German Antitrust Component of GDPR Consent – Bundeskartellamt’s Facebook Decision

On 7 February 2019, the German Bundeskartellamt (Federal Antitrust Authority) published in English “background information” on its Facebook decision imposing on Facebook far-reaching restrictions in the processing of user data. In the authority's assessment, Facebook's terms and conditions on processing user data are neither justified under data protection principles nor appropriate under competition law standards. Surprisingly, the Bundeskartellamt offers its own interpretation of GDPR's concept of "free consent", despite not beeing responsible for data protection as federal authority. For an accurate critique see Härting, "The German Antitrust Authority’s Interpretation of GDPR Consent – Facebook Decision", CRonline Blog, 8 February 2019

Facebook's Practice

So far individuals have only been able to use Facebook’s social network if they agreed to the terms of service stipulating that Facebook can collect many data outside of the Facebook website in the internet or on smartphone apps and assign these data to the respective Facebook user account. This means that not only the data collected on Facebook’s website, but also those collected on Facebook-owned websites and apps as well as on third party websites and smartphones, could be combined and assigned to the user’s Facebook account. This combination of data sources in particular enabled Facebook to build a unique database on each individual user.

Bundeskartellamt's Facebook Decision

The Bundeskartellamt prohibits this practice. In the future:

• Facebook may only combine data collected for its services like WhatsApp or Instagram and assign them to a Facebook user account if users give their voluntary consent to this practice.
• In the case of data from third party websites, voluntary consent by the user is already required for their collection. ‘Voluntary’ means that the use of Facebook’s services must not be subject to the users’ consent.
• If users do not consent, Facebook may no longer:
  > combine data in such comprehensive manner, or only to a highly restricted extent; and
  > data processing must generally take place in an internally separated process.
• When tracking users in the internet and in apps, the comprehensive collection of all user data created in this process is only possible subject to the voluntary consent of the users.

Measures Against Facebook

Under the Bundeskartellamt’s decision Facebook is required to adapt its terms of service and data processing accordingly.

If Facebook intends to continue collecting data from outside the social network and combining them in users’ accounts without the consent of users, the processing of these data must be substantially restricted. A number of different criteria are feasible: e.g. :

• restrictions on the amount of data,
• restrictions on purpose of use,
• restrictions on type of data processing,
• additional control options for users,
• anonymisation,
• processing only upon instruction by third party providers,
• limitations on data storage periods, etc.

Facebook is obliged to develop proposals for possible solutions and submit them to the Bundeskartellamt. The authority will then examine whether the proposals fulfil the requirements.

Result

Essentially the Bundeskartellamt has prohibited Facebook from stipulating in its terms of service that the use of the social network Facebook.com is subject to the company being able to collect and use data generated by the use of Facebook-owned services such as WhatsApp and Instagram and assign them to the user accounts of the social network without the consent of the users.

Bundeskartellamt, “Bundeskartellamt prohibits Facebook from combining user data from different sources“, Press Release, 7 February 2019