Meta v Bundeskartellamt: competition authority may find a GDPR breach, strict conditions for legal bases behind personalised advertising

What it is about

Question: may the German competition authority, when examining an abuse of a dominant position, assess whether Facebook complies with the GDPR, and on what legal basis may Meta link data from other group services and from third-party websites and apps to the Facebook account? Ruling: a competition authority may find a GDPR infringement where that is necessary to establish an abuse. It must cooperate sincerely with the data protection authorities and cannot depart from their earlier decision on the same or similar terms. Collecting and linking visit data from websites and apps touching special categories is processing of special category data where it allows such information to be revealed. Merely visiting such a site is not manifestly making the data public. Reliance on the contract (Article 6(1)(b)) is possible only where the processing is objectively indispensable to the main subject matter of the contract. Reliance on legitimate interest (Article 6(1)(f)) requires that the user was informed of that interest, that the processing is strictly necessary and that a balancing of interests favours the controller. For personalised advertising without consent, the Court held that the user's interests prevail. Legal obligation, vital interests and public interest are also of limited use. Dominance does not as such rule out valid consent, but it is an important factor in assessing whether consent was freely given.

What this means in practice

If you combine data from several services or third parties for profiling or advertising, you can rely on the contract only where the processing is genuinely indispensable to the service you provide. For personalised advertising based on such combined data, legitimate interest without consent is in practice not tenable. If you rely on legitimate interest, name that interest to the user in advance, limit processing to what is strictly necessary and document the balancing test. Processing that can reveal sensitive information falls under Article 9, even where that information is inferred from browsing behaviour. If you hold a strong market position, you must be able to show that consent was freely given. Expect that competition authorities can also review your GDPR compliance.

The GDPR articles concerned

• Article 4: Definitions
• Article 5: Principles relating to processing of personal data
• Article 6: Lawfulness of processing
• Article 7: Conditions for consent
• Article 9: Processing of special categories of personal data
• Article 51: Supervisory authority
• Article 56: Competence of the lead supervisory authority