On February 7, 2019, the Bundeskartellamt, the German antitrust authority, prohibited Facebook from combining data concerning German Facebook users gathered also from third party websites when the user didn’t give voluntary consent to this practice.
The decision concerns all private users of Facebook based in Germany.
According to the Bundeskartellamt’s decision, until now, individuals have only been able to use Facebook services if they agreed to the terms of service, including the following:
Facebook can collect users’ data on (i) its website, on (ii) Facebook-owned websites and apps (e.g., WhatsApp and Instagram) as well as on (iii) third party websites and smartphones. By utilizing all these sources, Facebook built unique databases for each individual user – all without the users’ consent.
“In the authority’s assessment, these terms and conditions are neither justified under data protection principles nor are they appropriate under competition law standards.”
The Bundeskartellamt found to be competent since “Facebook has a dominant position in the German market for social networks and is therefore subject to abuse control under competition law.”
In addition, the antitrust authority deemed to be competent since Facebook – a dominant company – enacted “exploitative business terms” by making the use of its services conditional upon users granting the company extensive permission to process their personal data.
Facebook users did not suffer a direct financial loss from Facebook’s exploitative business terms but “[t]he damage for the users lies in a loss of control: They are no longer able to control how their personal data are used.”
The antitrust authority didn’t fine Facebook but ordered the company to change the terms of service and to stop processing data without consent. Facebook may no longer combine data in the comprehensive manner described above, or only to a highly restricted extent. Without such consent, data processing must generally take place with internally separated processes.
In addition, Facebook must transparently communicate which data processing activities the company is actually carrying out.
Furthermore, the Bundeskartellamt ordered Facebook to submit an implementation plan setting out the details of the technical implementation of the obligations.
Facebook has 12 months to comply or could appeal to the Düsseldorf Higher Regional Court.
Further information on the proceeding B6-22/16, Facebook, Exploitative business terms pursuant to Section 19(1) GWB for inadequate data processing, can be found in a background paper.
For more information on how privacy may impact your business, contact Francesca Giannoni-Crystal. Thanks to Federica Romanelli