On the interplay between competition law and privacy: the impact of Meta Platforms case

ABSTRACT

In July 2023, the Court of Justice of the European Union (CJEU) issued a landmark judgment at the intersection of competition law and data privacy law. This article delves into two pivotal aspects: firstly, the recognition of privacy-related harms as factors within the realm of competition law considerations; and secondly, an examination of the role of competition law authorities in addressing infringements related to data protection. The analysis emphasizes the practical significance of the CJEU decision, asserting its importance rather than controversy. The judgment provides clarity on how regulatory rules can influence competition assessments and highlights the potential for competition authorities to consider the broader market and regulatory landscape without exceeding their mandate.The Facebook case, while not exhaustive, marks a crucial step in elucidating how regulatory rules influence competition assessments and how competition authorities can navigate broader market and regulatory considerations within their mandate. .

KEYWORDS:

• Privacy
• Facebook
• Meta platforms
• competition law
• abuse of dominance
• national competition authorities

1. Introduction

In July 2023, the Court of Justice of the European Union (CJEU) delved into the intricate intersection of competition law and data privacy law.¹ It is essential to emphasize that the judgment is specific to the German competition authority and does not serve as comprehensive guidance for interpreting Article 102 of the Treaty on the Functioning of the European Union (TFEU). The judgment is centred on the nuanced application of §19(1) of the German Act Against Restraints of Competition (GWB), with a particular focus on considerations related to the General Data Protection Regulation (GDPR).

The article explores two crucial aspects: (1) the acknowledgment of privacy-related harms as potential factors falling within the purview of competition law, and (2) an examination of the role of competition law authorities in addressing infringements related to data protection. Subsequently, it delves into the practical significance of this case, asserting that the CJEU decision should be viewed not as controversial but undeniably as an important judgment. The judgment clarifies how regulatory rules may impact a competition assessment and underscores how competition authorities may, arguably, consider the broader market and regulatory environment without exceeding their mandate.

2. Facts of the case

The German Federal Cartel Office (BKartA) launched an investigation into Facebook’s practices, uncovering unfair terms and conditions detrimental to users.² The inquiry highlighted Facebook’s dominant position in the social media landscape, fuelled by a lock-in effect arising from user loyalty and a dearth of viable alternatives. Despite being a free service, Facebook’s extensive data collection and network effects played pivotal roles in solidifying its market dominance.

The BKartA’s antitrust concerns revolved around two key issues. First, the accumulation of data was seen as reinforcing Facebook’s already dominant position. Second, the broad, catch-all consent obtained from users was deemed potentially unfair under Article 102(a) TFEU, addressing both exploitative and exclusionary theories of harm within the antitrust context. This comprehensive assessment underscored the intricate challenges posed by Facebook’s practices, prompting the BKartA to address multifaceted concerns related to market dominance and user consent.

The Facebook case faced a pending appeal at the Higher Regional Court in Düsseldorf after the BKartA’s preliminary decision faced serious doubts and was overruled by the German Supreme Court.³ In 2020, the Supreme Court echoed the BKartA’s findings, stating that data collection outside facebook.com was not crucial for contract performance.⁴ The Supreme Court affirmed Facebook’s abuse of its dominant position in the German social networks market, overturning the 2019 decision of the Düsseldorf Court of Appeal.⁵ Users were deemed locked into unfair terms, limiting their choice regarding personalized content, while Facebook had extensive access to internet users’ characteristics.⁶

The case has been referred to the CJEU for a preliminary reference.⁷ The Higher Regional Court raised questions at the intersection of competition law and data privacy law.⁸ Specifically, they queried whether consent, as defined by the GDPR, could be effectively given to a dominant undertaking.⁹ Additionally, the court questioned whether the BKartA had the competence to identify GDPR infringements in their competition law investigation.¹⁰ If the response to the latter was negative, the CJEU would assess whether the BKartA could evaluate Facebook’s terms and conditions for compliance with the GDPR.¹¹

In 2022, AG Rantos issued his opinion on the Facebook case, aiming to anticipate how the CJEU might interpret the convergence of competition law and privacy in this particular instance.¹² The core of the judgment revolved around two key questions: (1) whether a proven breach of privacy by a dominant company can be considered an act of abuse; and (2) whether this violation, even if unintentional, can be identified not by a data protection authority but by a competition authority. According to AG Rantos, the BKartA application of GDPR in its competition law assessment was not central but rather incidental.¹³ AG Rantos emphasizes that a national competition authority should investigate whether an undertaking’s actions impact fair competition. Therefore, GDPR compliance in the context of the conduct under scrutiny could provide essential insights in the fact-based assessment of a specific case.

However, AG Rantos issues a cautionary note, stating that a violation of Article 102 TFEU is not automatically established solely based on non-compliance with the GDPR. Merely breaching the GDPR does not render the conduct unlawful under Article 102 TFEU. Instead, the AG suggests that an incidental consideration of privacy-related harms may guide the assessment of data-related anticompetitive harms. In other words, without a GDPR infringement, anticompetitive conduct harming competition might not exist at all.

3. The CJEU decision in Facebook case: privacy as component of competition law investigation

3.1. Inclusion of personal data handling as a factor in competition law

The CJEU underscores that Facebook’s digital operations benefit from subsidisation through online advertising.¹⁴ Users who register with Facebook agree to its provided terms of service, thereby accepting its data and cookies policies. As per Facebook’s terms, the platform gathers information about users’ activities both on and off the social network, linking this data to their Facebook accounts. This collected data is then used to generate personalized advertising for Facebook users. The CJEU further asserts that Facebook’s business model and online advertising hinge on the creation of user profiles and the online services provided by the Facebook group. In essence, the CJEU contends that Facebook’s utilisation of personal data is driven more by technical constraints than intentional economic or strategic decisions guiding the platform’s exploitation of user data.

