I. Introduction

In February 2019, after three years of investigation, the Federal Cartel Office in Germany (hereinafter Bundeskartellamt), prohibited Facebook from assigning data from internal and external services to each user's account,^[1] on the grounds that such processing was contrary to the GDPR.^[2] The terms of use and privacy notices were considered insufficient to obtain users' consent as they condition the use of the social media service on the integration of user data collected by other internal services such as WhatsApp and Instagram, as well as data collected by publishers or external advertisers. The combination of data remains possible only with the user's consent.

The Düsseldorf Higher Regional Court (hereinafter also OLG Düsseldorf) ordered the suspensive effect in August 2019.^[3] Corrective measures ordered by the Bundeskartellamt are thus suspended pending the judgment on the merits or until the suspensive effect is lifted by the Federal Court of Justice (hereinafter BGH).^[4] In essence, the Düsseldorf Higher Regional Court concludes that the Facebook decision violates the law and that its annulment is very likely. The Court's summary examination is based on the premise that a dominant position exists. Also, it does not rule on the GDPR infringement, which will be the subject of a full assessment on the merits. The Düsseldorf Higher Regional Court rejects the automatic finding of an abuse of a dominant position on the grounds of non-compliance with the GDPR: the specific conditions of Article 19 of the German Act against Restraints of Competition (hereinafter «GWB» or «Gesetz gegen Wettbewerbsbeschränkungen») must be met to establish a competition law violation. In the opinion of the Düsseldorf Higher Regional Court, the data processing in question does not constitute an abuse of a dominant position, neither in the form of exploitation of users, nor in the form of exclusion of competitors.^[5] The Court further points out that the decision fails to demonstrate a causal link between Facebook's dominant position and the abuse, a condition necessary to find a violation of Article 19 GWB. Finally, it denies, in light of the facts presented in the Facebook decision, any situation of dependence of users on the social network that would invalidate the acceptance of the general conditions of use.

The Facebook decision orders Facebook to internally separate social media data from those collected by Instagram and WhatsApp, acquired by Facebook in 2012 and 2014, respectively. Internal separation attempts to undo, at least in Germany, acquisitions authorised without further investigation by the European Commission^[6] or other authorities.^[7] Facebook is the subject of political discussions, particularly in the United States, with some commentators specifically suggesting dismantling along the WhatsApp and Instagram service lines.^[8] Moreover, the FTC is currently investigating Facebook's acquisitions.^[9]

Although the Bundeskartellamt's investigation began before the Cambridge Analytica case, the decision will also be commented on in terms of the impact of new technologies on society. Internet governance is a major issue. In Europe, global internet players have been the subject of several decisions based on data protection laws,^[10] consumer laws^[11] and laws against unfair general conditions.^[12] The Irish Data Protection Commission, the lead authority competent to take action against Facebook under Article 56 GDPR, has announced the forthcoming closure of several investigations against Facebook, WhatsApp and Instagram.^[13]

In this context of increasing regulatory density, the question arises as to what the contribution of competition law to the fundamental right of individuals to data protection is. Should it be used to ensure compliance with the GDPR or other rules? The question here does not concern the scope of intervention of competition authorities: competition law applies concurrently to facts that may fall within the scope of other laws. The question raised by the Bundeskartellamt's intervention is that it integrates the conditions for the application of another regulation (in this case the GDPR) to establish the violation of competition law, and that instead of its own conditions, a violation of the GDPR becomes a violation per se of competition law. In doing so, this approach offers to significantly expand the powers of competition authorities.

At the same time, the decision's rationale incorporates dominance as a separate criterion for the application of the GDPR, giving it a new dimension with respect to dominant undertakings. The approach followed by the Facebook decision is likely to have an influence on the application of data protection law to dominant companies by data protection authorities.

This article, therefore, examines the arguments in the Bundeskartellamt's decision, focusing on the possible impact of such arguments on competition law (Section II) and data protection law (Section III).

In each section, the main arguments of the Facebook decision in relation to competition law (section II.2) and data protection law (section III.2) will be summarised first. In a second step, these arguments will be analysed in the light of each set of rules, examining what the contributions and consequences of such arguments could be on competition law (section II.1) and data protection law (section III.1), as well as their impact on businesses.

We will also mention the main objections raised by the Düsseldorf Higher Regional Court, but we will not comment on its judgment given the summary nature of its examination.

