Is a national competition authority allowed to establish a breach of data protection law and take measures against it? With the landmark decision of 4 July 2023 (Judgment of 4 July 2023, C‑252/21), the European Court of Justice (ECJ) clarifies the relationship between antitrust law and data protection law.
Result and relevance for companies
In its decision, the ECJ concludes that a national competition authority may find that there has been a breach of the of the General Data Protection Regulation (GDPR) in the context of the assessment of whether a dominant position is being abused. However, the competence to examine this issue is limited to the question of whether the data protection breach relates to the prohibition of abuse under antitrust law stipulated by § 19 (1) of the German Competition Act (GWB). In plain language, this means for companies with a dominant market position that they must also fear intervention by the competition authorities in the event of data protection breaches. At the same time, these companies must also be prepared for the fact that data protection aspects will increasingly be included in general audits by the antitrust authorities. However, the ECJ also clarifies that the data protection supervisory authorities and the competition authorities continue to perform different functions and tasks. The competition authorities are therefore required to consult and cooperate with the data protection supervisory authorities. They are not permitted to depart from decisions made by the data protection supervisory authorities.
Compliance with data protection law has already played a role in several proceedings before the EU Directorate General for Competition and the German Federal Cartel Office. Now that the ECJ has confirmed the previous practice of the authorities, data protection aspects will find their way into antitrust proceedings on a permanent basis. Companies with a dominant market position must therefore expect compliance with data protection requirements to remain in the focus of the antitrust authorities. Both the Digital Markets Act and the Digital Services Act are likely to reinforce this trend in the future. Meanwhile, the legal dispute between Meta and the German Federal Cartel Office will for the moment go back to the Düsseldorf Higher Regional Court (OLG Düsseldorf).back