In evaluating Facebook’s data collection and processing practices, the CJEU concurred with the opinion of AG Rantos and noted that the BKartA did not identify a breach of the General GDPR resulting in anti-competitive harm.¹⁵ The Court clarified that BKartA’s scrutiny of Facebook’s data processing activities was centred on assessing their alignment with the fundamental principles of the GDPR.¹⁶ Crucially, the portrayal of the case highlights a subtle yet significant distinction: the CJEU suggests that the outcome would have differed if it believed BKartA had directly applied the GDPR to the case, even accounting for procedural differences explicitly prohibited. Instead, the CJEU indicates that the incidental consideration of GDPR is permissible within the broader context of anticompetitive conduct. This practice is deemed essential for striking a balance in decisions made under competition law. Importantly, BKartA’s comprehensive analysis did not involve a substantial interpretation of the GDPR beyond its competencies.¹⁷ The focus was solely on scrutinising each legal requirement under the GDPR to ascertain whether there was a breach of competition law. The objective was to assess whether Facebook’s data processing activities adhered to the GDPR and maintained consistency in the platform’s analytical and data collection practices concerning user data.

The CJEU addressed whether Facebook’s processing activities were lawful under GDPR: Articles 6(1)(a) and 9(2)(a) GDPR were of a particular interest as they related to the nexus between market power, imbalance in the sense of GDPR and exploitative conducts.¹⁸ Here, the ruling did not appear to engage in a process of balancing between competition law and data privacy law. Instead, it offered more direct conclusions. The CJEU established that processing of Facebook’s data was unlawful under Article 9(2) GDPR, mirroring the approach taken by AG Rantos – Facebook has been involved in the processing of specific categories of personal data without the consent and clear understanding of the implications for individuals who registered on the social network.¹⁹

It is crucial to highlight that the CJEU delved into the concept of incorporating GDPR within a broader antitrust framework.²⁰ The Court extended its consideration to recognize the importance of collecting and utilizing personal data in the digital economy, especially in the context of business models reliant on personalized advertising, such as that of the Facebook group.²¹ In line with this perspective, the CJEU contends that the capability to access personal data, coupled with Facebook’s processing of this data (aggregated and interconnected into comprehensive datasets), could be viewed as a competitive element among companies operating in the digital economy. This recognition underscores the evolving landscape where the strategic use of personal data becomes integral to competitive dynamics, particularly for businesses engaging in personalized advertising models like that employed by the Facebook group.

Indeed, the notion of considering privacy as a parameter of competition is not a novel concept within the competition law framework, as evidenced by previous instances such as the EU Commission’s characterization of privacy in cases like Microsoft/LinkedIn or Facebook/WhatsApp.²² For instance, in the Microsoft/LinkedIn merger, the Commission indicated that privacy might be acknowledged in the competitive assessment when the consumer sees it as “a significant factor of quality”.²³ This indicated that data privacy was, arguably, an important parameter of competition that can be negatively affected by the merger. Accordingly, if reduction of a product’s quality is actionable under competition law and consumers see privacy as an aspect of quality, then reduction of privacy could arguably be seen as consumer harm in any competition assessment. Following the approach of privacy reduction as reduction of product’s quality, the EU authorities noted that any privacy-related harms correspond to elements of a product or service quality. For example, in Facebook/WhatsApp merger case, the Commission considered the parameter of privacy as a key quality-based element of a mobile communication apps’ quality.²⁴ The greater protection of user privacy offered by WhatsApp allowed the Commission to conclude that the parties were not close to being competitors. In addition, in Microsoft/LinkedIn, the Commission further added that privacy was an important element of competition amongst professional social networks.²⁵ It was noted that transactions could indirectly impact privacy. Such reasoning was based on LinkedIn being promoted on Microsoft’s operation system. Microsoft could foreclose and marginalize any professional social network competitor, including such networks offering the highest level of privacy protection. Therefore, Microsoft offered remedies that allayed the foreclosure concerns and precluded any effects on privacy. Cognitive bias, information asymmetry and limited choice could make consumers unwilling or unable to switch to different services or products. Accordingly, the CJEU, by labelling access to and the ability to process personal data as a competitive factor, refrains from taking a stance favouring business models that prioritize privacy, where greater privacy might be perceived as preferable for consumers.

The Court underscores that the significance lies in the level of access and processing capabilities, irrespective of their alignment with the principles of the GDPR, within competitive dynamics.²⁶ This perspective suggests that a digital platform’s activities can serve as a crucial indicator when assessing its departure from standard competition practices.²⁷ However, this viewpoint seems less applicable when interpreting the GDPR in the context of a platform’s dominance. The CJEU stresses that dominance could play a pivotal role in determining whether user consent for the data controller’s processing activities is freely given. Consequently, the interaction between these legal domains considers the potentially exploitative nature of the behaviour of a large digital entity. Yet, the concept of exploitation may not inherently be a prominent factor in deciding whether a platform can legitimately engage in processing personal data.

Furthermore, the CJEU addressed the legality of Facebook’s processing activities under the GDPR, and in this regard, the ruling does not seem to engage in a nuanced balancing act between competition law and data privacy law. Instead, it provides more straightforward conclusions. The CJEU largely concurred with BKartA’s finding that Facebook had neglected data protection regulations in justifying the processing of users’ data.

The CJEU affirmed that Facebook’s data processing was indeed unlawful under Article 9(2) of the GDPR, aligning with AG Rantos’ approach.²⁸ It held that Facebook had been involved in processing specific categories of personal data without obtaining the necessary consent and without providing clear information about the implications for individuals who registered on the social network. In this context, the CJEU specified that the responsibility falls upon the German court to assess whether users were adequately informed to grant their consent freely when using Facebook buttons on external websites.²⁹ Furthermore, the CJEU emphasized that the evaluation of Facebook’s justification for processing user personal data within their services, apps, and on third-party websites is grounded in Articles 6(1)(b)-(e) of the GDPR. This leaves little room for the referring court to interpret broadly in favour of Facebook regarding the legitimacy of their data processing actions.³⁰ Lastly, the CJEU discussed Facebook’s ability to justify its processing activities in the context of consent under Article 6(1)(a) of the GDPR.³¹ It clarified that while having a dominant position does not inherently prevent users of a social network from giving valid consent, Facebook, as a company generating revenue through online advertising, possesses the capability to develop alternative solutions. These solutions could involve minimizing or eliminating extensive processing activities, potentially requiring users to pay a suitable fee to account for the value of the service.³²