II. Arguments relating to dominance and its abuse and their impact on the application of competition law

In this section we will first summarise the main arguments of the Facebook decision related to competition law (section II.1). The second part provides a critical analysis of these arguments in the light of traditional competition law criteria (section II.2). Such an analysis is justified by their impact on the development of competition law in other jurisdictions. Particular arguments based on German law will not be discussed.

1. The arguments of the Facebook decision

The Facebook decision is based solely on the German provisions on the abuse of dominant position (Article 19 para. 1 GWB).^[14] It is explained that Article 102 TFEU does not cover the protection of fundamental rights or values protected by other laws.^[15] However, the Bundeskartellamt's intervention is authorised under Article 3 para. 2 of Regulation 1/2003.^[16]

a) Market power, market dominance and personal data

Facebook is considered to be dominant in the national social networking market for private users.^[17] When the price of the service is zero and monetary payments are replaced by the user's attention and the marketing of its data to advertisers in the form of targeted advertising, the extent to which user data is processed is also a relevant factor in defining market power.^[18] The decision refers to the newly introduced Article 18 para. 3 letter a GWB concerning access to data as a criterion in the assessment of market power.^[19] Since market power allows data to be processed even against the will of users,^[20] the scope of data processing by Facebook is not under sufficient competition constraint.^[21] The extent of data collected and processed is such that it creates barriers to entry that cannot be challenged by competitors, except by Google.^[22] The data actually plays an important role in the overall assessment of dominance, although the decision maintains that a large database as such is not an indication of market power.^[23]

b) Privacy notices and terms of use as an abuse of a dominant position

According to German case law, the general terms of use can constitute an abuse of a dominant position. The Facebook decision is based on the BGH's VBL^[24] and Pechstein^[25] judgments. In particular, the privacy notices are also likely to be considered abusive. The Pechstein case law is used as a basis for encompassing the protection of the fundamental rights of users with regard to personal data for the purposes of Article 19 para. 1 GWB,^[26] considering the provisions of the GDPR as mandatory principles for assessing whether privacy notices are reasonable.^[27] The Facebook decision is strongly based on constitutional values,^[28] the users' right to informational self-determination, as well as the fundamental right to data protection,^[29] and Article 8 para. 2 of the EU Charter of Fundamental Rights.^[30]

After incorporating the principles of the GDPR as a condition for the application of Article 19 para. 1 GWB, the assessment of abuse is carried out exclusively by applying these principles (see section III.1 below).

c) GDPR infringement as a manifestation of market power

According to the Facebook decision, the terms of use and privacy notices constitute an abuse of a dominant position because they are a manifestation of market power. The assessment of causality between market power and abuse is limited to the finding that there is no requirement of causation. With reference to the above-mentioned BGH judgments, it is explained that the requirement that the abuse must be the manifestation of market power is a sufficient condition and not a necessary one. In addition, the concept of «normative causality» (normative Kausalität) makes causality examination superfluous. In considering normative causation, the Facebook decision refers only to the situation of the addressee^[31] (i.e. Facebook's dominant position) and the violation of the users' right to self-determination as a manifestation of that dominant position.^[32]

The anti-competitive effect to the detriment of competitors is also mentioned in the Facebook decision, without any particular examination. Data combination may allow Facebook to transfer market power to other markets where WhatsApp or Instagram are present. In addition, the combination of the data sets in breach of the GDPR creates barriers to entry. According to the Bundeskartellamt, there is a direct correlation between the effect of the terms of use and market power.^[33] The evidence provided is an academic article.^[34]

2. Fundamental rights as a mechanism for extending the powers of competition authorities

The Facebook decision proceeds through two mechanisms to expand the government's control powers. As a first step, the main criteria applied in competition law are rendered ineffective (section II.2.a). Secondly, the fundamental rights of individuals are used to justify intervention in the business model of the dominant company (section II.2.b).

a) Abandonment of the competition law criteria

An abuse of a dominant position occurs when an undertaking in a dominant position thereby adopts a practice that has anticompetitive effects in the market in which it holds a dominant position or in a neighbouring market. These general criteria are the same for exclusionary or exploitative practices, including the use of general terms and conditions of sale. In exploitative abuses, the unfairness of the prices or conditions imposed is determined by comparison with the situation in the competitive market (the counterfactual). German case law refers in the VBL and Pechstein cases to a normative criterion based on values protected by other provisions. The latter alternative is used by the Bundeskartellamt as a criterion for examining whether Facebook's practices are abusive.^[35] In essence, the application of this normative criterion would mean that the authority does not need to investigate any competitive effect of the practice in the market.

