German ruling on Facebook data collection could finally protect consumers

Net Results: Ruling would give power to users to opt out of invisible mega-harvest of data

Decision by Bundeskartellamt pairs privacy and antitrust legislation. If upheld, it will be far-reaching. Photograph: Epa/Sascha Steinbach

Decision by Bundeskartellamt pairs privacy and antitrust legislation. If upheld, it will be far-reaching. Photograph: Epa/Sascha Steinbach

 

A ruling last week in Germany has the potential to change the parameters of surveillance capitalism by forcing Facebook and many other companies to limit how they gather and share data.

The significance of the decision from the country’s Bundeskartellamt – the federal cartel office that handles antitrust actions – notably pairs privacy and antitrust legislation. If upheld, it will be far-reaching.

The decision would upend the murky business models of not just Facebook but other data-gathering companies large and small which currently rely on exploiting personal data that is gathered in ways consumers cannot fully understand, then stockpiled and used for purposes and profiling that are mostly invisible.

The ruling follows a three-year investigation and states that Facebook abuses a dominant market position by requiring users to consent to having their data shared across other widely-used apps, Instagram and WhatsApp, which are also owned by the company, and even to being tracked when they leave Facebook and visit other websites.

 The Bundeskartellamt noted that visitors to third-party websites are tracked if they simply visit any website that contains a Facebook “like” button. Visitors are tracked regardless of whether or not they clicked the “like” button.

 “Above all, we see the collection of data outside the Facebook social network and its inclusion in the Facebook account as problematic,” Andreas Mundt, president of the Bundeskartellamt noted last December.

In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data

 For years, Germany has consistently been the toughest country in Europe in terms of regulating data collection and privacy. So, in many ways, it isn’t surprising that it has taken a groundbreaking position here.

 But this decision is far more than an attempt to restrain Facebook’s data collection activities.

 If allowed to stand, the ruling lays the ground for possible European antitrust action against Facebook (or other mega-data collectors such as Google). It’s right there in the title: cartel office. For the first time, a regulatory body is making an explicit business and antitrust link to privacy violations.

Non-Facebook data

“In future, Facebook will no longer be allowed to force its users to agree to the practically unrestricted collection and assigning of non-Facebook data to their Facebook user accounts,” Mundt said in a statement.

 “The combination of data sources substantially contributed to the fact that Facebook was able to build a unique database for each individual user and thus to gain market power.”

 In other words, because Facebook gathers data in this indiscriminate and mandatory way, without any opt-out for users, it both exploits and further consolidates a dominant market position.

 The ruling says the company cannot track people across other websites, and cannot gather and share data across its Instagram and WhatsApp apps, without first gaining explicit opt-in permission from users.

 This is a dramatic interpretation that, trust me, will be keeping corporate lawyers up at night right now (as well as the board of directors, if they are paying attention).

 While there will of course be a certain number of people willing to share their data, especially within Facebook’s own properties, people are surely far less likely to opt in to having their actions tracked on sites that have nothing to do with Facebook, other than serving as a data-gathering opportunity for the company.

 This is important. Facebook (and pretty much every data gathering company) relies on users not having any such options and not fully understanding what data is sucked in and how it is marketed and monetised). Facebook knows full well that if forced to disclose, up front, the sweeping scope of its data gathering and user tracking, currently hidden behind vague user agreements and relationships with third parties, most users will simply say no.

 The key thing here is that Facebook cannot then just withdraw services. If it wishes to offer Facebook as it currently exists, it must allow users to opt out of this invisible mega-harvest of data, but still offer the same service. Mundt’s office is saying that Facebook cannot avoid the consent element here, which it argues is intrinsic to the EU’s General Data Protection Regulation (GDPR).

 I see two intriguing, relevant points here. First, if Facebook challenges this ruling, it must ultimately end up with the European Court of Justice. While some observers (and Facebook) argue that privacy and antitrust (ie, business) determinations should be kept separate, and that an antitrust office cannot rule on privacy issues, it’s worth recalling that the ECJ initially had a role as the top EU court for business rulings, yet in recent years has taken on far-reaching data protection and privacy cases, ruling with significant bite.

The ECJ surely is the global court most likely to understand the interrelatedness between mass data gathering and market domination.

 Second, if this decision is upheld as a violation of GDPR, it would have dramatic, European-wide effect not just on Facebook, but many other companies.

 And, if Europeans get the right to opt out of these particular surveillance capitalism techniques, users everywhere will want the same option.

Definitely, a case to watch.

The Irish Times Logo
Commenting on The Irish Times has changed. To comment you must now be an Irish Times subscriber.
SUBSCRIBE
GO BACK
Error Image
The account details entered are not currently associated with an Irish Times subscription. Please subscribe to sign in to comment.
Comment Sign In

Forgot password?
The Irish Times Logo
Thank you
You should receive instructions for resetting your password. When you have reset your password, you can Sign In.
The Irish Times Logo
Please choose a screen name. This name will appear beside any comments you post. Your screen name should follow the standards set out in our community standards.
Screen Name Selection

Hello

Please choose a screen name. This name will appear beside any comments you post. Your screen name should follow the standards set out in our community standards.

The Irish Times Logo
Commenting on The Irish Times has changed. To comment you must now be an Irish Times subscriber.
SUBSCRIBE
Forgot Password
Please enter your email address so we can send you a link to reset your password.

Sign In

Your Comments
We reserve the right to remove any content at any time from this Community, including without limitation if it violates the Community Standards. We ask that you report content that you in good faith believe violates the above rules by clicking the Flag link next to the offending comment or by filling out this form. New comments are only accepted for 3 days from the date of publication.