Facebook's Collection And Use Of Data From Third-Party Sources Is 'Abusive', Says Germany's Competition Authority

Privacy

from the informational-self-determination dept

As Techdirt has reported previously, Facebook is having various problems in the European Union because of the region’s privacy laws. It turns out that data protection is not the only area where it is coming under scrutiny. Germany’s competition authority, the Bundeskartellamt, has just made a preliminary assessment that Facebook’s data collection is “abusive”:

the authority assumes that Facebook is dominant on the German market for social networks. The authority holds the view that Facebook is abusing this dominant position by making the use of its social network conditional on its being allowed to limitlessly amass every kind of data generated by using third-party websites and merge it with the user’s Facebook account. These third-party sites include firstly services owned by Facebook such as WhatsApp or Instagram, and secondly websites and apps of other operators with embedded Facebook APIs.

This is not about privacy, then, but about Facebook’s alleged abuse of its dominant position in the German market. The German competition authority is not worried about Facebook’s use of personal data gathered directly on its own sites — not yet, at least — but the way in which data is transmitted back to Facebook from third-party sites, as a detailed background document (pdf) explains :

The current proceeding examines the terms and conditions Facebook is enforcing with regard to data from third party sources. These are on the one hand data generated by the use of services owned by Facebook, such as WhatsApp or Instagram, and on the other data generated by the use of third party websites and apps. If a third-party website has embedded Facebook products such as the ‘like’ button or a ‘Facebook login’ option or analytical services such as ‘Facebook Analytics’, data will be transmitted to Facebook via APIs the moment the user calls up that third party’s website for the first time. These data can be merged with data from the user’s Facebook account, even if the user has blocked web tracking in his browser or device settings. In the authority’s preliminary assessment, Facebook’s terms and conditions in this regard are neither justified under data protection principles nor are they appropriate under competition law standards

The detailed analysis from the German competition authority makes an interesting point about the nature of Facebook’s business model, and the fact that its users have no choice about accepting its terms and conditions:

Facebook offers its service for free. Its users therefore do not suffer a direct financial loss from the fact that Facebook uses exploitative business terms. The damage for the users lies in a loss of control: they are no longer able to control how their personal data are used. Facebook’s users are oblivious as to which data from which sources are being merged to develop a detailed profile of them and their online activities. On account of the merging of the data, individual data gain a significance the user cannot foresee. Because of Facebook’s market power users have no option to avoid the merging of their data, either. Facebook’s merging of the data thus also constitutes a violation of the users’ constitutionally protected right to informational self-determination.

The competition authority’s finding is preliminary: Facebook now has the opportunity “to comment on the allegations and provide justification for its conduct or offer possible solutions.” The company has already responded with a blog post by Yvonne Cunnane, Head of Data Protection, Facebook Ireland, in which she writes:

Although Facebook is popular in Germany, we are not dominant. We’re just one part of how people interact, and we must constantly innovate to ensure we’re meeting people?s expectations — from designing new features to improving reliability to giving people better controls over their experience on Facebook. If we fail, people will go elsewhere — as history has shown with other technology services over the years.

This is a crucially important battle for Facebook. If the German competition authority issues a final ruling next year that Facebook is abusing its dominant position through its use of data from third parties, it could order the US company to cease aggregating data in this way. That would be a major blow to Facebook’s current business model, in Europe at least, since it is likely that other competition authorities there would take the same line. Facebook derives much of its power as an advertising medium from the vast quantities of data gathered from all around the Web that it collects and uses for profiling.

As if Facebook did not have enough problems in the EU, France’s data protection agency has just ordered WhatsApp to stop sharing user data with its parent company, or face fines. Although these would be small under current legislation, once the EU’s new General Data Protection Regulation comes into force next year, they could be up to 4% of Facebook’s global turnover.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, data collection, germany, privacy
Companies: facebook, instagram, whatsapp