We will examine below the process whereby the general criteria in competition law are abandoned, which is clearly visible in the Facebook decision. Among the competition law criteria, only dominance is fully examined, with abuse simply referring to GDPR infringement. What makes such an outcome possible? The VBL and Pechstein judgments are in our opinion not the only explanation. A general trend towards the misuse or even abandonment of key competition law criteria has emerged and even established itself in Europe, supported by the inaction or judicial activism of some courts.

First, we have the narrow definition of the relevant markets. It is common to define markets narrowly so as not to include low substitutes. Competitive relationships are re-examined when assessing dominance, taking into account potential competition or the countervailing market power of customers. The assessment of the anti-competitive effects of the practice is another corrective to the narrow market definition. At the same time, a narrow definition has the disadvantage of isolating markets that exert horizontal competitive pressures on each other, which prevents effective merger control. For instance, if a broader «attention market» had been defined,^[36] the Commission might have examined the Facebook/WhatsApp merger in depth.

Secondly, the political objective of rebalancing trade relations has led to the use of ex post control of abusive practices by lowering the threshold of dominance. This dilutes the very concept of market power: consumer preference for brands, bilateral bargaining power, economic dependence and all kinds of influences are presented as manifestations of market power.^[37]

Thirdly, the requirement of causality between dominance and abuse, which differentiates between practices resulting from market power and those that are not, is neglected. The notion of «normative causality» used by the Bundeskartellamt is another tool to render causality between abuse and market power ineffective. The causation criterion has been diluted to the point where it is virtually non-existent. Therefore, any practice can be qualified as an abuse of a dominant position, including the violation of another law unrelated to market power.^[38] In this respect, the Düsseldorf Higher Regional Court rightly points out that intervention is not legitimate in the absence of causation.^[39] German legal doctrine also warns against the risk of inappropriate extension of the scope of the GWB as a result.^[40]

Fourthly, the rationale for competition law intervention, the anti-competitive effects on the market, are not examined, even in cases of abuse of a dominant position. The Facebook decision does not articulate or quantify the anti-competitive effects of a combination of data.^[41] According to the Facebook decision, the combination of data from different services is problematic under antitrust law, as combination can transfer and preserve market power, exclude other market players and create barriers to market entry for competitors such as Snapchat.^[42] However, Facebook does not bundle the use of Facebook social media with the use of WhatsApp or Instagram services, which could have been considered a tied sale; in fact, users can register and use each service separately.^[43] Finally, the anti-competitive effect of combining data collected by external partners is even more doubtful, as it is not clear which markets would be affected, in particular to which markets any market power would be transferred. The collection of external data is used only to improve the offer of personalized services, which might strengthen Facebook's dominant position. In addition, the Facebook decision creates confusion as to the type of abuse throughout its argumentation: imposing general terms on users would be exploitation, while the alleged effects concern the exclusion of competitors. The lack of analysis of anti-competitive effects and abuse mechanisms explains the rejection of any abuse by the Düsseldorf Higher Regional Court after a summary examination; prejudice to users within the meaning of data protection law does not amount to a competition law infringement.^[44]

The only arguable argument is, therefore, the accumulation of data and the increase in barriers to entry, arguments that relate to dominance, but not to the abuse. This case appears to be more of an ex post regulation of the dominant position itself, independent of any anticompetitive practice.

Finally, the establishment of the counterfactual is used to identify the outcome of a competitive market. The decision does not offer a counterfactual analysis. The Düsseldorf Higher Regional Court also criticizes the absence of a serious examination of the counterfactual (Als-ob-Wettbewerb) in the Facebook decision,^[45] which makes it impossible to identify conduct that would differ from the competitive situation. A counterfactual based on users' fundamental rights, visible in the background of the Facebook decision's argument, is based on the assumption that a competitive market would offer a greater degree of compliance with GDPR or respect for fundamental rights. But such a premise is not relevant to the competitive market. This is because the market does not have such a function.

