A Matter of Choice: The German Federal Supreme Court’s Interim Decision in the Abuse-of-Dominance Proceedings Bundeskartellamt v. Facebook (Case KVR 69/19)

1 Introduction

In June 2020, the Federal Supreme Court of Germany (Bundesgerichtshof) upheld the 2019 decision of the Federal Cartel Office (Bundeskartellamt) against Facebook during interim proceedings.¹ It preliminarily confirmed that the latter abused its dominance on the (national) market for social networks for private users to the detriment of its users, overruling a preceding decision of the Düsseldorf Court of Appeal (Oberlandesgericht Düsseldorf).² Facebook must, in a nutshell, stop collecting data about its users (and their terminal devices) without their consent when they are using apps and visiting websites outside the social network.

The case is relevant from different perspectives. Firstly, it is set at the core of the debate on digital platforms providing services to consumers without demanding monetary compensation, but obtaining far-reaching access to their users’ personal data instead. This notion of “data as counter-performance” should be assessed with a view to the (yet to be implemented) Directive (EU) 2019/770 on certain aspects concerning contracts for the supply of digital content and digital services.³ Secondly, the case sheds further light on the relationship of data protection legislation, most notably the General Data Protection Regulation (GDPR),⁴ and competition law, as the Bundeskartellamt’s line of argument was strongly based on Facebook’s alleged non-compliance with the GDPR. Thirdly, to the surprise of many, the Court partially based its decision on the consideration that, for many users, Facebook acts as an essential forum by enabling them to exchange views and participate in public debates. Based on this finding it subsequently found (when balancing the interests concerned) that Facebook was indirectly bound by the human rights enshrined in the German constitution, even though it is a private entity. The long-term implications of this finding in areas other than competition law, for instance in the context of discriminatory advertising, can hardly be foreseen.

2 Facts of the Case

2.1 Previous Proceedings

In February 2019, the Bundeskartellamt issued a decision against Facebook based on Sec. 19 Competition Act, the national equivalent to Art. 102 Treaty on the Functioning of the European Union (TFEU).⁵ It found that Facebook is dominant on the market for social networks and abused this position by using terms of service allowing it to collect personal data of its users (and data related to their terminal devices) outside the actual social network and assign these data to the individual user accounts. The decision prohibited use of these conditions and the corresponding data processing envisaged by Facebook. It only covered what the authority coined “Off-Facebook” data, i.e. those collected on websites and apps outside the social network. This includes services owned by Facebook (Instagram, WhatsApp etc.), but also third-party websites (such as online shops) that oftentimes do not even show any readily apparent connection to Facebook at all. The data is collected through so-called Facebook Business Tools, using various techniques such as plugins. Data collected while using the actual social network were coined “On-Facebook” data. The Bundeskartellamt essentially argued that the terms of service used do not provide any legal basis for the personal data processing under Art. 6(1) GDPR. According to the authority, the take-it-or-leave-it situation users were subjected to was abusive in that it made them lose control over their personal data and harmed competition. Facebook appealed the decision to the competent Düsseldorf Court of Appeal and applied to suspend execution of the decision until the main proceedings are over.

In August 2019, the Düsseldorf court granted interim relief to Facebook. Despite the cursory nature of the proceedings, the decision was highly detailed. It suspended the authority’s decision based on several grounds, implying clearly that it would eventually be annulled in the main proceedings. Among other reasons, the Düsseldorf court found that Facebook’s conduct did not result in any damage to competition, as users suffered no financial loss. It held that no causality was given between Facebook’s market dominance and use of its terms of service, arguing that other companies were using similar conditions and the “abusive” terms of service were thus not deemed a result of market dominance. The court further argued that no exploitative abuse was given as users freely and willingly agreed to the terms of service and were free to abstain from using the social network altogether. It did not further elaborate on the alleged violation of GDPR requirements, arguing that this was not relevant for the case at hand.

2.2 Decision of the Federal Supreme Court

The Federal Supreme Court, still in interim proceedings, overruled the decision of the Düsseldorf court. Facebook must start implementing the decision, pending a final judgment in the main proceedings.

