Is a national competition authority allowed to establish a breach of data protection law and take measures against it? With the landmark decision of 4 July 2023 (Judgment of 4 July 2023, C‑252/21), the European Court of Justice (ECJ) clarifies the relationship between antitrust law and data protection law.
Background
The social network Facebook, operated by Meta, finances itself through online advertising. For this purpose, Facebook also creates user profiles using data collected outside the social network. Users agree to this practice by confirming the terms of use. The German Federal Cartel Office objected to this practice and based its decision on the assumption that Facebook is dominant in the market within the meaning of § 19 of the German Competition Act (GWB) and that a breach of the General Data Protection Regulation is sufficient to suppose abusive conduct. Meta appealed against this to the Düsseldorf Higher Regional Court (OLG Düsseldorf), which referred several questions to the ECJ for a preliminary ruling. The core question was whether national competition authorities can establish and punish breaches of the GDPR.
Result and relevance for companies
In its decision, the ECJ concludes that a national competition authority may find that there has been a breach of the of the General Data Protection Regulation (GDPR) in the context of the assessment of whether a dominant position is being abused. However, the competence to examine this issue is limited to the question of whether the data protection breach relates to the prohibition of abuse under antitrust law stipulated by § 19 (1) of the German Competition Act (GWB). In plain language, this means for companies with a dominant market position that they must also fear intervention by the competition authorities in the event of data protection breaches. At the same time, these companies must also be prepared for the fact that data protection aspects will increasingly be included in general audits by the antitrust authorities. However, the ECJ also clarifies that the data protection supervisory authorities and the competition authorities continue to perform different functions and tasks. The competition authorities are therefore required to consult and cooperate with the data protection supervisory authorities. They are not permitted to depart from decisions made by the data protection supervisory authorities.
Outlook
Compliance with data protection law has already played a role in several proceedings before the EU Directorate General for Competition and the German Federal Cartel Office. Now that the ECJ has confirmed the previous practice of the authorities, data protection aspects will find their way into antitrust proceedings on a permanent basis. Companies with a dominant market position must therefore expect compliance with data protection requirements to remain in the focus of the antitrust authorities. Both the Digital Markets Act and the Digital Services Act are likely to reinforce this trend in the future. Meanwhile, the legal dispute between Meta and the German Federal Cartel Office will for the moment go back to the Düsseldorf Higher Regional Court (OLG Düsseldorf).
back