The same argument had been put forward by the Munich Higher Regional Court in the Pechstein case,^[46] overturned by the BGH: the Regional Court held that the FIS's^[47] imposition of CAS^[48] arbitration deprived the athlete of the right to an impartial and neutral tribunal, criteria with which the CAS structure would not comply. According to the regional Court, in a competitive market, the athlete would have chosen a tribunal that met the requirements of impartiality and independence, but without explaining why a competitive market would give the athlete a choice and why it would also establish an impartial and independent tribunal. The competitive counterfactual is based on standards applicable to state courts which are not subject to competition and on values such as the neutrality and impartiality of justice, which are not values related to the functioning of the market but to the rule of law.

The criteria listed above are related to the functioning of the market and market power. By rendering these criteria ineffective, the scope of intervention of competition authorities widens, while at the same time legal certainty decreases. Ultimately, the intervention of competition authorities is not necessarily linked to the functioning of the market but to another type of regulation, such as product regulation, consumer protection and even protection of fundamental rights. The confluence of the aims of the various regulations is highlighted by the metamorphosis of the principle of the special responsibility of a dominant undertaking not to distort effective competition, which now becomes, according to the Bundeskartellamt, a special responsibility when it comes to defining the characteristics of the product, in its conditions of use and its strategic decisions on products.^[49] In other words, the liability of dominant companies is extended to the violation of other legal requirements and competition authorities are set up as authorities that ensure the compliance with other laws by these companies.

b) Fundamental rights as a disciplinary power mechanism for economic freedom

In the Facebook decision, competition law limits the company's economic freedom by confronting it with the users' right to self-determination. Fundamental rights provide governments with a mechanism to limit the economic freedom of companies without having to apply competition law criteria. This is the core proposal of the Facebook decision.

This proposal is based on the BGH's Pechtein judgment, which is also of interest to Switzerland, home of the headquarters of FIS and CAS. However, the Pechstein case is an example of how the BGH has refrained from using competition law to restrict the fundamental rights of a private association following a balancing of interests. In dealing with the invalidity of the arbitration clause, the Court had to take into account several fundamental rights: the athlete's right to access the courts,^[50] its economic freedom and the right of a sports association to autonomy.^[51] This was the context of the balancing of interests: the application of competition law by the State to protect the fundamental rights of the athlete could compromise the organisational autonomy of the FIS.^[52] The Bundeskartellamt, on the other hand, deduced from the Pechstein judgment an extension of the scope of competition law to the protection of fundamental rights in general, which would allow it to intervene even in the absence of anticompetitive effects on the market. The Düsseldorf Higher Regional Court, while recalling that Pechstein claimed her economic freedom as a professional skater, rejected this hypothesis, stating that a violation of the fundamental rights of the contracting parties of a dominant company does not constitute an abuse per se.^[53] In this respect, a possible appeal by the Bundeskartellamt to the BGH could also clarify the scope of the BGH judgment in Pechstein.

While competition law has already struck a balance between the public interest in free competition, on the one hand, and the economic freedom of dominant undertakings, on the other,^[54] such a balance is only maintained if competition law applies relevant criteria relating to dominance, harm to competition and causation between the former and the latter. Conversely, the intervention is not balanced if it is based solely on the violation of the GDPR or the fundamental rights of users.

Finally, the Facebook decision adopts a paternalistic vision of the users' right to self-determination. The freedom to waive Facebook services is not taken into account in the decision, because from the Bundeskartellamt's point of view it is not a real choice. Therefore, Facebook must offer two versions of its services: one with combined data and the other where the user can refuse the combination of Facebook and WhatsApp data while using both services.^[55] In doing so, competition law gives users more than a choice: it gives them the right to be on Facebook in addition to the option of choosing the features of the services used. It thus encompasses techniques of governance that go beyond the consumer choice paradigm^[56] by establishing rights for consumers, rights created for them, but immediately captured and enforced by government coercion: product choice and product functionalities are not determined by the market but by competition authorities.

As the competition law criteria cannot be met, the decision focuses on the application of the GDPR, the only regulation relevant to the factual situation.

III. Non-compliance with the GDPR as an abuse of a dominant position and its implications for data protection

In this section we will first summarise the main arguments of the Facebook decision related to the breach of GDPR (section II.1). The second part of this section provides a critical analysis of the arguments used in the Facebook decision with regard to their impact on data protection law (section II.2). Since the main contribution of the Facebook decision is to integrate the concept of dominance into the GDPR analysis, we will examine the relevance of this concept as a criterion for the application of the GDPR, a criterion that can be used by data protection authorities to restrict the ability of dominant companies to process personal data.