2.2.1 Theory of Harm: aufgedrängte Leistungserweiterung

The Court chose a different approach to the case than the Bundeskartellamt did while still finding an exploitative abuse under Sec. 19 Competition Act. The decision does not put data protection issues at the forefront, but rather competition policy considerations. The theory of harm used is called “aufgedrängte Leistungserweiterung”, which can be roughly translated as “imposed extension of services”.⁶ Here, it is based on the differentiation made between “On-Facebook” and “Off-Facebook” data. According to the Court, this two-tier structure corresponds to two different levels of personalization of the “user experience”, whereby the price to be paid (in the form of personal data) is higher when “Off-Facebook” data are also used. The Court argues that use of the social network – browsing it, connecting with friends etc. – is easily possible using “On-Facebook” data only, and that the processing of these data suffices for financing the service. Additional “Off-Facebook” data use provides for a more personalized user experience. Yet, it is not strictly necessary for providing the product Facebook’s users are looking for.

The theory of harm is, in essence, that there is a significant number of users who would like to use Facebook without the higher degree of personalization (and the higher data price) that goes hand in hand with the processing of “Off-Facebook” data. But as they have no choice, they are forced to agree to the whole package, i.e. “On-” and “Off-Facebook” data processing.⁷ In other words, the problem is that many users must use and “pay” for a service they do not want. The Court argues that in a competitive scenario, this outcome could not be expected: the market would cater for those users not willing to “give away” so much data and users would have a choice between more or less intensive data collection.⁸ The Court sees damage to competition for two reasons: Firstly, users lack choice and are forced to supply more data than they wish to, having to use a product they do not want in its entirety. Secondly, Facebook’s (potential) competitors are harmed as it becomes more and more difficult for them to compete for advertising contracts. Regarding the latter aspect, several factors come into play: Facebook benefits from direct network and lock-in effects. In addition, the higher quantity and quality of the data it is able to collect makes it more attractive for advertising companies.

2.2.2 Overview of the Court’s Approach

The Court goes to great lengths in arguing that Facebook is dominant on the market for social networks, describing the well-known economic effects of multi-sided platforms.⁹ It then presents its overall theory of harm in that Facebook abuses its market dominance by making all (private) users agree to terms of service that allow Facebook to collect “Off-Facebook” data and merge them with the user accounts without their further consent.¹⁰ In the following, the main strands of argument will be summarized.

• (a) The Court starts by contextualizing the economic role of the personal data provided by the users.¹¹ It argues that these data have a monetary value for Facebook, even though they are non-rival, non-exclusive etc., and must thus be treated as a counter-performance. The user data finance the social network and generate profit on the other side of the market, where Facebook sells advertising spots. Thus, there is a direct financial link between these two sides. With an increasing quantity of data, Facebook becomes more and more attractive for advertisers, as users can be targeted more precisely and effectively. This assessment is based both on a competitive assessment and on the (not yet implemented) Directive (EU) 2019/770, which in its Art. 3(1) recognizes that personal data can be a counter-performance.

• (b) The Court disagrees with the Düsseldorf court on the issue of strict causality between market dominance and use of the abusive terms of service. It opts for a normative approach instead.¹² It argues that causality is given, as Facebook uses terms of service to the detriment of its users (who would, in a competitive scenario, profit from more available options) which, at the same time, also impedes competition in relation to its competitors. Thus, the Court applies the rather lenient causality requirements used on a European level in cases of exclusionary abuse¹³ to an exploitative one. A decisive factor within this case-specific assessment is that the abusive conduct vis-à-vis the users triggers negative effects for competition on the market for online advertisements as well. The underlying idea is that, in such a situation, one must assess the overall effect on competition. Consequently, it does not matter if other, non-market-dominant companies would be factually able to impose the same terms of service on their users, as long as the damage to competition results from the market dominance of the company in question.

