Harvesting Data in the Metaverse: Insights from ECJ’s Ruling on Meta Platforms
Introduction
On 4 July 2023, the European Court of Justice (“the ECJ”) handed down a preliminary ruling concerning the processing of personal data in accordance with the General Data Protection Regulation (“GDPR”) and an alleged abuse of dominance contrary to Article 102 of the TFEU in Case C‑252/21 Meta Platforms v Bundeskartellamt.
Facts
Meta Platforms Ireland operates the online social network Facebook and other online services within the European Union. Facebook’s business model is based on financing through online advertising, which is tailored to individual users based on their behaviour, interests, purchasing power, and personal situation. Such advertising is made possible by collecting users’ data on and off the social network so that Facebook can draw detailed conclusions about those users’ preferences and interests. In order to collect users’ data on and off the social network, Meta Platforms Ireland relies on the user agreement to which the users of the social network Facebook adhere when they click on the “Sign up” button, thereby accepting the general terms drawn up by that company. Acceptance of those terms is necessary to be able to use the social network Facebook. With regard to the processing of personal data, the general terms refer to that company’s data and cookies policies. According to those policies, Meta Platforms Ireland collects user- and device-related data about user activities on and off the social network and links the data with the Facebook accounts of the users concerned.
The German Federal Cartel Office brought proceedings against Meta Platforms, Meta Platforms Ireland, and Facebook Deutschland, resulting in a decision on 6 February 2019 (“the Decision”). The Decision prohibited the companies from (1) making the use of Facebook by private users in Germany subject to the processing of their off-Facebook data; and (2) processing the data without their consent on the basis of the general terms in force at the time. The Decision also required the companies to adapt their general terms which are made clear that those data would neither be collected, nor linked with Facebook user accounts nor used without the consent of the user concerned. More importantly, the Decision clarified that users’ consent is not valid if it is a condition for using the social network.
The German Federal Cartel Office based its decision on the finding that the processing of user data by Meta Platforms Ireland constituted an abuse of the company’s dominant position on the market for online social networks for private users in Germany. In particular, the general terms of the company were found to be an abuse of its dominant position and inconsistent with the values of the GDPR, and cannot be justified in the light of Articles 6(1) and 9(2) of the GDPR.
On 11 February 2019, Meta Platforms, Meta Platforms Ireland and Facebook Deutschland brought an action against the decision of the Federal Cartel Office before the Oberlandesgericht Düsseldorf (Higher Regional Court, Düsseldorf, Germany). The Court raised a number of questions, including (but not limited to): –
(a) whether a national competition authority may find, in the context of the examination of an abuse of a dominant position by an undertaking within the meaning of Article 102 TFEU, that that undertaking’s general terms of use relating to the processing of personal data and the implementation thereof are not consistent with the GDPR (“Question 1”); and
(b) whether the consent given by users to Facebook was valid for the purpose of the processing of personal data when Facebook had a dominant position on the national market for online social networks (“Question 2”).
As the Court took the view that the resolution of the case would depend on the answer to the above questions, it decided to stay the proceedings and to refer those questions to the ECJ for a preliminary ruling.
The ECJ’s Preliminary Ruling
Question 1
The ECJ held that in determining whether the conduct of the dominant undertaking has the effect of hindering the maintenance of the degree of competition existing in the market or the growth of that competition, the compliance or non-compliance of that conduct with the provisions of the GDPR may be a vital clue among the relevant circumstances of the case in order to establish whether that conduct entails resorting to methods governing normal competition and to assess the consequences of a certain practice in the market or for consumers (§47) . Therefore, it may be necessary for the national competition authority to examine whether that undertaking’s conduct complies with rules other than those relating to competition law, such as the rules on the protection of personal data laid down by the GDPR (§48). This is particularly so when access to personal data and the fact that it is possible to process such data have become a significant parameter of competition between undertakings in the digital economy. Therefore, excluding the rules on the protection of personal data from the legal framework to be taken into consideration by the national competition authorities when examining an abuse of a dominant position would disregard the reality of this economic development and would be liable to undermine the effectiveness of competition law within the European Union (§51).
However, in line with the duty of sincere cooperation enshrined in Article 4(3) TEU, when national competition authorities are called upon, in the exercise of their powers, to examine whether an undertaking’s conduct is consistent with the provisions of the GDPR, they are required to consult and cooperate sincerely with the national supervisory authorities concerned or with the lead supervisory authority, all of which are then bound, in that context, to observe their respective powers and competences, in such a way as to ensure that the obligations arising from the GDPR and the objectives of that regulation are complied with while their effectiveness is safeguarded (§§53-54).
