The often-quoted description of data as the "new oil" now seems rather quaint. The seemingly all-conquering tech giants are seen by many as surfing a tsunami of proprietary data with nobody else getting a free ride. But is the party nearly over in the EU? New regulation is focusing on data sharing and transparency as the key to breaking down barriers to competition in digital markets. While we don't have the final text or even the final position for all the incoming legislation, we do know there will be a very significant impact on the use of big data, so data-rich businesses need to follow developments closely.
What's the issue?
The symbiotic relationship between data and competitive advantage in the online world is well established. In many, but not all cases, the data is personal data. The way big tech collates and analyses user data to track users and serve targeted adverts, has been under particular scrutiny. The ability of large online platforms and search engines to make use of third party data from advertisers or sellers on their platforms, and the perceived lack of control users have over that data, is now the focus of legislators and regulators on the competition, consumer, digital and data sides.
Facebook (Meta) – a case in point?
One of the most high profile (but by no means the only) focus of actions targeted at the intersection of data and competition is Facebook (now Meta). Key actions include:
- In 2019, Germany made a reference to the CJEU, asking to consider whether Germany's competition regulator was correct in its assessment that Facebook abused its dominant position as a provider of social networks in Germany by processing user data in breach of the GDPR.
- In spring 2021, the European Commission and the UK's CMA separately announced investigations into Facebook's collection and use of data in the context of providing online advertising services. Attention is focused particularly on the single sign-on function and whether Facebook unfairly uses data from this and its advertising to prioritise its own services. Preliminary findings expected in summer 2022. The Commission is also looking at whether Facebook harms competition in neighbouring markets as a result of its market position in social networking and online advertising and whether it uses data from competing providers, obtained through their advertising on Facebook, to gain an unlawful competitive advantage. In the US, Meta is facing FTC action in the US on anti-trust issues.
- A class action said to worth $2.3bn was recently filed in the UK at the Competition Tribunal under the Consumer Rights Act 2015. It alleges Meta abused its market dominance by setting an unfair price for the free use of Facebook in the form of the personal data it collects from users.
While the outcome of these investigations and cases are pending, they demonstrate the close relationship between control of big data and competition.
Made to play nicely
The European Commission is tackling these issues through a raft of legislation, some of which focuses specifically on data and some of which only touches on it (see here for a summary and anticipated timelines). A few of the incoming initiatives are squarely aimed at tackling big tech's data advantage and levelling the data playing field.
European Strategy for Data
One of the main initiatives under the European Strategy for data is the draft Data Act, published in February 2022. As we discuss here, the Data Act aims to remove barriers to data sharing, give business users access to data they contribute to creating, and individuals more control over all their data (not just personal data). It will empower users of connected devices to access and share data they generate with third parties, as well as to switch cloud and edge service providers. It also aims to protect SMEs by providing a harmonised framework in which data can be shared, equalising access to data across the market. It will apply to relevant UK businesses operating in EU markets.
The Act is seen as a crucial tool to help share the benefit of data among a wider range of businesses, and to give users more control over data they contribute to creating. It is at the beginning of the legislative process and will sit alongside the Data Governance Act which creates a trusted framework for data sharing and data altruism.
Digital Services package
The Digital Markets Act will have a profound impact on players designated as "gatekeepers". The politically agreed version of the Digital Markets Act has been published. It introduces mandatory actions and prohibitions on gatekeepers designed to level the playing field for digital businesses. Data driven advantages including access to and collection of personal and non-personal data and analytics capabilities, are explicitly cited as relevant to a company's designation as gatekeeper. See here for more.
In respect of data, gatekeepers:
- must not combine personal data sourced from different core services, unless users consent to a GDPR standard (consent not to be sought more than once per year)
- must not process personal data from end users using third party services which use core platform services for their advertising purposes, unless users consent to a GDPR standard
- must not use non-public data generated from business and end users to compete with business users
- must not use personal data from users that are using the service provided by a third party when that third-party service is using the gatekeeper’s platform
- must provide continuous and real time access to data subjects whose personal data is processed
- must provide business users with free, effective, high-quality, continuous and real-time access and use of aggregated and non-aggregated data, generated in the use of the core platform services by those business users and the end users engaging with the products or services provided by those business users
- must provide advertisers with access to both aggregated and non-aggregated data for the ads they run.
The DMA is expected to be adopted in the coming weeks, meaning it will enter into force later in 2022. Following that, it will take six months to apply, likely taking up to mid-2023. The designation process will start, which might take up to mid-2023. From there, the regulatory dialogue would formally start. Finally, the compliance process is expected to begin around Q1 2024.
Political agreement has also been reached on the Digital Services Act. The agreed text had not yet been published at the time of writing, but the press releases indicate that large online platforms will need to protect users from illegal content, goods and services.
