Out-Law News 4 min. read

Opinion on big data, privacy and competition may be latest marker in closer scrutiny of Google, says expert

A new opinion issued by an EU watchdog on 'big data', privacy and competition issues can be read as a "shot across the bows" of Google and other large technology players, an information law specialist has said.

Lore Leitner of Pinsent Masons, the law firm behind Out-Law.com, said that data protection authorities (DPAs) in the EU are becoming increasingly frustrated with limitations to their ability to control Google's power in collecting and using personal data.

She said, however, that the new preliminary opinion issued by the European Data Protection Supervisor (EDPS) has highlighted the potential for EU scrutiny of Google's activities to shift from an assessment of whether the company is compliant with EU data protection laws to whether the way Google gathers and uses personal data gives the company advantages in a way that is in line with competition rules.

In his opinion, EDPS Peter Hustinx said that an investigation into the "costs and benefits" associated with the way companies often provide free services to consumers in exchange for the right to gather and use their personal data is "overdue". He called for DPAs and competition regulators to work closer together so as to help "stimulate the market for privacy-enhancing services".

"Firms operating in the digital economy do not yet consider privacy as opportunity for competitive advantage," Hustinx said in the new opinion. "On the contrary, there is the danger of a ‘race to the bottom’ of privacy protection, where failure to comply with data protection rules and the acquisition of data through anti-competitive means may have become symptomatic of market power, with externality costs borne by users."

"A useful comparison may be drawn with the spread in the 1960s and 1970s of the notion of corporate social and environmental responsibility. Companies began to realise the importance of the socio-economic impact of their business and how it was perceived by their customers. They now typically benchmark their own policies against those of competitors, and there is a genuine market for product safety and green technologies. A more joined-up approach to data protection and competition could help stimulate a similar level of competition in online services," he said.

Google is currently the subject of a number of separate investigations by DPAs across the EU into whether its privacy policy is sufficiently clear in explaining to users of its services how it accumulates data about them from across those services, what kind of data is collected and the purposes for which the data is used.

"It is not surprising to see the EDPS' opinion on privacy and competition in the age of big data (41-page / 915KB PDF) if you consider recent developments in the various cases brought by DPAs against Google over its privacy policy," Leitner said. "The current Data Protection Directive does not give the DPAs the ammunition they need to counter big organisations like Google that monetise masses of information they collect through their services. The Directive simply wasn’t drafted with the current state of technology and use of data in mind."

"That said, it is my own view that Google's privacy policy is clear and seems sufficiently compliant with the Directive," Leitner said. "The Article 29 Working Party previously concluded that Google's privacy policy allows the company 'to combine almost any data from any services for any purposes' and Google has subsequently been told to change the policy. Google has refused, stating that there is nothing in the Directive to stop them from combining data across various services. The DPAs in France and the Netherlands have both argued that doing so doesn’t meet the requirements of transparency and purpose limitation, but Google has disputed this interpretation, and rightly so."

"As the Working Party previously stated, Google plays a key role in the online world. The company is years ahead of its competitors, but data protection rules do not allow DPAs to impose specific rules just because a data controller holds a dominant market position," she added.

Competition law specialist Sammy Kalmanowicz of Pinsent Masons said competition issues around how the use of personal data is controlled has been discussed previously at EU level, including when the European Commission assessed Google's takeover of advertising business DoubleClick in 2008.

However, Kalmanowicz said he expects competition authorities to pay closer attention to competition issues as the need to analyse big data becomes a more prominent part of doing business. He said competition law could be engaged in a variety of ways.

"Regulators are likely to become increasingly interested in the way companies with significant market power use personal data and will be on the look out for activities that could be said to constitute an abuse of market dominance and thus a breach of competition rules," Kalmanowicz said.

"In particular, the imposition of restrictions on rivals gaining access to consumers' personal data is likely to be scrutinised closely as the data becomes an ever more important currency in providing better targeted services. Interoperability with competitors' platforms and giving consumers the right to transfer their data to rival services will become more important for major businesses as a result," he said.

An abuse of dominance can occur when a dominant company refuses to supply or provide access to an essential facility. The expert said that businesses' mere collection and processing of personal data may be scrutinised by competition authorities more closely in future "because big data may be considered an asset giving significant advantages".

Kalmanowicz also said that competition authorities may also review how companies involved in potential merger deals can exploit the amalgamated personal data records and whether the advantages that can be accrued by the merged entity could raise barriers to entry in certain markets, including advertisement, technology and innovation markets.

"Information is power as services can be tailored better to consumers from analysing their personal data," Kalmanowicz said. "Proposed merger deals may be affected if they lead to a concentration of a great volume of personal data or tools for analysing such information so that the merged company has significant consumer insights. In such circumstances competition authorities may, for example, require the data to be made available to rival companies if it is felt that such access is indispensible to ensure effective competition and innovation."

Competition rules governing the use of big data are also relevant to companies which are not dominant in a market and which do not envisage a merger. Kalmanowicz said that organisations active in the big data business must be aware that antitrust rules prohibit them from sharing, or facilitating the sharing, of commercially sensitive information amongst competitors, such as pricing and strategic data.

"Companies which collect and sell big data should be aware that they need to look at the nature and quality of the data they are proposing to share before sharing it because the provision of commercially sensitive data to rivals, or through third party intermediaries, may constitute an anti-competitive practice prohibited under EU competition rules," Kalmanowicz said. "Such risks are mitigated if the data shared is sufficiently aggregated, historic and anonymous."

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.