of users‘ data. Facebook doesn’t process only data collected from its own social network; it also collects data from its other services such as WhatsApp or Instagram and from third party websites and applications. The legal ground on which such processing is based is users’ consent with data processing, which is the condition for using Facebook’s social network. The Bundeskartellamt also found that Facebook has a dominant position on the social networks market.
According to the Bundeskartellamt, Facebook’s practices amount to the abuse of its dominant position and infringe personal data protection rules. In case of social networks, a certain amount of data use is expected; however, the extent in which Facebook collects and combines data from other sources significantly exceeds such expectations.
Accordingly, the Bundeskartellamt ruled that collection of data and their combination is possible only subject to the users‘ voluntary consent. To be voluntary, such consent must not be a condition for the use of the social network itself.
As a result of the decision, it might be impossible for Facebook to combine data from own and external sources to make and use a unique database for each user. Facebook users should be able to narrow down the extent in which their data are processed, at least whether the data can be combined from various sources.
The decision is not yet final, Facebook has one month to appeal against it. The appeal and subsequent lawsuit are more than likely. However, regardless of the result, it is clear even now that today’s decision will have significant impacts not only on Facebook, but also on many other companies in the area of digital economy whose business models are primarily based on data. This applies especially to Google. The Bundeskartellamt’s decision may lead to abandonment of countries where data-protection rules are being promoted most strongly (apart from Germany, that would include also France, whose data protection authority recently imposed EUR 50m penalty on Google), but considering the size of market in these countries, such an option is unlikely. More likely option is the adjustment of the rules according to the Bundeskartellamt’s decision.
The decision is available here.
Written by: Mgr. Michal Nulíček, LL.M., CIPP/E, Mgr. Bohuslav Lichnovský, CIPP/E, Mgr. Anna Cervanová, LL.M., Mgr. Filip Beneš