In general, the CJEU’s approach aligns with the opinion of the AG Rantos with some nuanced adjustments. The CJEU emphasizes that the assessment of exploitative abuse should be an indirect aspect of the GDPR, particularly concerning the validity of consent. The Court clarified that a violation of the GDPR does not automatically translate into an abuse, especially without considering a genuine competition law interest and balancing. Against this backdrop, the CJEU guides the consideration that a large digital entity’s access to personal data should be viewed as a parameter of competition law in the digital economy. However, the Court underscores that this should not be regarded as a universal goal or indicator applicable across EU competition law. This nuanced approach by the CJEU aligns with the existing stance of EU competition law, signalling that the assessment of a company’s access to personal data should be contextual and not applied uniformly in all cases.

3.2. Necessity for competition authorities to enforce data protection regulations in the digital landscape

While the CJEU’s decision may suggest flexibility in integrating data privacy considerations into competition law assessments, the court establishes institutional constraints that restrict National Competition Authorities (NCA) from relying extensively on GDPR rules in their determinations. This stance, aligned with AG Rantos’s arguments, underscores the importance of the duty of sincere cooperation outlined in Article 4(3) TEU.³³

In practical terms, the duty of sincere cooperation establishes various scenarios that essentially outline potential collaboration between National Competition Authorities (NCAs) and data protection authorities. In essence, NCAs are mandated to engage in consultations with the national data protection authority to respect their respective competencies.³⁴ Therefore, even in situations where there is no apparent risk of divergence, NCAs are obligated to seek the input of the relevant data protection authority to address a given issue.

In situations where there is a potential risk of interpreting GDPR rules in conflicting ways, the principle of necessity becomes applicable.³⁵ The CJEU has not offered explicit direction on the definition of necessity in this context. However, it can be inferred that the NCA authority to interpret GDPR provisions in antitrust conduct is limited to situations where the consideration of data protection rules is essential to establish a violation of competition law.³⁶ In a parallel manner, the CJEU could be signalling a substantive restriction on NCAs, allowing them to recognize privacy-related harms as a competitive infringement only when it is deemed necessary.³⁷

Within the broader framework of the duty to cooperate, National Competition Authorities (NCAs) are not entirely free to disengage from privacy-related infringements and collaboration with a competent data protection authority. At both the enforcement and advocacy levels, diverse measures imposed by different authorities to scrutinize GDPR violations may potentially clash with one another.³⁸ One could argue that both competition and data protection authorities should go beyond the minimum requirements by aligning their enforcement actions and jointly implementing measures. Nevertheless, caution is necessary to prevent an overextension of their competencies. An intriguing example illustrating the intersection of enforcing competition law and data protection law is the French GDF Suez case, where the competition law remedy imposed seemingly introduced privacy-related issues.³⁹

In the GDF Suez case, the former gas monopoly utilized its database, containing regulated tariffs, to tailor personalized offers on gas and electricity for its consumers. GDF Suez’s competitors were placed at a disadvantage as they could not replicate this database. Consequently, the Autorité de la Concurrence mandated GDF Suez to provide its competitors access to historical files, which included consumer and consumption data. In response, the French data protection authority issued an opinion, suggesting that the Autorité de la Concurrence should ensure that the competition remedy aligns with data protection law.⁴⁰ The competition remedy introduces a potential opt-out provision, allowing consumers to choose not to share their data if they explicitly object within 30 days. There is skepticism about whether such a remedy effectively safeguards privacy. Theoretically, in this scenario, the actual choice of GDF Suez’s users may differ from their preferred choice. Users might prefer an opt-in mechanism, where they actively consent to their desired choice, rather than an opt-out option. The French GDF Suez case highlights a potential dilemma between competition law and data privacy law, as protecting the competitive process may have adverse effects on user privacy. It’s important to note that this does not necessarily imply that a competition law remedy would inevitably violate data privacy law. Instead, both competition law and data privacy law aim to protect consumers in business-to-consumer relationships against harmful practices that could negatively impact users.⁴¹

By its very nature, any remedy must ensure compliance with the relevant legal framework. The Facebook case serves as an illustrative example where the competition remedy extends into the realm of data protection to safeguard competition. To address the competition concerns, the BKartA, in collaboration with data protection authorities, directed Facebook to aggregate users’ data only when users provide free and explicit consent. In instances where consent is not freely given, users should still have access to Facebook and its services without charge. This remedy not only aligns with but goes beyond the minimum requirements of the GDPR by providing guidance on how Facebook should ensure user consent. Therefore, the remedy effectively safeguards both competition law and data privacy law.

Arguably, the CJEU suggested that the Facebook case provides a potential solution to the dilemma between competition law and data privacy. The indication is that competition authorities should engage in cooperation and coordination with non-competition regulators throughout the investigation to the monitoring phase. Any incidental consideration of non-competition policies could serve as a crucial factor in identifying anticompetitive conduct and formulating an effective remedy. This collaborative approach ensures alignment between competition and data privacy laws, preventing potential harm to either area of regulation.

4. Practical significance

The decision concerned primarily whether Facebook has abused its dominant position in the market for personal social networks by aggressive data combination practices. The broader implications of this case reflected on the GDPR as a factor for competition law assessment. Yet, the judgement has, in fact, avoided a detailed elaboration on the substantive interaction between two different laws. This section analyses two mostly persisting questions arising from the judgement.

3.1. Is it considered uncontroversial to accept policies unrelated to competition when evaluating the abuse of a dominant position?

The article argues that it is not controversial to accept external-to-competition policies when establishing competition related harms under Article 102 TFEU. While not entirely novel, the consideration of the regulatory impact, including compliance, on competition has been a recurring theme in various cases examined by competition authorities and the Court in the past.⁴² Hence, the CJEU judgement in the Facebook case is not entirely novel. What distinguishes the decision is that it marks the inaugural instance where the regulatory environment played a particularly prominent role in a competition case within digital markets.

