When should EU merger assessment address privacy? The conditions for addressing privacy issues under the EU merger control regulation

ABSTRACTThe advent of digital companies has brought benefits to society. Nevertheless, the digital era poses significant risks to consumers’ privacy. The combination, through mergers, of enormous datasets could raise further privacy concerns. It has been much discussed whether and how consumer privacy concerns should be introduced within merger assessment. This paper approaches this issue from another perspective and reflects upon the circumstances under which the EU Merger Control Regulation (EUMR) has a role to address privacy issues. Accordingly, this paper clarifies the conditions that must be satisfied in order for privacy issues to fall within the EUMR’s ambit. First, privacy should be a parameter of competition on the market and second, there must be a causal link between the merger and privacy deterioration. Following this, the paper turns to critically analyse the Commission’s treatment of privacy issues in objectively selected mergers involving some of the most powerful digital companies.KEYWORDS: EU merger controlprivacydata protectioncausal linkdigital marketsGAMAM AcknowledgementsI would like to express my deepest gratitude to Professor Michael Harker and Dr Elias Deutscher for their invaluable and insightful comments and suggestions on previous versions of this paper.Disclosure statementNo potential conflict of interest was reported by the author(s).Notes1 Campbell v MGN Ltd [2004] UKHL 22 [12].2 Charter of Fundamental Rights of the European Union [2000] OJ 364/3 of 18 December 2000, Articles 7&8.3 Juliane Kokott and Christoph Sobotta, ‘The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECHR’ [2013] International Data Privacy Law 222, 223.4 Autorité de la Concurrence & Bundeskartellamt, ‘Competition Law and Data’ [2016]. at page 5.5 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1 (GDPR).6 Andrew Murray, Information Technology Law (3rd edn, OUP 2016) 5–11 & 51–54.7 Helen Nissenbaum, Privacy in Context: Technology, Policy and the Integrity of Social Life (Stanford University Press 2010) 19.8 CMA, ‘The commercial use of consumer data’ Report on the CMA’s call for information CMA38 June 2015. at page 5; Paul Bernal, Internet Privacy Rights: Rights to Protect Autonomy (1st edn, Cambridge University Press 2014) 55.9 CMA, ‘The commercial use of consumer data’ (n 8) para 3.56; OECD, ‘Data-Driven Innovation for Growth and Well-being: Interim Synthesis Report’ [2014]. at page 7.10 Federal Trade Commission, ‘Non-HSR Reported Acquisitions by Select Technology Platforms 2012–2019: An FTC Study’ [2021]. at pages 1&3.11 See, e.g. argument in Google/Fitbit (Case COMP/M.9660) Commission Decision C(2020) 9105 final, para 452.12 Google/DoubleClick, FTC File No. 071-0170, Dissenting Statement of Commissioner Pamela Jones Harbour (2007). at page 11.13 See, e.g. Maurice E Stucke and Allen P Grunes, Big Data and Competition Policy (1st edn, OUP 2016) 61.14 CMA, ‘Online platforms and digital advertising’ Market study final report July 2020. at page 70.15 European Data Protection Supervisor, ‘Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy’ Preliminary Opinion of the European Data Protection Supervisor (March 2014). page 11.16 Aline Blankertz, ‘How competition impacts data privacy’ [2020] Stiftung Neue Verantwortung [September 2020]. at page 32.17 OECD, ‘Non Price Effects of Mergers-Note by Orla Lynskey’ [2018] DAF/COMP/WD(2018)70. at page 3.18 Maurice E Stucke and Allen P Grunes, ‘Debunking the