• (c) The Court further elaborates on why Facebook’s conduct leads to an outcome deviating from the outcome to be expected in a competitive scenario.¹⁴ The Bundeskartellamt conducted a survey, finding that a significant number of users would rather not provide “Off-Facebook” data. Many would even prefer a monetary payment option instead. The Court argues that in a competitive setting, Facebook would thus have an incentive to engage as many users as possible, as this would strengthen its position vis-à-vis advertising partners. The fact that Facebook does not provide a less “data-intensive” option indicates that it can act on the market irrespective of user preferences, which in turn implies an abuse of dominance. The Court addressed a rather obvious defence put forward by Facebook, which might well be used by other “tech giants” in other contexts: it claimed that the outcome was not anti-competitive, as other companies were relying on similar terms of service. Yet, the Court found that Facebook’s market dominance is so strong that imitation of its terms of service by other companies is natural and does not allow any inferences to be drawn on what a competitive outcome would look like.¹⁵

• (d) The Court finds that Facebook’s use of its terms of service impedes competition.¹⁶ First of all, competitors are facing entry barriers to the market for social networks, as Facebook benefits from direct network effects on the user side: the more users it has, the more attractive it is for new ones. On top of that, competition is also impeded from a different point of view: the increasing amount and quality of the data Facebook has access to (a result partially due to its “data hungry” terms of service) may lead to anti-competitive effects on the market for online advertisements as well. (Potential) competitors who do not have access to data of this quantity and quality will face severe difficulties when it comes to selling online advertisements. This, in turn, makes it difficult to finance a social network. As a result, the entry barriers for (potential) competitors to the market for social networks are increased further. It does not matter whether Facebook is dominant on a (yet to be further defined) market for online advertisements on social networks as well, as the negative effects of its conduct do not necessarily have to occur on the market a company is dominant on.

• (e) A crucial part of the decision is the final balancing of all interests involved in the case at hand, based on the factual findings.¹⁷ The Court sticks to the idea that competition is harmed both vertically and horizontally: vertically, a certain number of users must pay for an extended service they do not actually want, and, horizontally, competition is impeded on the advertising market.

  With a view to those users who have to accept all of Facebook’s conditions even though they would actually rather opt for the slim “On-Facebook” version, the Court confirms an exploitative abuse although it would be possible for the users to refrain from using the service altogether.¹⁸ It elaborates that for many users, Facebook is an essential forum used to exchange views and opinions and participate in public debates.¹⁹ Its role is strengthened by direct network effects and the particularly high number of users, which makes switching to another forum barely possible. The Court makes reference to national case law on third-party effects of fundamental rights (mittelbare Drittwirkung), quoting a decision²⁰ by the German Federal Constitutional Court that, under certain circumstances, even private – as opposed to state – entities offering services to the general public can be indirectly bound by the principle of equal treatment (and other human rights) contained in the German constitution.

  In a similar vein, the Court enters into a line of argument based on data protection considerations.²¹ It finds that when balancing the interests involved, particular attention must be paid to the (national) constitutional right to informational self-determination (Recht auf informationelle Selbstbestimmung)²² as well as the GDPR’s requirements, in particular those on legal bases under Art. 6 GDPR (such as consent and contractual necessity). For online communication and public discourse, Facebook plays an essential role, which makes it relevant in political, societal and economic terms. In order to safeguard the right to personal data protection, users must be protected from an overly far-reaching commercial exploitation of their personal data when communicating online. This holds true even though Facebook is a private entity, and thus not directly bound by human rights. Still, the Court finds, these constitutional values must be taken into consideration when interpreting general clauses of civil law, such as Sec. 19 Competition Act. It found that, as a result of this third-party effect, Facebook – providing a framework for public communication – may even be bound in the same way as public authorities are. The Court underlined that national and European law both play a role in this context. While the GDPR shapes the right to personal data protection (by, for instance, defining legal bases), national constitutional law should also be taken into consideration when assessing whether Facebook’s terms of service are abusive. The Court did not decide whether agreement to the terms of service could be seen as valid consent under Arts. 6(1)(a) and 4(11) GDPR.

• (f) Eventually, the Court addresses Facebook’s (unsuccessful) defence that user consent is not necessary, as other legal bases would apply anyway.²³ Readers will probably not be too surprised that the extensive data collection and processing in question is neither necessary for compliance with legal obligations²⁴ nor to protect the vital interests of its users (Art. 6(1)(c) and (d) GDPR). Also, Facebook failed to show that processing can be based on its legitimate interests (Art. 6(1)(f) GDPR).

