by Fatma Ceren Morbel
As we have discussed in our previous blogpost, Advocate General Rantos stated in his non-binding opinion on the case that although a competition authority does not have jurisdiction to rule on a violation of GDPR, it may investigate the compatibility of commercial practices with data protection laws. At that point, it was a question if his opinion would be shared by the CJEU as well.
On 4 July 2023, the CJEU gave its landmark decision[1] by ruling in a manner consistent with the Advocate General Rantos’ opinion, that when companies abuse their dominant market position, the competition authorities in Member States are authorized to investigate and sanction such violations. When there is a violation of data protection laws, competition authorities are responsible for consulting with the competent supervisory authority on the matter, as stated in the judgment, “it may be necessary for the competition authority of the member state concerned also to examine whether that undertaking’s conduct complies with rules other than those relating to competition law.”[2]
In its ruling, the CJEU explained that competition authorities are not substitutes for data protection authorities, as they do not monitor or enforce compliance with the GDPR.[3]
Data access and processing have become significant factors in the competition between undertakings within the digital economy, therefore, a violation of the GDPR may constitute an antitrust violation. Thus, the CJEU concluded that excluding the rules concerning the protection of personal data from the legal framework that competition authorities must consider when assessing abuse of a dominant position would ignore the reality of economic development and undermine the effectiveness of competition law within the European Union.[4]
In response to the Meta’s claim in the case, the CJEU stated that “in view of the nature of the services provided by the operator of an online social network, such an operator, whose activity is essentially economic and commercial in nature, cannot rely on the protection of an interest which is essential for the life of its users or of another person in order to justify, absolutely and in a purely abstract and preventive manner, the lawfulness of data processing such as that at issue in the main proceedings.”
According to the CJEU, the following requirements must be met for consent to be lawful:
“Those users must be free to refuse individually, in the context of the contractual process, to give their consent to particular data processing operations not necessary for the performance of the contract, without being obliged to refrain entirely from using the service offered by the online social network operator, which means that those users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations.”
Despite the fact that Facebook offers its services free of charge, the CJEU stated that the user cannot expect Facebook to use his or her personal information without his or her consent for personalized advertising purposes. The Court clarified that there is no legitimate interest that would override an individual’s right to privacy when controllers try to provide advertising, thereby limiting any controller located in Europe from running personalized advertising without prior consent.[5]
Under the EU Digital Markets Act (“DMA”), gatekeepers are already subject to similar rules as those imposed by the CJEU in this case. For instance, pursuant to Article 5(2)(b) of the DMA “The gatekeeper shall not do combine personal data from the relevant core platform service with personal data from any further core platform services or from any other services provided by the gatekeeper or with personal data from third-party services unless the end user has been presented with the specific choice and has given consent within the meaning of Article 4, point (11), and Article 7 of Regulation (EU) 2016/679.”
In order to prevent divergences between the competent national supervisory authority for data protection and the competent national competition authority, the CJEU has required both authorities to engage in “sincere cooperation”.[6]Accordingly, national competition authorities must consult with data protection authorities when assessing and implementing the GDPR. As part of this requirement, the data protection authorities are required to respond to requests for information or cooperation “within a reasonable period of time” and to inform the competition authority if they intend to consult other data protection authorities or the lead supervisory authority.[7]
Following the decision, the competition and data protection authorities have been assigned the responsibilities of cooperating and coordinating their interpretation of the law. The decision should, however, not be construed as an instrument for enforcing non-competitive goals through competition law. Competition authorities should continue to base their decisions primarily on competition factors.[8]
It is apparent that the Court’s decision will bring new questions to what extent the data protection violation must be based on the dominant market position. We remain to see the reaction and interpretation of this decision by national courts, supervisory authorities for data protection, and competition authorities.
[1] Case C-252/21: Meta Platforms and Others, 04 July 2023. ECLI:EU:C:2023:537.
[2] Case C-252/21: Meta Platforms and Others, 04 July 2023, para. 48. ECLI:EU:C:2023:537.
[3] Case C-252/21: Meta Platforms and Others, 04 July 2023, para. 49. ECLI:EU:C:2023:537.
[4] Case C-252/21: Meta Platforms and Others, 04 July 2023, para. 51. ECLI:EU:C:2023:537.
[5] Noyb, CJEU declares Meta’s GDPR approach illegal. CJEU joins noyb and EDPB view on Meta’s “GDPR bypass”, 4 July 2023. https://noyb.eu/en/cjeu-declares-metafacebooks-gdpr-approach-largely-illegal
[6] Case C-252/21: Meta Platforms and Others, 04 July 2023, para. 57. ECLI:EU:C:2023:537.
[7] Verena Grentzenberg, Philipp Schmechel, Jonas Kranz, CJEU’s landmark decision in Meta vs Bundeskartellamt, 12 July 2023. https://www.dlapiper.com/en/insights/publications/2023/07/cjeus-landmark-decision-in-meta-vs-bundeskartellamt
[8] Stefan Horn, ECJ rules on Meta data sharing that competition authorities may enforce data protection law, 4 July 2023. https://www.taylorwessing.com/en/insights-and-events/insights/2023/07/ecj-decision-in-the-facebook-case