In respect of data:
- platforms must carry out systemic risk assessments, risk mitigation measures and independent audits. Personal data will inevitably be processed as part of such assessments and particular interactions with personal data may form part of risks identified
- certain platforms will also be required to comply with requests from relevant regulators to grant access to data sets to assess compliance with the DSA. There will be privacy implications where that data is personal
- platforms must provide transparency information to users about how content is recommended to them and how to choose at least one option not based on profiling
- platforms must provide transparency information to users about the identity of advertisers placing digital ads, and parameters used to target them at individuals. This is likely to involve processing of personal data
- targeted advertising based on sensitive personal data will be prohibited as will targeted advertising of any kind to minors.
The agreed text is now subject to formal approval by the European Parliament and Council. It will apply fifteen months from adoption or from 1 January 2024, whichever is later. However, it will apply to very large online platforms and very large online search engines four months after their designation as such.
Spotlight on targeted advertising
One of the areas in which access to data provides a crucial advantage is targeted advertising. The EU and the UK are both looking at the role data plays in the online advertising system and the extent to which it presents a barrier to competition and/or a privacy issue. As noted above, the DSA is likely to restrict certain types of targeted advertising and the EC's draft ePrivacy Regulation, currently stuck in trilogues, may tighten up rules on the use of cookies and similar technologies for the purposes of online tracking and targeted advertising.
New rules regulating the use of AI under the EC's draft AI Act may further reduce barriers to competition by requiring transparency of algorithms for certain types of AI.
The view from the UK
The UK government has been looking at reforming both competition and data protection policy, as well as at overhauling consumer protection laws. While its areas of focus are similar to the EU's, it has not got as far with concrete proposals.
The government's intention to create a lighter touch, alternative regime to the EU's in order to foster innovation and competition is well known. In its 'Benefits of Brexit' White Paper, published in January 2022, it suggested it will take a more targeted approach than the EU in terms of the digital markets competition regime.
Informed by the Furman Review and the CMA report of its market study into online platforms and digital advertising, as well as by the work of the Digital Markets Taskforce (the CMA working closely with Ofcom and the ICO), the government launched a consultation on potential changes to the competition regulation of digital markets in July 2021. This focused on the design of anew pro-competition regime for digital platforms with strategic market status to be overseen by the Digital Markets Unit which brings together members from the CMA, DCMS, BEIS and HM Treasury, the ICO, Ofcom and FCA (DMU).
In May 2022, the government published its response to the consultation outlining plans to introduce a legislative regime underpinned by binding codes of conduct individually targeted at companies engaged in "Digital Services" which are designated as having "Strategic Market Status" (SMS). The regime will be overseen and enforced by the DMU. It is explicitly targeted at a handful of 'big tech' businesses and overlaps with elements of the EU's Digital Services and Data packages.
In particular, the government intends the codes will introduce fair-play rules to make it easier for consumers to switch between digital service providers without losing their data, and give them greater overall control over their data. Rules will also be introduced to ensure fair prices for content providers like news publishers and advertisers. SMS firms will also be required to notify smaller firms about changes to algorithms which may impact their revenue. The DMU will have wide ranging powers to oversee and enforce the regime, including to fine SMS firms up to 10% of annual global revenue. These are likely to be brought in under the Digital Markets,Competition and Consumer Bill, announced in the Queen's Speech in May 2022.
The government's April 2022 response to the consultation on reforming competition and consumer law also proposes some more general reforms to the UK's competition regime but these focus largely on reforming existing processes and enhancing the CMA's enforcement powers, rather than on specifically data-related issues.
In addition, the UK government announced plans to overhaul the UK data protection regime in its September 2021 consultation 'Data a New Direction', suggesting a pro-competition, pro-innovation approach. Again, we have not reached the stage of developed proposals although the government announced the Data Protection Bill in the May Queen's Speech with publication expected before the summer recess in July and a response to the consultation with further detail expected by the end of June.
In short though, we have some way to go before we know how the UK's regime will compare with the EU's in these areas. The likelihood is there will be significant similarities as well as considerable differences.
Regulators at the ready
In the meantime, data protection and competition regulators continue to look closely at the use of data by digital market leaders. They have the power to impose considerable financial penalties under the data protection framework and, in the EU, under the competition regime, to those breaching the rules, but the EU's longer term approach is to break down the big data advantage through regulation, whether or not that advantage is an 'unfair' one in competition law terms.
It remains to be seen the extent to which the UK follows suit and what the impact will be if it does not, but in-scope UK businesses operating in the EU will be impacted by the incoming EU legislation, as well as by new UK rules. Things are definitely changing in the world of big data, and businesses need to stand by to absorb and adapt to the new laws.