1. The arguments of the Facebook decision: non-compliance due to lack of legal grounds

Let us recall the main argument of the case: the use and implementation of the terms of use and privacy notices constitute an abuse of a dominant position within the meaning of the general clause of Article 19 para. 1 GWB because, as a manifestation of market power, these conditions violate the principles of the GDPR.^[57]

The collection and processing of data when opening a Facebook,^[58] WhatsApp or Instagram account is not the subject of the Facebook decision. Its purpose is the combination of data sets, a type of data processing. Therefore, the principle of data minimisation is not an issue (Article 5 para. 1 letter c GDPR). In this respect, the argument concerning the processing of data collected by external partners is more ambiguous, as the decision also examines the scope of the data collected,^[59] even if the corrective measure prohibits a type of processing, namely the assignment of the data collected to the Facebook user profile, subject to the user's specific consent.

Article 6 GDPR reflects the EU's approach based on a limited list of legal grounds for data processing; in the absence of a legal ground, data processing is prohibited.^[60] We will briefly describe the arguments rejecting the legal grounds put forward by Facebook, the most relevant being consent (Article 6 para. 1 letter a, and Article 9 para. 2 letter a of the GDPR), contract (Article 6 para. 1 letter b, and Article 9 para. 2 letter b of the GDPR) and legitimate interest (Article 6 para. 1 letter f of the GDPR).

a) Consent

The acceptance of general terms and privacy notices during registration was not considered freely given,^[61] because of the «clear imbalance» resulting from Facebook's dominant position.^[62] The quasi-monopolistic position with 90% of the market, combined with direct network effects, prevents the user from switching to other services, so that there is no free choice within the meaning of the GDPR. Refraining from using social media services was not an option, since this has significant disadvantages for users, as they cannot meet their needs to participate in the social network.^[63]

b) Contract

The Facebook decision raises three objections to the application of the contract as a legal ground (Article 6 para. 1 letter b GDPR).

First, the contract cannot be used as a legal basis by a dominant company.^[64] Since the necessity criterion is interpreted restrictively, Facebook's social services contract cannot justify the processing of data collected from other internal services (such as WhatsApp) or external services, which are not considered necessary for the functioning of the social network. The Facebook decision criticizes the extended and unlimited definition of Facebook services in its general terms,^[65] which does not automatically require the processing of all kinds of data.

Secondly, the contract cannot be used to combine all Facebook products into a single contractual object to justify processing data of this magnitude.^[66] Facebook's dominant position rather justifies a narrow definition of the main purpose of the contract and, consequently, of the data processed for that purpose.

Third, such a wide processing of user data is not necessary for a personalized user experience.^[67] The company cannot define itself what data are necessary for its offer: the mere utility of the data for the user's personalised experience would then make the contract the legal ground for its business model, without the need for legitimate interest or consent, which would ultimately disregard the users' fundamental rights to personal data protection and self-determination in terms of information.^[68]

c) Legitimate interest

The assessment of the legitimate interest is conducted separately for internal and external services, and for the legitimate interests of Facebook and third parties, using the same criteria. In short, Facebook cannot use the legitimate interest as a legal ground for the processing of data collected from other internal services or third parties.

First, Facebook has not clearly indicated what its legitimate interest is.^[69] In particular, it does not specify what its interest would be in assigning all internal (and external) service data to a user account. The main objection is that an undertaking cannot decide which processing is in its legitimate interest: the processing of the data must be essential, necessary, and even absolutely necessary.^[70] In order to satisfy the legitimate interest criterion, the purpose must not be achievable by any other means.^[71] And the decision provides the appropriate means: the user's consent would be a less intrusive measure.