Myths Over Big Data and Antitrust’ [2015] CPI Antitrust Chronicle University of Tennessee Legal Studies Research Paper No. 276. at page 5.19 Council Regulation (EC) No 139/2004 of 20 January 2004 on the control of concentrations between undertakings [2004] OJ L 24/1 (EUMR).20 See, e.g. European Data Protection Supervisor, ‘Privacy and competitiveness in the age of big data’ (n 15) 26.21 See, e.g. Stucke and Grunes, Big Data and Competition Policy (n 13) 260.22 See, e.g. James C Cooper, ‘Antitrust and Privacy’ The Global Antitrust Institute Report on the Digital Economy [2020]. at pages 1188, 1222.23 Case C-328/05 Asnef-Equifax v Asociación de Usuarios Servicios Bancarios (Ausbanc) [2006] ECR I-11125, para 63.24 Google/DoubleClick (Case COMP/M.4731) Commission Decision C(2008) 927 final, para 368.25 Facebook/WhatsApp (Case COMP/M.7217) Commission Decision C(2014) 7239 final, para 87.26 Eleonora Ocello, Cristina Sjödin and Anatoly Subocˇs, ‘What's Up with Merger Control in the Digital Sector? Lessons from the Facebook/WhatsApp EU merger case’ [2015] Competition Merger Brief Issue 1/2015 Article 1. at page 7.27 ibid 6.28 Microsoft/LinkedIn (Case COMP/M.8124) Commission Decision C(2016) 8404 final, para 350.29 GDPR, article 1(1).30 Directive 2002/58/EC DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) [2002] L 201/37 (E-Privacy Directive).31 E-Privacy Directive, article 1(1).32 E-Privacy Directive, article 5(3).33 GDPR, article 4(1).34 GDPR, article 5.35 GDPR, articles 51(1)–(2).36 EUMR (n 19), para 5.37 Guidelines on the assessment of non-horizontal mergers under the Council Regulation on the control of concentrations between undertakings [2008] OJ C 265/6 para 10; Guidelines on the assessment of horizontal mergers under the Council Regulation on the control of concentrations between undertakings [2004] OJ C 31/5 para 8.38 Case C-12/03 P Commission v Tetra Laval ECLI:EU:C:2005:87 paras 42–43.39 Google/Fitbit (n 11) paras 411–412.40 ibid.41 Google/Fitbit (n 11) para 411.42 Meta (Formerly Facebook)/Kustomer (Case M.10262) Commission Decision C(2022) 409 final, paras 526–528.43 Microsoft/LinkedIn (n 28) para 176.44 ibid para 178.45 ibid para 177.46 Apple/Shazam (Case COMP/M.8788) Commission Decision C(2018) 5748 final, para 200.47 ibid paras 225&226.48 ibid para 231.49 ibid para 238.50 Case C-252/21 Meta Platforms and Others (General terms of use of a social network [2023] ECLI:EU:C:2023:537.51 ibid, para 48.52 ibid, para 49.53 Microsoft/LinkedIn (n 28) para 350.54 See, e.g. European Data Protection Supervisor, ‘Privacy and competitiveness in the age of big data’ (n 15) 26.55 See, e.g. Stucke and Grunes, Big Data and Competition Policy (n 13) 260.56 Cooper (n 22) 1188, 1192.57 ibid 1193.58 CMA, Merger Assessment Guidelines [2021] CMA129, para 2.5.59 Guidelines on the assessment of horizontal mergers (n 37) para 8; Guidelines on the Assessment of Non-Horizontal Mergers (n 37) para 10.60 ibid.61 OECD, ‘The Role and Measurement of Quality in Competition Analysis’ [2013] Policy Roundtables DAF/COMP(2013)17. at page 79.62 Microsoft Yahoo!