Should competition authorities enforce the GDPR?

Taming tech giants with competition law tools proves a laborious exercise that is full of surprises.  The German Supreme Court's Facebook decision this week is another example.  After the competition authority and a higher regional court, this is the third and yet again different approach to assessing whether Facebook's treatment of personal data is an abuse under antitrust rules.  

Put simply, the competition authority had held that Facebook only got away with serious violations of data protection laws because customers had no alternative.  Facebook was found to have leveraged its dominant position to extract consent to use data more widely than justified under the GDPR.  Competition law became an additional sanction mechanism for GDPR violations of dominant tech giants.  

On appeal against the interim measures imposed, the higher court disagreed.  It observed that we consumers all click "accept" very easily to continue using internet services. Whether the provider is dominant makes little difference in this regard.  It saw no link between the dominance and the alleged abuse.

The Supreme Court found a way to reinstate the competition authority's decision, but without accepting the premise that that any infringement of data protection rules by a dominant company is an abuse.  Rather, it puts the emphasis on how facebook bundles data from traffic on its own site with data generated on other internet sites in "super user profiles".  According to the Supreme Court, Facebook should have offered two packages for consumers to chose.  The full version may well build super user profiles to provide the most  targeted advertising and services.  But there should also have been a "Facebook light" option, only using data that consumers generate by using the Facebook platform itself and not drawing on traffic on third party sites.  

There is some logic in how this defines the role of the competition authority.  It is not a super GDPR enforcer but there to protect consumer choice, quite in line with the objectives of antitrust (at least in the German tradition).  

But let's stay tuned:  this third twist will not be the last. The decisions so far are only about the interim measures. The final word on the substance is still to come, first from the Higher Regional Court and then, presumably, again from the Supreme Court.  A preliminary ruling by the ECJ is not out of the question and may well change the approach again.