3 Analysis

The Facebook case is relevant from three different viewpoints in particular.

3.1 Data as Counter-Performance

The Facebook case is relevant for the debate²⁵ on data as counter-performance in the context of Directive (EU) 2019/770 on contracts for the supply of digital content and services. The Court refers to the (not yet implemented) Directive and considers the “Off-Facebook” data collected from users to be a contractual counter-performance.²⁶ Unfortunately, the approach the Court took to the case left many questions unanswered that might become relevant in the future.

Directive (EU) 2019/770 in its Art. 3(1) draws a fine line between the provision of data as counter-performance and data processing “for the purpose of supplying the digital content or digital service”.²⁷ In the latter case, the Directive is not applicable, as the data processing is necessary anyway and does not provide commercial value for the trader. Facebook is a good example for showing that the differentiation between the data processing necessary for performance of the contract and the provision of data as a counter-performance can be cumbersome. For instance, to a certain extent, users have a vested interest in providing personal data in order to receive a good, personalized service.²⁸ A social network like Facebook only functions if users provide information about themselves, so it would be fair to argue that provision of one’s name, date of birth, profile picture etc. per se would not be a counter-performance on the user side. Based on that, one might even argue that increased personalization based on as much data as possible might well be necessary to provide a truly personalized social network, finding that “Off-Facebook” data processing is also necessary for the purpose of supplying the service. The problem here is that these assessments eventually depend on how to interpret the contractual duties in a given case: what exactly can users demand from Facebook? Depending on the individual contractual duties, a legal basis can be found in Art. 6(1)(b) GDPR. To the extent contractual necessity is not given, user consent must be retrieved (Art. 6(1)(a) GDPR)²⁹ as long as no other legal basis applies, such as compliance with a legal obligation (Art. 6(1)(c) GDPR). It is not clear how to deal with a situation where one party to the contract – in particular a market-dominant one – unilaterally drafts terms of service in a way that purposefully increases the amount of data to be processed as a contractual necessity, simply in order to be able to invoke Art. 6(1)(b) GDPR.³⁰ In the case at hand, arguing that “Off-Facebook” data collection is necessary to fulfil the contract is not convincing, as Facebook does process those data not only for personalization in the sense of a better user experience, but also for another purpose users regularly do not aim for, namely advertising.³¹ Thus, in casu, some of the data Facebook collects about its users must be considered a counter-performance. Still, it is difficult to define the tipping point between data as a contractual necessity and data as a counter-performance.

The need to conduct such differentiation is mirrored in the level of data protection law. Here, further complications are looming. When personal data are processed, the GDPR is applicable and the trader (here: Facebook) must find a suitable legal basis for the processing.³² Article 6(1)(b) GDPR provides such a legal basis when the data processing is necessary for the performance of a contract. Yet, if the data are meant to (also) serve as a counter-performance, the trader is only allowed to process them if users have granted consent under Art. 6(1)(a) GDPR as the other legal bases contained in Art. 6(1) GDPR would not cover this purpose. Insofar, Art. 3(1) Directive (EU) 2019/770 and Art. 6(1)(a) and (b) GDPR can be applied in parallel, as both make it necessary to differentiate whether data processing is “necessary” to fulfil contractual duties or not. Hence, both layers – contract law and data protection law – should be seen as distinct, but at the same time intrinsically connected and interwoven. In the case at hand, it might indeed be argued that “Off-Facebook” data processing is only lawful under the GDPR if valid consent is given under Arts. 6(1)(a) and 4(11) GDPR, as the processing of “Off-Facebook” data arguably does not appear to be necessary to run the social network. Unconvincingly, Facebook tried to somehow invoke all legal bases under Art. 6(1) GDPR in its terms of service, with a particular emphasis on contractual necessity, consent and legitimate interests.³³

Regarding the above considerations, the debate on data as a counter-performance is particularly relevant with a view to market-dominant platforms in the digital economy providing seemingly “free” services. Unfortunately, due to its chosen theory of harm, the Court saw no reason to dig deeper into the relationship between contract and data protection law. Had Facebook been treated as an “excessive pricing” case instead,³⁴ then it would have provided a valuable opportunity to clarify some of the questions raised above, as the Court would have had to assess what the exact counter-performance on the user side is and why it is excessive.