/Search Business (Case COMP/M.5727) Commission Decision C(2010)1077, para 101; Microsoft/Skype (Case Comp/M.6281) Commission Decision C(2011)7279, para 8163 Patricia A Norberg, Daniel R Horne and David A Horne, ‘The Privacy Paradox: Personal Information Disclosure Intentions versus Behaviors’ [2007] The Journal of Consumer Affairs 100, 100–101.64 See, e.g. Alessandro Acquisti and Jens Grossklags, ‘Privacy and Rationality in Individual Decision Making’ [2005] IEEE Security and Privacy 24, 26&28.65 See, e.g. Pinar Akman, ‘A Web of Paradoxes: Empirical Evidence on Online Platform Users and Implications for Competition and Regulation in Digital Markets’ [2022] Virginia Law & Business Review 217, 269–270.66 CMA, ‘Online platforms and digital advertising’ (n 14) page 117.67 Joseph Farrell, ‘Can Privacy be Just Another Good’ [2012] J.ON TELECOMM & HIGH TECH L 251,259.68 CMA, ‘The commercial use of consumer data’ (n 8) para 4.41.69 ibid para 4.142.70 Akman (n 65) 268.71 OECD, ‘Considering non-price effects in merger control – Background note by the Secretariat’ [2018] DAF/COMP(2018)2. at page 31.72 OECD, ‘Non Price Effects of Mergers-Note by Orla Lynskey’(n 17) 8.73 EU Commission, ‘Factsheet on Merger Control Procedures’ [2013]. at page 2.74 ibid.75 Microsoft/LinkedIn (n 28) footnote 330 to para 350.76 ibid.77 ibid para 350.78 ibid.79 ibid.80 See generally OECD, ‘Emerging Privacy Enhancing Technologies’ (OECD Publishing Paris, 2023). page 15.81 Cases C-68/94 and C-30/95 France and Others v Commission EU:C:1998:148 paras 109–124.82 Guidelines on the assessment of horizontal mergers (n 37) para 2.83 Guidelines on the Assessment of Non-Horizontal Mergers (n 37) para 21;Commission v Tetra Laval (n 38) para 43.84 Case C-413/06 P Bertelsmann and Sony Corporation of America v Impala (Impala II), ECLI:EU:C:2008:392 paras 46&48&51.85 Case T-79/12 Cisco Systems and Messagenet v Commission, ECLI:EU:T:2013:635 para 46.86 C-376/20 P Commission v CK Telecoms UK Investments ECLI:EU:C:2023:561 para 88.87 ibid para 87.88 ibid para 76.89 France and Others v Commission (n 81) paras 109–124.90 Guidelines on the assessment of horizontal mergers (n 37) footnote 110.91 ibid para 9.92 ibid.93 Damien Geradin and Ianis Girgenson, ‘The Counterfactual Analysis in EU Merger Control (2013) accessed 15 July 2023 at page 2; Guidelines on the assessment of horizontal mergers (n 37) para 9.94 Guidelines on the assessment of horizontal mergers (n 37) para 9.95 Geradin and Girgenson (n 93) 6.96 Guidelines on the assessment of horizontal mergers (n 37) para 9.97 ibid.98 ibid para 89; France and Others v Commission (n 81) para 110.99 Guidelines on the assessment of horizontal mergers (n 37) para 89.100 France and Others v Commission (n 81) para 115.101 BASF/Pantochim/Eurodiol (Comp/M.2314) Commission Decision of 11/07/2001, paras 142&143.102 Guidelines on the assessment of horizontal mergers (n 37) para 90.103 Microsoft/Yahoo!Search Business (n 62) paras 131–159.104 Microsoft Yahoo!/Search Business (n 62) para 101; Microsoft/Skype (n 62) para 81.105 European Data Protection Supervisor, ‘EDPS Opinion on coherent enforcement of fundamental rights in the age of big data’ (Opinion 8/2016). page 6.106 European Data Protection Supervisor, ‘Privacy and competitiveness in the age of big data’ (n 15) 10.107 Completed merger on the acquisition of Footasylum plc by JD Sports Fashion plc: Final report (6 May 2020). .108 ibid paras 8.95, 8.98, 8.108–8.115&8.200–8.204.109 ibid.110 JD Sports Fashion PLC v Competition and Markets Authority [2020] CAT 24.111 ibid [77]&[89].112 ibid [99].113 ibid.114 Facebook/WhatsApp (n 25) para 87.115 ibid para 87.116 ibid para 169.117 ibid paras 102&106.118 ibid para 132.119 Stucke and Grunes, Big Data and Competition Policy (n 13) 75&133.120 Microsoft/LinkedIn (n 28) para 301.121 ibid para 338&343.122 ibid para 346.123 ibid para 350.124 ibid.125 Google/Fitbit (n 11) para 452.126 ibid.127 Google/Fitbit (n 11) footnote 300 of para 452.128 See, e.g. Stucke and Grunes, Big Data and Competition Policy (n 13) 61.129 France and Others v Commission (n 81) paras 109–124.