Over the years, EU competition law has depended on economic indicators to illustrate harm to consumers, such as through the observation of prices or potential declines in input, quality, and/or innovation.⁴³ Article 102 TFEU centres around the notion of abuse, involving the use of methods divergent from those inherent in normal competition.⁴⁴ It also suggests that the behaviour of a dominant entity may undermine genuine, undistorted competition.⁴⁵ It is important to highlight initially that there is no inherent conflict between public interest considerations and the goal of safeguarding competition. For instance, the CJEU has affirmed that the assessment of the concept of abuse can extend to other legal domains.⁴⁶ In various rulings, antitrust agencies have taken into account the regulatory landscape when evaluating the impact of a transaction or practice on competition. In the case of E.ON/MOL,⁴⁷ which dealt with a concentration raising concerns about vertical foreclosure in the energy sector, regulatory changes were anticipated to take effect 18 months after the decision’s adoption. These changes aimed to introduce competition to the downstream market affected by the merger. The Commission determined that the anti-competitive effects arising from the vertical relationship between the involved parties would manifest once the new rules became applicable. The Commission’s rationale was that the merged entity would possess both the capacity and motivation to deny the supply of gas to businesses seeking to enter the downstream market. The merger was ultimately approved, contingent upon the implementation of extensive remedies. Equally, in the AstraZeneca case, the Court concluded that unilateral actions undermining the objectives of a law safeguarding the introduction of new products and parallel imports cannot be considered “competition on the merits”.⁴⁸ The Court held that a dominant undertaking, owing to its “special responsibility” to avoid distorting competition, cannot manipulate regulatory rules to impede the entry or expansion of competitors in the market.⁴⁹

One could argue that the preservation of competition might inherently contribute to the attainment of public policy goals, particularly when such outcomes align with consumer expectations.⁵⁰ Therefore, there could be a potential complementarity between competition law and non-competition public interest goals, such as data privacy. Harms solely centred on privacy, unrelated to their impact on competition, are typically not considered recognizable issues under competition law.⁵¹ With the exception of privacy-related harms, a similar question has previously been addressed by NCAs concerning whether environmental considerations could be considered in the prohibition of anticompetitive agreements under Article 101 TFEU.

The Netherlands Authority for Consumers and Markets (ACM) addressed a specific example related to the “Chicken of Tomorrow” initiative.⁵² In 2013, various Dutch organizations and businesses within the poultry industry, along with Dutch supermarket chains, engaged in discussions regarding the more sustainable production of chicken meat. The purpose of these conversations was to establish an industry-wide standard that surpassed the legally required conditions for chicken meat production. Eventually, this initiative ended in signing a declaration committing to producing more sustainable poultry.

The ACM conducted a review of the agreement reached among Dutch organizations, businesses in the poultry industry, and supermarket chains, ultimately determining that the “Chicken of Tomorrow” initiative imposed competitive restraints under Article 101(1) TFEU.⁵³ According to the ACM’s perspective, the initiative constrained competition in the chicken meat retail market, as conventionally produced poultry would no longer be available for purchase in Dutch supermarkets once the initiative was implemented, leading to a diminished variety of choices for consumers.

The ACM found that it was not feasible to grant an exception to the initiative under Article 101(3) TFEU. Therefore, the ACM analyzed consumers’ willingness to pay. The assessment revealed that the “Chicken of Tomorrow” initiative might be exempted from its anticompetitive behaviour if it resulted in a higher consumer surplus. However, this was to be determined based on consumers’ willingness to pay for the product in question, which ultimately proved insufficient to justify the anticipated increase in consumer prices and the reduction in choice.

Likewise, the BKartA addressed a sustainability initiative known as the animal welfare initiative (ITW). At the core of the proposed ITW initiative was the introduction of an animal welfare fee provided to farmers as a reward for implementing measures to enhance animal welfare. The BKartA examined the impact of the initiative on competition law, focusing on the exchange of information between the various market levels and businesses operating within the relevant market.⁵⁴

In any type of competitive evaluation, it becomes apparent that the substantive antitrust assessment centres on identifying competition issues stemming from the behaviour of firms.⁵⁵ In other words, establishing abuse requires identifying a departure from competition based on merits.⁵⁶

The rationale behind this approach is rooted in the acknowledgment that dominant firms bear an increased responsibility to ensure that their actions do not distort competition.⁵⁷ Unquestionably, the concept of economic efficiency plays a pivotal role in the rationale of Article 102 TFEU. The term “dominance” is explicitly defined as “a position of economic strength which enables an undertaking to prevent effective competition”.⁵⁸ Moreover, any potential consideration of public interest would encompass an economic efficiency standard.⁵⁹ Restrictions on competition may arise from abusive practices that undermine the broader public interest of the European Union.⁶⁰ It can be inferred that the EU Courts underscore the specific responsibility of a dominant undertaking to prevent its actions from adversely impacting fair and impartial competition. If the rationale behind this special responsibility were solely to address anti-competitive outcomes, then all companies with significant market influence would be obliged to uphold such responsibility.

Presumably, the acknowledgment of such a responsibility is driven by considerations of economic freedom, consumer welfare, fairness, and legal certainty. In the case of British Airways, Advocate General Kokott emphasized that Article 102 TFEU “is not designed only or primarily to protect the immediate interests of individual competitors or consumers but to protect the structure of the market and thus competition as such”.⁶¹

The question arises as to whether such an assessment might extend beyond the scope of competition policy. EU competition law does not operate in isolation, and non-competition public interest concerns are considered to varying degrees within the broader framework that underpins the internal market. In other words, competition authorities may take non-competition public policy considerations into account when determining whether specific behaviour impedes competition, serving as a proxy to ensure fair competition and protect consumer welfare. Consequently, both overarching values related to maximizing consumer welfare and broader social and political priorities that shape enforcement could be elements of the competition law framework if they introduce competitive restraints in a relevant market.