In essence, the Facebook decision denies the need to collect and process user data for the purpose of personalizing Facebook's services. In particular, the decision questions the added value or crucial contribution of automatically combining data from other internal or external services, since Facebook is able to achieve a high degree of personalization and individualization with the data generated by Facebook.com itself^[72] The decision further recalls that the economic model in itself is not sufficient to justify any data processin^[73] and that the undertaking can only exercise its fundamental right to carry out an economic activity if the data processing is necessary for its economic model.^[74]

The result of the balancing test is negative.^[75] The type of data processed is sensitive. The processing itself involves a significant amount of data, and user profiling is complemented by user tracking on a large number of websites, services, locations and devices, which constitutes a serious breach of the data subject's privacy.^[76] Such large-scale processing does not meet the reasonable expectations of users. Finally, Facebook's dominant market position is considered a negative factor in the balancing process, as users - most of them young and inexperienced - have no bargaining power and Facebook can therefore unilaterally impose its business model. This position allows it to impose several grounds for the processing of their data, such as legitimate interest, contract or consent.^[77]

2. The relevance of the concept of dominant position in data protection

Including dominance amongst the criteria for assessing a breach of the GDPR would allow data protection authorities to intervene more actively against data processing by dominant companies, for example, by limiting the legal grounds that would make such processing lawful. The question arises as to the function and added value of the dominant position test in protecting personal data and the fundamental rights of individuals with regard to it. We conclude that dominance is not relevant to assess the legal grounds of consent (subsection III.2.a), contract (subsection III.2.b) or legitimate interest (subsection III.2.c). The result is an unjustified limitation on companies that may be in a dominant position in a particular market, without improving user protection.

a) Function of the concepts of dominant position and choice

In the Facebook decision, the dominant position of the controller is used to exclude the application of any legal ground for a particular type of data processing. The result is worrying for companies that may one day become dominant in a particular market, a risk that is real given the inclination of competition authorities to define narrow markets. Does this mean that dominant companies will not be able to collect and process data based on consent, contract or legitimate interest?

First, let us recall the function of the notion of user choice in both sets of rules. In competition law, consumer choice is taken into account when defining the relevant market: it includes all products that represent a choice in terms of price and quality for a sufficiently large number of consumers in the market to make a price increase unprofitable. The relevant market and dominance analysis take into account the existing supply on the market. Even the most interventionist and extensive proposal of the objectives of competition law to adopt the consumer choice standard^[78] is based on choice as a mechanism to choose among different products placed on the market by competing companies. On the other hand, the dominant position of an undertaking does not say anything about the indispensability of the product in question, even in the event of a monopoly.^[79] In other words, competition law does not give the right to obtain a particular product, even when the supplier is in a monopoly position, nor does it aim to increase the choice of products on the market through State intervention.

From a data protection perspective, the purpose of the choice during consent to data processing is to allow each individual more control over his or her personal data. The preamble to the GDPR explains that consent «should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.»^[80] Examples of obstacles limiting the choice of the data subject relate to technical constraints on the way consent is collected.^[81] The choice, therefore, has an impact on the design of the product itself, which should by default satisfy a high degree of compliance with the principles and requirements of the GDPR.^[82] In this sense, data protection provisions aim to regulate the specifications of products and services placed on the market. They are more relevant than competition law, which is not intended to define the characteristics of the product or to increase the number of products on the market.

On the other hand, the GDPR does not mention the choice or availability of competing products to judge whether consent was freely given. The GDPR does not refer to market power, dominance or monopoly. It refers only to the concept of «clear imbalance between the data subject and the controller», giving the example of public authorities.^[83] It is interesting to note that even the reference to labour relations has been deleted as a statutory example of «clear imbalance».^[84] And contrary to what is mentioned in the Facebook decision, the existence of a dominant position does not necessarily imply a clear imbalance between the controller and the user. Dependency or a situation of «imbalance» between the parties depends more on the type of contractual relationship and the situation of the user than on the dominant company. In addition, a concentrated market may limit the choice of products available when concluding contracts, but the market structure does not determine the business model based on the collection and processing of personal data: in other words, the removal of the dominant position will not bring a business model into line with the GDPR, nor will it remove any imbalance in contractual relations.

In this context, the measures taken in the Facebook decision itself show that dominance is not an obstacle to Facebook's ability to obtain users' consent, provided that users have the choice to refuse data integration. In other words, the limited choice of products in the market resulting from the structure of the market does not preclude the use of consent as a legal ground.

b) Data protection against the freedom of contract?

The contract is another legal ground for processing personal data. However, according to the proposal in the Bundeskartellamt's decision, the dominant position does not allow the company to rely on contract. The data protection regulations separate consent as a condition for the formation of the contract from consent to the processing of data for the purpose of its execution, the requirements being more stringent in the latter case. The services funded by the use of personal data cannot therefore freely benefit from the legal security offered by the contract.

