Lore Leitner of Pinsent Masons, the law firm behind Out-Law.com, said that data protection authorities (DPAs) in the EU are becoming increasingly frustrated with limitations to their ability to control Google's power in collecting and using personal data.
She said, however, that the new preliminary opinion issued by the European Data Protection Supervisor (EDPS) has highlighted the potential for EU scrutiny of Google's activities to shift from an assessment of whether the company is compliant with EU data protection laws to whether the way Google gathers and uses personal data gives the company advantages in a way that is in line with competition rules.
In his opinion, EDPS Peter Hustinx said that an investigation into the "costs and benefits" associated with the way companies often provide free services to consumers in exchange for the right to gather and use their personal data is "overdue". He called for DPAs and competition regulators to work closer together so as to help "stimulate the market for privacy-enhancing services".
"Firms operating in the digital economy do not yet consider privacy as opportunity for competitive advantage," Hustinx said in the new opinion. "On the contrary, there is the danger of a ‘race to the bottom’ of privacy protection, where failure to comply with data protection rules and the acquisition of data through anti-competitive means may have become symptomatic of market power, with externality costs borne by users."
"A useful comparison may be drawn with the spread in the 1960s and 1970s of the notion of corporate social and environmental responsibility. Companies began to realise the importance of the socio-economic impact of their business and how it was perceived by their customers. They now typically benchmark their own policies against those of competitors, and there is a genuine market for product safety and green technologies. A more joined-up approach to data protection and competition could help stimulate a similar level of competition in online services," he said.
"As the Working Party previously stated, Google plays a key role in the online world. The company is years ahead of its competitors, but data protection rules do not allow DPAs to impose specific rules just because a data controller holds a dominant market position," she added.
Competition law specialist Sammy Kalmanowicz of Pinsent Masons said competition issues around how the use of personal data is controlled has been discussed previously at EU level, including when the European Commission assessed Google's takeover of advertising business DoubleClick in 2008.
However, Kalmanowicz said he expects competition authorities to pay closer attention to competition issues as the need to analyse big data becomes a more prominent part of doing business. He said competition law could be engaged in a variety of ways.
"Regulators are likely to become increasingly interested in the way companies with significant market power use personal data and will be on the look out for activities that could be said to constitute an abuse of market dominance and thus a breach of competition rules," Kalmanowicz said.
"In particular, the imposition of restrictions on rivals gaining access to consumers' personal data is likely to be scrutinised closely as the data becomes an ever more important currency in providing better targeted services. Interoperability with competitors' platforms and giving consumers the right to transfer their data to rival services will become more important for major businesses as a result," he said.
An abuse of dominance can occur when a dominant company refuses to supply or provide access to an essential facility. The expert said that businesses' mere collection and processing of personal data may be scrutinised by competition authorities more closely in future "because big data may be considered an asset giving significant advantages".
Kalmanowicz also said that competition authorities may also review how companies involved in potential merger deals can exploit the amalgamated personal data records and whether the advantages that can be accrued by the merged entity could raise barriers to entry in certain markets, including advertisement, technology and innovation markets.
"Information is power as services can be tailored better to consumers from analysing their personal data," Kalmanowicz said. "Proposed merger deals may be affected if they lead to a concentration of a great volume of personal data or tools for analysing such information so that the merged company has significant consumer insights. In such circumstances competition authorities may, for example, require the data to be made available to rival companies if it is felt that such access is indispensible to ensure effective competition and innovation."
Competition rules governing the use of big data are also relevant to companies which are not dominant in a market and which do not envisage a merger. Kalmanowicz said that organisations active in the big data business must be aware that antitrust rules prohibit them from sharing, or facilitating the sharing, of commercially sensitive information amongst competitors, such as pricing and strategic data.
"Companies which collect and sell big data should be aware that they need to look at the nature and quality of the data they are proposing to share before sharing it because the provision of commercially sensitive data to rivals, or through third party intermediaries, may constitute an anti-competitive practice prohibited under EU competition rules," Kalmanowicz said. "Such risks are mitigated if the data shared is sufficiently aggregated, historic and anonymous."