For instance, sustainable development holds a strong legal position among the objectives of the EU, as evident in the codification of the environmental integration rule in Article 11 TFEU. Generally, EU policies are implemented by considering social protection,⁶² consumer protection,⁶³ public health,⁶⁴ equality considerations,⁶⁵ regional development, investment,⁶⁶ and environmental protection.⁶⁷ Similarly, it is widely accepted that EU competition law guarantees the protection of human rights.⁶⁸ In the Front Polisario case, it was affirmed that EU institutions must consider the impact of fundamental rights even when it is not immediately apparent that those rights are at stake.⁶⁹

In various cases, the Court has underscored that Article 102 TFEU should be oriented towards preserving undistorted competition in the market to enhance social welfare⁷⁰. In the GlaxoSmithKline case, the application of the concepts of end consumers and their choices was employed to constrain the competitive freedom of a dominant company.⁷¹ This linkage facilitated the connection between restrictions on parallel trade and adverse effects on competition. Advocate General Kokott emphasized in this context that the protection of market structures indirectly safeguards consumers, as any harm to the flow of competition also affects consumers.⁷² The EU courts have established that competition law addresses practices that detrimentally impact both consumers and the structures of effective competition. The TeliaSonera case recognized the significance of maintaining competition to prevent potential distortions with adverse effects on public interests, individual undertakings, and consumers, thereby ensuring the well-being of the EU.⁷³

In essence, Facebook case is not about a competition authority encroaching on the domain of a data protection authority. Instead, it revolves around a competition authority adopting a proactive position and fulfilling its expected role – to adapt its administrative practices in response to the evolving dynamics of markets.

3.2. Does the court grant competition authorities unrestricted authority to evaluate adherence to GDPR regulations in cases related to competition?

The complex system of governance in the EU for competition law results in frequent interactions between EU competition law and national competition law.⁷⁴ A thorough discussion of Article 3 of Regulation 1/2003 is essential to illustrate the relationship between the competences of National Competition Authorities (NCAs) and conduct falling under the scope of EU competition law, along with potential consequences for non-compliance with this provision.⁷⁵

Article 3 of Regulation 1/2003 empowers the EU Council to regulate the connection between Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU) and national law. Recital 8 of Regulation 1/2003 emphasizes the goal of ensuring “the effective enforcement of the competition rules and the proper functioning of the cooperation mechanisms” outlined in the regulation. The cooperation mechanism dictates that the European Commission and NCAs closely collaborate in applying Article 102 TFEU. This cooperative incentive has been reinforced by the ECN + Directive,⁷⁶ which grants NCAs the authority to set their priorities, including deciding which cases to pursue or close.⁷⁷ Member States must, at a minimum, guarantee that NCA personnel remain independent from external influences while adhering to general policy guidelines. In the terms of the application, this article suggests that the CJEU has not provided a clear clarification regarding the obligation to “apply” Article 102 TFEU in conjunction with national law. Regarding the substance, national prohibitions on unilateral conduct are only applicable if they are deemed “stricter” rather than merely different from Article 102 TFEU. On the procedural front, the obligation to apply Article 102 TFEU initiates specific notification requirements and coordination mechanisms with the Commission and the European Competition Network (ECN). In the instances of the cases, such as Facebook case, has initially applied EU law provisions to assess anticompetitive conducts, then the Commission and other related NCAs would have had a more significant opportunity to impact the decision. However, these implications were not explicitly discussed in the judgment.

Furthermore, Article 3(2) of Regulation 1/2003 introduces a “convergence rule” related to Article 102 TFEU. This article serves as a demarcation between EU and national “competition” rules. Member States are permitted to enact and enforce stricter national competition laws within their territories, even if they go beyond the prohibitions outlined in Article 102 TFEU. Notably, the enforcement of EU competition law is not the sole responsibility of the Commission; it plays a vital role in fostering the internal market and advancing European integration. As a result, it is considered a fundamental policy of the EU. Hence, any consideration of external to competition law policies to establish a connection between abuse and market power could be established by reasoning that if competition were functioning effectively. This line of reasoning was adopted by AG Rantos who pointed out, the violation of Article 102 TFEU was not automatically evident solely based on a failure to comply with the GDPR or other legal regulations.⁷⁸ Instead, the CJEU emphasized the need for a case-by-case analysis, where non-compliance with the GDPR serves as a vital clue among the relevant circumstances of the case in order to establish whether that conduct entails resorting to methods governing normal competition.⁷⁹

It remains crucial to strike a balance in defining the appropriate role of competition authorities when addressing privacy-related harms.⁸⁰ Regulation 1/2003, however, does not establish a clear boundary between national competition law and non-competition rules, posing challenges addressed by Article 3(3) of the regulation. This provision establishes a rule favouring the primacy of EU competition law rules. Notably, Article 3(1) and Article 3(2) of Regulation 1/2003 do not come into play when national competition authorities or courts are enforcing their own competition law rules. Moreover, these articles do not impede the enforcement of national law rules if their primary purpose differs from the objectives outlined in Articles 101 and 102 TFEU. This question is more intricate than it may first seem. Article 3(2) does not expressly define the term “stricter”. Brook and Eben argued that various interpretations are possible, including (i) a more rigorous criterion for defining abuse; (ii) a lower threshold of market power required to establish dominance; (iii) diverse levels and forms of economic power, such as economic dependence or gatekeeper powers; or (iv) regulations addressing conduct that was objectively justified under Article 102 TFEU.⁸¹

Reflecting on the intersection between competition law and privacy, efforts aimed at embracing value pluralism can offer a structured approach to reconciling competition law and data protection concerns, aiding courts and competition authorities in evidence-based decision-making within the contextual and principled realms.⁸² It is important to note that while competition law won’t serve as a cure-all for privacy issues, a value pluralism framework suggests that the assessment of competition law should consider various values, including economic freedom, consumer well-being, fairness, and legal certainty. Hence, the connection between abuse and market power can be established by considering that if competition were operating efficiently; it would not be reasonable for Facebook Ireland to impose terms for data processing operations that are in violation of the GDPR. Yet, this balancing activity might only be achieved by a nuanced, case-specific examination where the failure to comply with the GDPR serves as a crucial indicator within the broader context. In this approach, non-compliance with GDPR is considered as a significant factor among various relevant circumstances, helping to determine whether the conduct involves the utilization of practices that regulate normal competition.

