ECJ rules on Meta data sharing that competition authorities may enforce data protection law

Today, the ECJ ruled on important questions regarding the interpretation of the GDPR in a preliminary ruling procedure concerning the data collection and processing of Meta for its social network Facebook. The decision contains important statements on the relationship between competition law and data protection law and thus on the competences of competition and data protection authorities and their duty to cooperate.

Background of the decision

The starting point of the proceedings before the ECJ was a decision by the German Federal Cartel Office, according to which Meta's terms for the use of Facebook infringed the German prohibition of the abuse of a dominant market position. The German Federal Cartel Office had based its decision on the fact that Facebook's terms violated the GDPR because the use of Facebook required that Meta was allowed to collect and process user data from various sources and that there was no effective consent from users to do so. This infringement of the GDPR constituted an abuse of Meta's dominant position. The German Federal Cartel Office's decision was criticised by some commentators. One objection was that competition authorities should not base violations of competition law on infringements of the GDPR. Competition law was not a general instrument for solving data protection problems.

ECJ clarifies competences and cooperation obligations

The ECJ has now ruled in favour of the German Federal Cartel Office's view. Here are the most important statements of the judgment in this context (para. 36 et seqq.):

• The GDPR does not prevent national competition authorities from finding that a data processing operation carried out by an undertaking in a dominant position does not comply with the GDPR.
• In deciding whether a certain conduct of a dominant undertaking constitutes an abuse of such market power, competition authorities may also assess, as part of the relevant circumstances, whether the conduct is compatible with the GDPR. In this respect, compatibility with the GDPR can be an important indicator for the assessment of whether the conduct is permissible under competition law.
• In this context, the ECJ also emphasises the importance of personal data for competition. These are an essential parameter of competition in the digital economy. For this reason alone, the GDPR must be taken into account by competition authorities as part of the assessment under competition law.
• However, the ECJ also clarifies that competition authorities do not replace data protection authorities. In particular, they neither monitor nor enforce the application of the GDPR.
• Furthermore, the ECJ also emphasises that the coherent application of the GDPR must not be forgotten when applying data protection law in the context of the competition law assessment. This follows from the duty of sincere cooperation enshrined in Art. 4 (3) TEU.
• Therefore, national competition authorities are obliged to consult with data protection authorities when assessing and applying the GDPR.
• Thus, the competition authority must check whether a certain conduct has already been the subject of a decision by a data protection authority or the ECJ. If so, it may not deviate from this decision.
• In other cases competition authorities must consult data protection authorities as well and ask for their cooperation before starting their own assessment.
• Data protection authorities must in turn respond to requests from competition authorities within a reasonable period of time. If the data protection authority does not respond within a reasonable period of time, the competition authority may continue its own investigation.

Implications of the judgment

The ECJ has encouraged the competition authorities to take data protection considerations into account in their assessments under competition law. And other areas, e.g. regulations on consumer protection, seem to be covered by the ECJ decision as well. It would be good if the competition authorities will nevertheless continue to base their decisions primarily on competition considerations, because competition law should not become an instrument for enforcing non-competitive goals.

In the interest of a coherent application of the GDPR, the ECJ rightly emphasises the information and cooperation obligations of the competition and data protection authorities. It is telling in this respect that the proceedings now continue before the specialised Cartel Senate of the Higher Regional Court Düsseldorf, which now has to decide on detailed questions of the interpretation of the GDPR.