To what extent data protection law should take into account the supply on the market, and therefore the option to choose different products in order to examine the free nature of consent, has so far been the subject of conflicting decisions. For example, the new Article 7 para. 4 GDPR has been construed differently by the Supreme Courts of Italy and Austria. In Italy, the Supreme Court^[85] has ruled that Article 7 para. 4 GDPR does not apply if the service is not essential and other interchangeable services exist on the market; in such a case, consent to the general terms of use is valid. The Austrian Supreme Court^[86] has held that making contractual consent conditional on the processing of data not necessary for the performance of the contract is prohibited, regardless of the availability of other services on the market. This latter interpretation means that consent to the general terms of use is not a valid basis for the processing of data which are not necessary for the provision of the service. Both cases concerned the sending of advertising messages from third party partners to customers of online services. While we have more sympathy for Italian case law, which is more respectful of the parties' contractual freedom, it seems to us that the market structure, the dominant position of the controller or the availability of other products on the market are not relevant criteria for assessing the lawfulness of personal data processing.

The issue lies more in the very idea expressed in Article 7 para. 4 GDPR: companies and users do not benefit from the contractual freedom for data considered not necessary for the contract and the economic model of the company, thus legitimizing unlimited state interventions in the freedom of individuals and companies. This would mean that individuals cannot pay with personal data considered as unnecessary. The Advocate General's opinion in the Planet49 case addresses these concerns by first clarifying that the prohibition of bundled consent is not absolute.^[87] Secondly, it considers that, since the provision of personal data constitutes the user's main obligation in order to be able to participate in a service (a promotional game), the processing of such personal data by third-party companies (sponsors) should be considered as necessary for participation in the service, which in turn makes consent valid.^[88] The scope of the offer on the market was not relevant for its analysis. Finally, through a process of objectification of the subject matter of the contract and increased requirements on consent, Article 7 para. 4 GDPR can even be used as a basis for establishing an obligation to provide a service, as in the case of the proposal to no longer allow cookie walls.^[89]

c) Dominance and legitimate interest

The use of dominance as a ground for disqualifying the preponderance of the legitimate interest of the company is even more doubtful, as the test of the balancing of interest should remain focused on the needs of the company's business and the harm caused to individuals by data processing. The position of the controller on the market does not provide any useful information to judge whether the company's interest is legitimate or not, or to judge whether any possible harm is being caused to individuals: the power to impose one's own interest on an individual^[90] does not increase or reduce the legitimacy of the interest itself. The argument on the imbalance of power, on the other hand, becomes much more relevant when the status of individuals is taken into account: the example of employees, students, patients,^[91] children or other vulnerable population groups may require specific regulation.

IV. Concluding remarks

The Facebook decision is part of a trend not to apply criteria relating to the functioning of the market in competition law, without providing real added value in terms of data protection.

The main suggestion of the Facebook decision is to integrate fundamental rights as a controlling mechanism of dominant companies. The government can thus freely restrict the freedoms of one party on the basis of the fundamental rights of the others, without having to apply the usual assessment criteria in competition law. We can only disapprove. The space of freedom that underpins spontaneous cooperation between consumers and businesses in the market economy will be replaced by a mechanism of government coercion.

In the field of data protection, dominant position is used in the Facebook decision to exclude any legal ground justifying a particular type of processing, whereas the market position of the controller should not be relevant. Dominance thus amplifies the consequences of a limited list of legal grounds for processing personal data in conformity with the GDPR, a process that already significantly restricts companies' freedom to determine their business model and, by mirror effect, consumer choice. Consumers too must remain free to access more services in return for their personal data.

Overall, such an approach risks delegitimising the work of competition and data protection authorities. Competition law and data protection are, however, of paramount importance in the digital economy sector, whether they are used to examine the competitive advantage in data or the data protection (privacy) dimension as a parameter of effective competition. In terms of data exploitation, merger control is better suited to preventing the creation of a dominant position in sectors that use and depend heavily on the processing of large amounts of data. Merger control is a powerful mechanism that competition authorities can use more agilely in the future. The prohibition of cartels may also apply in the case of agreements aimed at reducing the degree of protection of individuals with regard to personal data (privacy), as one of the important parameters of competition in these markets. The control of abuses of dominant position remains relevant, provided that predictable criteria related to dominance, harm to competition and causation between the former and the latter are applied.