According to case law, the EU Commission is granted broad discretion in selecting cases related to the enforcement of Article 102 TFEU.⁸³ Recital 9 of Regulation 1/2003 introduces the consideration that NCAs could apply national rules, regardless of whether specific actions are known or believed to impact market competition, as long as they fall within the domain of competition law. The core focus of competition law is to preserve and promote competition in the market rather than safeguard individual interests solely for market participants’ benefit.

Article 4(5) of the ECN + Directive ensures that NCAs have similar discretion in setting their enforcement priorities.⁸⁴ It is prudent to consider not only other facets of competition law but also areas that could potentially become part of the system following the introduction of the ECN + or areas that stand to benefit from similar considerations, especially in addressing data-related harms within the scope of competition law.⁸⁵

The CJEU, in Facebook cased missed the point on the relationship granted to by Article 102 TFEU or any comparable national provision. Correspondingly, the CJEU has left unresolved the question of whether similar cases could be brought under both EU competition law and national competition law. The interplay between competition law and data protection law can follow two distinct dynamics. Firstly, CJEU and/or the Commission may incorporate concepts from one area of law when interpreting the rules of the area they are authorised to enforce.⁸⁶ Secondly, the CJEU and/or the Commission might indicate an enforcement action by relying on various bases for each area of law in each case, where conduct simultaneously involves unfair processing, anti-competitive behaviour, or unfair conduct within the boundaries of their competence or the primary legal basis of the action.⁸⁷ Importantly, non-compliance with GDPR alone does not determine the legality of a practice under Articles 102 TFEU. Compliance with GDPR does not guarantee compliance with competition rules, and vice versa; violations of competition regulations can occur independently of GDPR non-compliance.

4. Conclusion

The article extensively examined two pivotal aspects: firstly, the recognition of privacy-related harms as potential factors within the realm of competition law; and secondly, an exploration of the role of competition law authorities in addressing infringements related to data protection. Beyond these legal intricacies, the discussion extended to the practical significance of the CJEU decision. It was underscored that the judgment, far from being controversial, stands as an important clarification.

In conclusion, the intersection of competition law and data privacy law, as highlighted in the Facebook case and related legal discussions, presents a multifaceted and evolving landscape. The analysis reveals that incorporating external considerations, such as GDPR compliance and broader public interest goals, is not inherently controversial when assessing the abuse of a dominant position under Article 102 TFEU. The judicial and regulatory landscape, exemplified by the CJEU’s judgment, indicates a recognition that competition law must adapt to the evolving dynamics of digital markets and consider the broader regulatory environment.

The Facebook case, while not introducing a novel concept, marks a significant instance where the regulatory context played a prominent role in a competition case within digital markets. The examination of cases such as E.ON/MOL and AstraZeneca further emphasizes the consideration of regulatory impact on competition, indicating a broader trend in competition authorities recognizing the interplay between competition law and other regulatory domains.

The balancing act between competition law and non-competition public interest goals, as seen in cases like the “Chicken of Tomorrow” initiative and the animal welfare initiative (ITW), highlights the need to carefully evaluate the potential complementarity between these areas. The acknowledgment that competition law protects the immediate interests of compfacetitors or consumers and the broader market structure and competition itself is crucial.

The complex governance system in the EU, as outlined in Regulation 1/2003, underscores the need for a nuanced approach in defining the authority of competition authorities in cases related to privacy concerns. The interaction between EU and national competition laws, and the convergence rule, establishes a framework that allows flexibility in addressing varying degrees of competition-related issues influenced by non-competition policies.

The analysis also emphasizes that non-compliance with GDPR alone does not determine the legality of a practice under Articles 102 TFEU, and compliance with one set of regulations does not guarantee compliance with the other. The recognition of economic efficiency, consumer welfare, fairness, and legal certainty in the competition law framework highlights the broader societal goals that competition authorities seek to uphold.

In essence, the evolving landscape of the digital economy necessitates a balanced and comprehensive understanding of how competition and privacy intersect. While the Facebook case may not provide a definitive answer to all questions, it serves as an important milestone in clarifying how regulatory rules may impact competition assessments and how competition authorities can consider the broader market and regulatory environment without overstepping their mandate. The ongoing dialogue between competition law and data privacy law requires continued scrutiny and adaptation to effectively address the challenges posed by digital platforms and evolving market dynamics.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Notes

1 Case C-252/21 Meta Platforms and Others (Conditions Générales d’Utilisation d’un Réseau Social). For the sake of consistency, this article will refer to this case as “Facebook case”.

2 Bundeskartellamt, ‘Amendment of the German Act against Restraints of Competition’ (2021) < https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2021/19_01_2021_GWB Novelle.html?nn=3591568> accessed 14 August 2023.

3 Case KVZ 90/20, Facebook, BGH, 15.12.2020.

4 Ibid.

5 Case VI-Kart 1/19 (V) ECLI:DE:OLGD:2019:0826.VIKART1.19V.0A;.

6 Case C-252/21, Request for a preliminary ruling, Meta Platforms and Others (Conditions générales d’utilisation d’un réseau social) ECLI:EU: C:2022:704, Opinion of AG Rantos.

7 Ibid.

8 In light of the questions asked, the Higher Regional Court Düsseldorf enquired about the BKartA’s finding, compared with Ireland’s Data Protection Commission over Facebook’s conduct. Data Protection Commission, ‘In the matter of Meta Platforms Ireland Limited, formerly Facebook Ireland Limited, and the “Instagram” social media network’ DPC Inquiry Reference: IN-20-7-4 (2022) <https://www.dataprotection.ie/sites/default/files/uploads/2022-09/02.09.22%20Decision%20IN%2009-09-22%20Instagram.pdf> accessed 25 October 2022.

9 Opinion of AG Rantos (n 7) 5.

10 ibid 1.

11 Opinion of AG Rantos (n 7).

12 ibid.