3.2 Unequal Distribution of Power under Competition and Data Protection Law

The Court’s decision obliging Facebook to give users a choice between more or less intensive data personalization is based on the notion of user autonomy.³⁵ The reasoning takes recourse to competition policy considerations, not to data protection law. Insofar, it diverges from the Bundeskartellamt’s reasoning. The Court’s dogmatic approach is convincing, taken that its decision is based on a breach of competition law: it puts the role of users as market participants at the forefront, not their role as data subjects. A closer look at the GDPR’s regulation of consent – a legal basis based on user autonomy and choice itself – shows that not only competition law, but also data protection law aims at solving situations where an unequal distribution of power between parties is given. The Court’s decision can be seen as a welcome advancement of user autonomy also from a data protection perspective. By taking recourse to data protection legislation, such as the right to informational self-determination, legal basis requirements under the GDPR etc., the Court made clear that this legal regime played an indirect, yet significant part of the decision.

Basing its decision on the aufgedrängte Leistungserweiterung theory of harm, the Court did not have to decide whether or not acceptance of Facebook’s terms of service would fulfil the requirements on consent formulated in the GDPR.³⁶ This assessment would not only have been interesting regarding general questions of data protection law enforcement vis-à-vis online platforms, but also for the debate on data as counter-performance described above.

Assuming that Facebook demands consent to the processing of “On-” and “Off-Facebook” user data as a form of payment, then a key question from a data protection point of view would be whether this consent is “freely given” or not.³⁷ In this regard, Art. 7(4) GDPR is relevant. It reads: “When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract (…) is conditional on consent to the processing of personal data that is not necessary for the performance of that contract”. Recital 43 GDPR goes on to state that consent “is presumed not to be freely given (…) if the performance of a contract (…) is dependent on the consent despite such consent not being necessary for such performance”. This wording – postulating a general presumption – is problematic, as the Recital is significantly stricter than Art. 7(4) GDPR, which is part of the GDPR’s binding provisions. Recital 43 GDPR refers to situations where there is a “clear imbalance” between the data subject and the data controller³⁸ “and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation”. The Recital names consent given to public authorities as an example, thereby showing that it is its telos to protect data subjects/users in situations where one party has more power than the other one. There is no reason why this should not apply to imbalance in economic power, too. Thus, as a rule of thumb it is safe to assume that the GDPR’s requirements on consent also aim at protecting the weaker party when the other one has significantly more power. A minori ad maius, this must hold true even more for market-dominant companies. Insofar, competition and data protection law share some common goals.

Yet, open questions remain regarding “consent as counter-performance” and when it is “freely given” or not. Several factors come into play. For instance, a general presumption that consent is always void in certain situations might be considered overly paternalistic and would be problematic with a view to Art. 8(2) Charter of Fundamental Rights of the European Union. As part of the right to the protection of personal data, reference is made therein to consent as a legal basis. This in turn, arguably, grants users a constitutional guarantee to freely decide whether they would like to provide personal data in a specific situation.³⁹ This right cannot be restricted without good cause, as this would endanger the users’ personal autonomy as well as the freedom of contract both parties – the users and Facebook – can rely on. A general presumption that in situations like the one at hand consent is void would fundamentally question whether consent to data processing can represent a contractual counter-performance in the first place. Such interpretation of Arts. 4(11), 7(4) and Recital 43 GDPR would run entirely counter to Directive (EU) 2019/770, which does recognize data as counter-performance,⁴⁰ and could significantly impede many business models of the data-driven economy.⁴¹ The decision if consent is freely given and how to interpret Art. 7(4) GDPR thus ultimately depends on the individual case. During the assessment, one must ensure a fair balancing of the various interests at stake, protecting users who are dependent on certain services from granting “consent” that is not actually free while safeguarding their personal autonomy and freedom.

