On 26 November, Joaquín Almunia, Vice President of the European Commission responsible for Competition Policy, delivered a speech highlighting the potential application of competition law to companies' personal data.
The issue has not been fully explored by the EU Commission's Competition authorities as of yet, but in principle, and in particular as the value of personal data continues its inexorable rise, competition law is relevant.
Personal data is increasingly a core asset for many companies; those with access to more and better quality personal data can have a real competitive advantage over their rivals.
The natural consequence of personal data being a source of competitive advantage is that it could also be used in a competitively abusive manner.
As Mr Almunia took the trouble to point out, it is not impossible for personal data in particular markets to become heavily concentrated in the hands of a few, dominant companies. Any abuse of this dominant position which might affect competition, for example, a failure to honour an individual's privacy rights in full thereby restricting access to personal data, could trigger competition investigation.
How likely are competition issues to apply in practice?
This question is very difficult to answer precisely.
The EU has looked at some of the issues in passing, for example, when Google bought DoubleClick (an online ad retargeting business) in 2008. In reviewing and ultimately approving the merger, the EU considered that it did not cause competition issues, but emphasised the need for the merged entity to comply with existing privacy laws. In particular, the EU separated the search and ad serving markets, and felt the merger would not enhance Google's dominance in either.
In Mr Almunia's own words: "The effect of the increase in the amount of personal information obtained by the merger entity was considered. The investigation found that the combination of information on search behaviour and web-browsing behaviour would not give a competitive advantage in the advertisement business that could not be replicated by other players that have access to similar web-usage data."
For those casual observers who are vaguely familiar with the ad retargeting business, Google's dominance in search, and Google's recent censure for its privacy compliance in particular over the convergence of its data resources, this decision may appear slightly surprising in hindsight.
Suffice it to say here that (as Mr Almunia implied) against such a backdrop the application of competition law to personal data certainly cannot be ruled out.
Does the draft EU General Data Protection Regulation affect the position?
The draft EU General Data Protection Regulation is partially designed to mitigate risk of abuses. It gives an individual the right to take their data away from one organisation in its entirity, in electronic format, and give it to another organisation (the so-called "right of portability").
This right would obviously limit the extent to which personal data can be used as source of competitive advantage.
Nonetheless, if the new EU General Data Protection Regulation becomes law in its present format, and personal data-derived competition issues arise (e.g. because the right of portability is not honoured by a dominant company) a culpable organisation would be staring down the barrel from a regulatory point of view. The new Data Protection Regulation doesn't fall too far behind the EU's competition regime in the sanctions that can be levied (up to 2% of global turnover as against 5%, respectively). It remains to be seen how the 2 regimes might work in tandem, but the headline figures speak for themselves.
Where does this speech leave us? Why raise competition law as an issue now?
In substance. nothing has changed. No new case has been brought, and the underlying competition and privacy laws remain the same.
If viewed alongside the OFT's recent call for information on behavioural data though, this speech gives yet more weight to the growing picture of regulatory convergence on privacy issues.
Reading between the lines a little, the EU also appears to be playing a shrewd political game here. The speech gives robust support to elements of the current draft EU General Data Protection Regulation, which has come under increasing attack for being too cumbersome and costly to implement.
Perhaps most significantly, to quote in Mr Almunia one last time, "Privacy – and the many delicate issues associated with it – is becoming one of the central debates of our time." For most organisations, but especially those used to the current, relatively benign UK privacy regime, this presents a growing challenge.This information is intended as a general discussion surrounding the topics covered and is for guidance purposes only. It does not constitute legal advice and should not be regarded as a substitute for taking legal advice. DWF is not responsible for any activity undertaken based on this information.