13 ibid, para 152.

14 Meta Platforms (1) para 50.

15 Meta Platforms (1) para 62.

16 ibid, para 30.

17 ibid, para 147.

18 ibid, para 154.

19 Meta Platforms (1) paras 147–154.

20 ibid, para 62.

21 ibid, para 117.

22 Case M.8124 Microsoft/LinkedIn [2016] C(2016) 8404 final; Case M.7217 Facebook/WhatsApp [2014] OJ C 417/4.

23 European Commission, ‘Press release, Mergers: Commission approves acquisition of LinkedIn by Microsoft, subject to conditions’ (2016) < https://www.europeansources.info/record/mergers-commission-approves-acquisition-of-linkedin-by-microsoft-subject-to-conditions/> accessed 10 September 2021.

24 Facebook/Whatsapp (22) para 87.

25 Microsoft/LinkedIn (22).

26 Meta Platforms (1) para 147.

27 ibid, paras 140–147.

28 ibid, para 154.

29 ibid, para 154.

30 ibid, para 148.

31 Meta Platforms (1) paras 140–147.

32 ibid, para 150.

33 AG Rantos Opinion (n 7) para 28.

34 Meta Platforms (n 1) para 54.

35 ibid, paras 55 and 56.

36 ibid, paras 55–56.

37 ibid, para 48.

38 Agustin Reyna, ‘Interdisciplinary Enforcement in Competition and Data Protection Law’ (BEUC 2023) <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4349827> accessed 16 April 2023.

39 Adlc, ‘Press release, 9 September 2014: Gas Market’ (2014) <https://www.autoritedelaconcurrence.fr/en/communiques-de-presse/9-september-2014-gas-market> accessed 2 August 2023.

40 Adlc, Décision N° 14-MC-02 du 9 Septembre 2014 Relative à une Demande de Mesures Conservatoires Présentée par la Société Direct Energie dans les Secteurs du Gaz et de l’électricité, September 9, 2014, para. 289.

41 Frank Pasquale, ‘Privacy, Antitrust, and Power’ [2013] Geo Mason L Rev 1009, 1009.

42 See, Commission Decision of 8 December 1983, IV/29.955 – Carbon Gas Technologie, 83/669/EEC, OJ, 31 December 1983, L 376/17; Commission Decision of 12 December 1990, IV/32.363 – KSB/Goulds/Lowara/ITT, 91/38/EEC, OJ, 25 January 1991, L 19/25, para. 27; Commission Decision of 14 January 1992, IV/33.100 Assurpol, 92/96/EEC, OJ, 14 February 1992, L 37/16, para 38; Commission Decision of 24 January 1999, (IV.F.1/36.718. – CECED), 2000/475/EC, OJ 26 July 2000, L187/47, paras 51, 57; Commission Decision of 17 September 2001, COMP/34493 – DSD, 2001/837/EC, OJ, 4 December 2001, L319/1; Commission Decision of 16 October 2003, COMP D3/35470 – ARA; COMP D3/35473 – ARGEV, ARO, 2004/208/EC, OJ, 12 March 2004, L 75/59.

43 C-107/82 AEG-Telefunken v Commission ECLI:EU:C:1983:293, para 33; N Averitt and R Lande, ‘Consumer Choice: The Practical Reason for Both Antitrust and Consumer Protection Law’ (1998) 10(1) Loyola Consumer Law Review 44. Ioannis Lianos, ‘Competition law in the European Union after the Treaty of Lisbon’ in Diamond Ashiagbor, Nicola Countouris, Ioannis Lianos (eds), The European Union after the Treaty of Lisbon (CUP 2012). Roger Van den Bergh and Peter Camesasca, European Competition Law and Economics: A Comparative Perspective (2nd edn, Sweet & Maxwell 2006) 16–53.

44 Case C- 85/ 76, Hoffman-La Roche & Co v Commission [1979] ECR 461, paras 38–39.

45 Case C-413/14 P, Intel v. Comm’n, EU: C:2017:632, para 135.

46 Case C-457/10 P, AstraZeneca v Commission [2012] ECLI:EU:C:2012:770.

47 Commission Decision of 21 December 2005 declaring a concentration compatible with the common market and the functioning of the EEA Agreement (Case COMP/M.3696 – E.ON/MOL).

48 C-457/10 P AstraZeneca/Commisson ECLI:EU:C:2012:770.

49 See also, Ioannis Lianos, ‘Categorical Thinking in Competition Law and the “Effects-based” Approach in Article 82 EC’ in Ariel Ezrachi (ed), Article 82 EC – Reflections on its recent evolution (Hart 2009) 35–37; Stavros Makris, ’Applying Normative Theories in EU Competition Law: Exploring Article 102 TFEU’ (2014) UCL Journal of Law & Jurisprudence 30, 46.

50 M Vestager, ‘A Principles Based approach to Competition Policy’ (Keynote at the Competition Law Tuesdays, 22 October 2022).

51 Case C-235/08 Asnef-Equifax v Asociación de Usuarios de Servicios Bancarios ECR I-11125. [2006].

52 For a detailed summary of the initiative and ACM’s assessment see G Monti and J Mulder, ‘Escaping the Clutches of EU Competition Law: Pathways to Assess Private Sustainability Initiatives’ (2017) 42 European Law Review 635.

53 ACM, ‘ACM’s Analysis of the Sustainability Arrangements Concerning the “Chicken of Tomorrow”’ (26 January 2015) <https://www.acm.nl/en/publications/publication/13761/Industry-wide-arrangements-for-the-so-called-Chicken-of-Tomorrow-restrict-competition.> accessed 20 July 2023.

54 Bundeskartellamt, ‘2013/2014 Activity Report, German Bundestag – 18th legislative period, printed paper 18/5210, 53–54’, <https://www.bundeskartellamt.de/SharedDocs/Publikation/DE/Taetigkeitsberichte/Bundeskartellamt%20-%20T%C3%A4tigkeitsbericht%202014.pdf?__blob=publicationFile&v=2> accessed 4 August 2023.

