[Access official publication on EDPB website]
Promoting cooperation between personal data protection and competition authorities can be useful to protect individuals and increase their choice. In fact, as companies’ business models evolve, personal data and the rules applicable to its processing are becoming increasingly central. It is therefore essential to consider ways of promoting coherence among separate but interacting areas of regulation, bearing in mind the risks from their incoherent application at individual and societal levels.
This will require a better understanding of the relationship between concepts used in data protection and competition law, so as to strengthen the ability of data protection authorities of taking into account the economic context, and the ability of competition authorities of incorporating potentially relevant data protection considerations in their assessments and decisions.
The European Data Protection Board has adopted the following position paper:
For data protection regulators, recent changes in the legal landscape raise numerous issues at the intersection of data protection and competition law. It is clear from the decision in Meta v Bundeskartellamt that data protection and competition regulatory objectives cannot always be pursued in isolation. Instead, regulators may need to cooperate and coordinate in order to explore synergies and to engage in coherent, effective and complementary enforcement activities. Such cooperation can benefit individuals, corporations and other entities: it enables different regulators to protect individuals in the EU in the most effective and efficient manner and ensures a consistent interpretation and application of legal norms.
While the GDPR and competition law may apply to the same actors and activities, they are clearly distinct areas of law, based on different legal concepts and objectives and with their own enforcement framework. While data protection law aims at guaranteeing data subjects’ fundamental right to the protection of their personal data, in particular against unlawful, unfair and opaque processing of their personal data, competition law aims “to protect the efficient functioning of markets”. Hence, analysis is needed to assess situations where the interplay between data protection and competition arises.
With this position paper, the EDPB provides a short analysis of this interplay and give recommendations for further development of existing cooperation between regulators.
EU data protection law and competition law are clearly distinct legal frameworks and fields of law that pursue different objectives. However, they have a number of potential commonalities, such as the protection of individuals and their choices. Indeed, while data protection policy aims to protect individuals from any unlawful or unfair processing of their personal data, competition policy aims to guarantee the conditions for free and undistorted competition between companies on the relevant markets in the interests of consumers, by promoting innovation, diversity of supply and attractive prices. This aim of protecting individuals in their role as consumers under competition law is expressed in the prohibition of cartels, abuse of dominant positions and countering anticompetitive mergers, which without intervention may lead to harm to consumers, in the form of higher prices, less choice or lower quality and innovation.
Strengthening the link between the protection of personal data and competition can contribute to the protection of individuals and the well-being of consumers by reinforcing the common consideration of respect for their fundamental rights and the proper functioning of competitive markets.
It would therefore seem beneficial to strengthen cooperation between data protection and competition authorities especially in those cases where there is a clear intersection between the application of competition law and the application of data protection rules. This would assist in identifying and tackling upstream the tensions that could arise in certain situations between both fields of law. In this way, increased cooperation between authorities could make it possible to improve consistency and effectiveness in their respective actions, to the benefit of both individuals and entities that must comply with the legal requirements of both fields.
The digital economy has put personal data at the heart of many business models. As a result, data protection has become in some cases an important parameter of competition. At the same time, EU data protection law aims to prevent unlawful and unfair processing of personal data, including in the case of power imbalances between data controllers and the individual whose personal data is collected.
In its new Notice on the definition of the relevant market, the Commission recognises that when defining the relevant market, the protection of privacy and personal data offered to consumers may be one of the parameters of competition to be considered. In other words, privacy is considered to be one of the parameters especially “in the assessment of digital and tech mergers”.
A competitive market can be a decisive facilitating factor in creating circumstances for privacy friendly options. In other words, if the consumer has different options in the market, this can encourage the minimisation of the amount of personal data collected or avoid massive combinations and uses of personal data from different sources that are harmful to users. The reverse is also possible. This is the case with exclusionary strategies, which limit the number of players on the market, and can thus artificially affect the number of privacy-friendly solutions. Lack of commercial alternatives can lead users to opt for less privacy-protective products.
In the digital sector the behaviour of companies in a dominant position may raise questions about the role of personal data processing in strengthening and exploiting this position. Data-driven advantages from the combination and the cross-use of personal data from different sources by ‘gatekeepers’ in digital markets and the risks such advantages pose to the fairness and contestability of such markets are highlighted by the prohibitions in Article 5(2) of the DMA.