In casu, with Facebook being a market-dominant company and the Court’s finding that it plays a major role for public discourse, there appears to be a strong case that consent was not freely given through acceptance of the terms of service. This finding is not based on (and does not question) the business model of Facebook per se, which is legitimate.⁴² Yet, an obligation to offer a choice between “Off-Facebook” and “On-Facebook” data processing can indeed be based not only on Sec. 19 Competition Act (and, arguably, Art. 102 TFEU), but also on Arts. 4(11) and 7(4) GDPR. Insofar, Recital 43 GDPR seems to be tailored to the case at hand: “Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case (…)”.

Overall, the two legal regimes can be applied coherently despite their different objectives (protection of competition v. protection of personal data) as both provide certain protection against an unjust imbalance of power. Yet, the relationship between data protection, consumer protection and competition law calls for further research, in particular when it comes to their scope of application and enforcement issues.⁴³ Besides, the starting point of the Court’s theory of harm was that terms and conditions used by a market-dominant company can be an abuse of dominance. This leaves room to base other cases on breaches of data protection law contained therein, if an exploitation of users with relevance for the competitive process can be proven.⁴⁴

3.3 Human Rights Considerations

The Court argues that users depend on Facebook, finding that the social network is to some extent (indirectly) bound by the human rights provided in the German constitution. The reason is that Facebook provides a forum for communication which is essential for participation in public debates. The judgment (by the German Federal Constitutional Court) referred to by the Court deals with the question under what circumstances football clubs (running nationwide football stadiums and organizing matches) are allowed to ban individuals from entering these premises and watching the games.⁴⁵ The Constitutional Court found that the football clubs – holding a quasi-monopoly over stadiums throughout Germany – must exercise their property rights having at least a certain degree of regard to the principle of equal treatment, even though as private entities they are not directly bound by the constitution. In a related decision, the German Federal Constitutional Court (during interim proceedings) hinted at Facebook’s essential role for communication and public discourse as well, stressing how far-reaching its indirect human rights obligations possibly are regarding the principle of equal treatment.⁴⁶

The Court’s reliance on constitutional law allowed it to consider during its balancing of interests both Facebook’s role as a medium for public communication and the users’ right to protection of their personal data. The future implications going beyond that remain to be seen. In a competition law context, they might, at least in theory, pave the way to applying or rethinking the essential facilities doctrine.⁴⁷

More importantly, regarding the selling of advertisements – Facebook’s main source of income – the human rights dimension the Court presented might turn burdensome for the company. Presuming that Facebook is (indirectly) bound by human rights vis-à-vis its users, this means that it must not discriminate against them based on a protected ground. Private entities are in principle allowed to freely discriminate between users, as human rights – such as the principle of equal treatment – are directed at state bodies only. Private entities are merely bound by civil law anti-discrimination legislation, in particular those national laws implementing the EU non-discrimination directives.⁴⁸ Yet, these obligations are fragmentary when compared to the obligations state bodies face under constitutional law.⁴⁹ In 2019, the United States Department of Housing and Urban Development charged Facebook with violation of the Fair Housing Act by

encouraging, enabling, and causing housing discrimination through the company’s advertising platform [alleging] that Facebook unlawfully discriminates based on race, color, national origin, religion, familial status, sex, and disability by restricting who can view housing-related ads on Facebook’s platforms and across the internet. Further, [the Department] claims Facebook mines extensive data about its users and then uses those data to determine which of its users view housing-related ads based, in part, on these protected characteristics.⁵⁰

The more far-reaching Facebook’s obligations of non-discrimination are, the easier it would be to prosecute similar charges of discriminatory advertising within the European Union.

4 Outlook

It remains to be seen how the case will eventually be decided. It is possible that the Düsseldorf Court of Appeal, the next instance in the main proceedings, will again decide in favour of Facebook, only to be overturned by the Federal Supreme Court again. Either court may even request a preliminary ruling under Art. 267 TFEU by the European Court of Justice (ECJ). This might concern questions relating to EU competition law⁵¹ and/or to the GDPR. Guidance in this controversial field would be highly appreciated, as a European answer on how to deal with exploitative abuses conducted by international “tech giants” seems overdue.