The practical implication is that national competition authorities must ascertain whether the conduct concerned or similar conduct has already been the subject of a decision by the competent national supervisory authority or the lead supervisory authority or the Court. If that is the case, the national competition authority cannot depart from it, although it remains free to draw its own conclusions from the point of view of the application of competition law (§56).
In case of doubt or uncertainty, or if the national/lead supervisory authority has not investigated the matter, the national competition authority must consult and seek their cooperation in order to dispel its doubts or to determine whether it must wait for the supervisory authority concerned to take a decision before starting its own assessment. Reciprocally, the supervisory authority should respond to a request for information or cooperation within a reasonable period of time. In the absence of a reply, within a reasonable time, from the supervisory authority, the national competition authority may continue its own investigation (§§57-59).
Question 2
In determining whether a consent is freely given, the ECJ held that the following three considerations are material (§§143-145): –
(a) Consent cannot be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment (recital 42 of the GDPR).
(b) In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data where there is a clear imbalance between the data subject and the controller. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case (recital 43 of the GDPR).
(c) When assessing whether consent is freely given, utmost account must be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract (Article 7(4) of the GDPR).
The ECJ held that the operator of an online social network bears the burden of demonstrating that the data subject has consented to the processing of his or her personal data. The mere fact that the operator holds a dominant position on the social network market does not, as such, prevent the users of that social network from validly giving their consent to the processing of their personal data by that operator (§147). The dominance of the operator is nevertheless an important factor in determining whether the consent was in fact validly and, in particular, freely given. For instance, the existence of such a dominant position may create a clear imbalance, within the meaning of recital 43 of the GDPR, between the data subject and the controller (§149). The key question is whether users are free to refuse individually, in the context of the contractual process, to give their consent to particular data processing operations not necessary for the performance of the contract, without being obliged to refrain entirely from using the service offered by the online social network operator (§150). The German Court may consider whether users have been offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations not necessary for the performance of the contract.
Implications
This preliminary ruling of the ECJ will have a profound impact on the prevailing business models in the social network market. Currently, the popular social media platforms allow users to use their platform freely. In return, users give “consent” to the platforms to harvest their personal data so that the platforms may subsidise their free services through online advertising. This business model, especially if it is operated by a dominant player, may no longer be lawful in the EU in that the consent given by the users may not be regarded as being freely and validly given under the GDPR. These platforms may have to provide users with an option, if necessary for a fee, to continue to use the platforms without having to consent to share their personal data which are not necessary for the operation of the platforms. In other words, there may be some sort of “premium account” of Facebook, Instagram, Twitter, etc. for the EU market in the near future.
|
Author Carter Chim
“Carter is well known amongst the Hong Kong Bar as a leading specialist in Hong Kong competition law. He is sought after by practitioners for his superb knowledge of competition law and experience in a growing number of cases in Hong Kong.” “Carter Chim…is frequently instructed on complex and high-value cases.” — Legal 500 Asia-Pacific 2023 Carter has been recognised by The Legal 500 (Legalease) as a Leading Junior (Tier 1) in Competition Law for three consecutive years (i.e. 2021 to 2023). Carter has acted in a number of landmark constitutional and administrative law cases before the Hong Kong Court of Final Appeal, including Secretary for Justice v Leung Kwok Hung [2021] HKCFA 32 (concerning the scope of parliamentary privilege enjoyed by a member of the Legislative Council in the course of proceedings). General civil matters form a core part of Carter’s practice. Matters which he is regularly instructed to handle include winding up petitions (for the successful petitioner in Re Yuan Tong Global Financial Group Ltd [2021] HKCFI 1534), water leakage cases, property disputes, discrimination cases, and more. Carter currently teaches Civil Procedures and Clinical Legal Education at The University of Hong Kong. Visit Carter’s profile for more information. |
This article was first published on 21 July 2023.
Disclaimer: This article does not constitute legal advice and seeks to set out the general principles of the law. Detailed advice should therefore be sought from a legal professional relating to the individual merits and facts of a particular case. The photographs which appear in this article are included for decorative purposes only and should not be taken as a depiction of any matter to which the case is related. The views and opinions expressed in this article/material are solely those of the members authoring it and do not necessarily reflect the official policy or position of Denis Chang’s Chambers.