55 Case C-95/04 British Airways plc v Commission [2007] ECR 1-2331, para 86.

56 Case AT.39740 Google Search (Shopping), 27 June 2017, paras 273–284.

57 Joined Cases C-501/06 P, C-513/06 P, C-515/06 P and C-519/06 P, GlaxoSmithKline Services and Others v Commission and Others ECLI:EU:C:2009:610

58 Case C-27/76 United Brands Company and United Brands Continentaal v Commission, [1978] EU:C:1978:22 para 65.

59 Case C-52/09, Konkurrenverket v TeliaSonera Sverige AB ECLI:EU:C:2011:83, paras 21-24.

60 Case C-322/81 NV Nederlandsche Banden Industrie Michelin v Commission [1983] ECR I-3461, para 57; British Airways (n 51) para 23.

61 British Airways (n 51) para 68.

62 TFEU, article 9 refers to: ‘the promotion of a high level of employment, the guarantee of adequate social protection, the fight against social exclusion, and a high level of education, training and protection of human health.’

63 TFEU article 12; Charter of Fundamental Rights, article 38.

64 TFEU, article 168(1); Charter of Fundamental Rights article 35.

65 TFEU, article 8.

66 Commission Decision of 23 December 1992, IV/33.814 – Ford Volkswagen, 93/49/EE, OJ, 28 January 1993, L20/14, para 36.

67 TFEU article 11; Charter of Fundamental Rights article 37; see also: Julian Nowag, Environmental Integration in Competition and Free-Movement Laws (Oxford University Press 2016).

68 R O’Donoghue and J Padilla, The Law and Economics of Article 102 TFEU (Hart Publishing 2020) 43.

69 Case T-512/12 Front Polisario, ECLI:EU:T:2015:953.

70 Case T-321/05 AstraZeneca AB and AstraZeneca plc v European Commission [2010] ECR II-2805, para 804; GlaxoSmithKline (n 134) para 118; Joined Cases T-213/01 and T-214/01 Österreichische Postsparkasse AG and Bank für Arbeit und Wirtschaft AG v Commission [2006] ECR II-1601, para 115.

71 Joined Cases C-501/06 P, C-513/06 P, C-515/06 P and C-519/06 P, GlaxoSmithKline Services and Others v Commission and Others ECLI:EU:C:2009:610.

72 Case C-8/08, T-Mobile Netherlands BV, KPN Mobile NV, Orange Nederland NV and Vodafone Libertel NV v Raad van bestuur van de Nederlandse Mededingingsautoriteit ECLI:EU:C:2009:110, Opinion of AG Kokott, para 71; Case 6–72 Europemballage Corporation and Continental Can Company Inc. v Commission [1973] ECR-215, para 26; British Airways (n 50) para 106.

73 TeliaSonera Sverige (n 55) para 22.

74 F Cenzig, Antitrust Federalism in the EU and the US (Routledge, 2013).

75 Council Regulation (EC) No 1/2003 of 16 December 2002 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty (Text with EEA relevance) OJ L 1, 4.1.2003, p. 1–25 (hereinafter Regulation 1/2003), article 3.

76 Directive (EU) 2019/1 of the European Parliament and of the Council of 11 December 2018 to empower the competition authorities of the Member States to be more effective enforcers and to ensure the proper functioning of the internal market (Text with EEA relevance.) PE/42/2018/REV/1.

77 Directive (EU) 1/2019 of the European Parliament and of the Council of 11 December 2018 to em- power the competition authorities of the Member States to be more effective enforcers and to ensure the proper functioning of the internal market.

78 Opinion of AG Rantos (n 7) para 23.

79 ibid.

80 There is no discussion on how to distinguish between national competition law and other laws within the meaning of Articles 3(2) and (3) Regulation 1/2003. Or Brook and Magali Eben, ‘Article 3 of Regulation 1/2003: A Historical and Empirical Account of an Unworkable Compromise’ (SSRN, 2022) <https://ssrn.com/abstract=4237413 or https://doi.org/10.2139/ssrn.4237413> accessed 29 October 2023.

81 Or Brook, Magali Eben, ‘Another Missed Opportunity? Case C-252/21 Meta Platforms V. Bundeskartellamt and the Relationship between EU Competition Law and National Law’ [2023] Journal of European Competition Law & Practice 1.

82 See Pablo Ibáñez Colomo, ‘Anticompetitive Effects in EU Competition Law’ [2021] Journal of Competition Law & Economics 309; Pablo Ibáñez Colomo, ‘The (Second) Modernisation of Article 102 TFEU: Reconciling Effective Enforcement, Legal Certainty and Meaningful Judicial Review’ (SSRN, 2023) 3 < https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4598161> accessed 22 October 2023.

83 Wouter Wils, ‘Procedural Rights And Obligations Of Third Parties In Antitrust Investigations And Proceedings By The European Commission’ May 2022, Concurrences N° 2-2022, Art. N° 106136.

84 ‘Competition authorities: Towards more independence and prioritisation? The European Commission’s “ECN+” Proposal for a Directive to empower the competition authorities of the Member States to be more effective enforcers’, Concurrences N°4-2017, pp.60-80, both also accessible at http://ssrn.com/author=456087, and L. Idot, ‘Reform of Regulation 1/2003: Power to set priorities’, Concurrences N° 3-2015, 51.

85 F Costa-Cabral and O Lynskey, ‘Family Ties: The Intersection Between Data Protection and Compe- tition in EU Law’ (2017) CMLRev 11 ff.; see also N Heilberger, F Zuiderveen Borgesius and A Reyna, ‘The Perfect Match? A Closer Look at the Relationship Between EU Consumer Law and Data Protection Law’ (2017) CMLRev 1427 ff.

86 Opinion of AG Rantos (n 7).

87 Servizio Elettrico Nazionale, GDF Suez Décision n° 14-MC-02 du 9.9.2014 relative à une demande de mesures conservatoires présentée par la société Direct Energie dans les secteurs du gaz et de l’électricité) and appeals, at https://www.autoritedelaconcurrence.fr/en/communiques-de-presse/9-september-2014-gas-market.