This presentation by Orla LYNSKEY, Assistant Professor of Law, London School of Economics, was made during the discussion “Non-Price Effects of Mergers” held at the 129th meeting of the OECD Competition Committee on 6 June 2018. More papers and presentations on the topic can be found out at oe.cd/npem

1. Data Privacy as a
non-price effect in
Merger Control
OECD – Committee on Competition Policy
Dr. Orla Lynskey (o.lynskey@lse.ac.uk)
6 June 2018

2. BACKGROUND
Data protection legislation in place for decades
Exponential increase in intensity of personal data
processing
Personal data as an input/commodity
‘Fragile’ consumer sentiment re extent of
consumer use

3. IN THE SPOTLIGHT….
Report of the FTC on data brokers, and statements of
various Commissioners, May 2014
Resolution of the European Parliament on the unbundling
of Google's search from other commercial activities,
December 2014
Report of the CMA on the collection and use of consumer
data, June 2015
Bundeskartellamt, Facebook investigation, March 2016
Joint Report – Autorité de la Concurrence and
Bundeskartellamt, ‘Competition Law and Data’, May 2016
Opinion 8/2016 of the EDPS on coherent enforcement of
fundamental rights in the era of Big Data, Sept 2016

4. ROLE OF DATA IN COMPETITION ASSESSMENTS
Data as a barrier to entry and potential source
of market power
Empirical question: are alternative sources of
a similar volume and variety of data available
on the market?
Contrast Microsoft/Yahoo Search Business with
Microsoft/LinkedIn

5. ROLE OF DATA PRIVACY IN MERGERS
1. Data privacy as an element of quality:
- Concentration restricts ‘quality’ of data use
policies – use data protection legislation as
a normative benchmark.
- Competition on ‘data privacy’ quality must
be a ‘key parameter of competition’
- Overlooks role of maverick ‘data-privacy
protectors’ and/or acquisition as a
defensive move to stifle future competition

6. EXAMPLE
ADVERTISERSINDIVIDUAL USERS
FACEBOOKWHATSAPP
INDIVIDUAL USERS

7. ROLE OF DATA PRIVACY IN MERGERS
2. Data privacy as part of the relevant
competitive backdrop
- Data protection as economic regulation; seeks
to correct information/power asymmetries
- Merged entity would: ‘lack the ability to lock-in
patients by limiting or preventing the portability
of their data given that, [according to GDPR],
users will have the right to ask for the data
portability of their personal data’.
Sanofi/Google/DMI JV

8. CHALLENGES
Identifying qualitative criteria to assess quality
- Discretion in regulatory framework leaves
scope for competition
- Global convergence around a core set of
data privacy principles (Convention no.108;
FIPPs)
- Data security; data accuracy;
anonymization; data minimization;
transparency.

9. KEY DATA PRIVACY PRINCIPLES
System of checks and balances for personal data
processing
Legal basis: consent; contract; legitimate interests of
the undertaking
Safeguards: purpose limitation; data minimisation;
accuracy; anonymization; fairness
Responsibilities: data security; data privacy by design

10. CHALLENGES
Close analysis of consumer decision-making
- Presumption: regulation promotes efficient
decision-making and market reflects
consumer preference
- ‘Dysfunctional equilibrium’ persists despite
regulation
- Must understand ‘other inhibitors’ to
consumer decision-making  systemic
issues
- True impact of regulation on market

11. Dysfunctional
Equlibrium
Convoluted Boilerplate terms;
Bounded rationality;
Number of decisions required;
Secondary markets
Pervasive
sense of loss
of control;
resignation to
‘no privacy’
Lack of incentive for firms to
compete on data privacy;
No reward for those offering good
terms
Deterioration
in data
privacy
quality

12. 1. Text and ‘opt-out’ not visible until user clicks ‘Read More’
2. If user opts-OUT, they must still click ‘Agree’.
3. ‘Agree’ = Facebook and The Facebook family of companies will still receive and use this
information for other purposes such as improving infrastructure and delivery systems,
understanding how our services or theirs are used, securing systems, and fighting
spam, abuse, or infringement activities.
4. A users phone number will still be shared with Facebook even if they opt-out.
5. An opt-out only applies to the sharing of account information with Facebook to
improve Facebook Ads and product experiences (note language used in opt-out - it
does not state ‘Facebook Family of companies’)
Mobile App ToS update

13. DATA PRIVACY AS AN EXTERNAL CONSTRAINT
Data privacy as a fundamental right and/or
public good:
- Irrespective of individual preferences, seek
to promote core data protection principles
- Positive obligation to ensure the
effectiveness of rights
Allow for a non-competition assessment for
privacy and data protection concerns
 Media plurality precedent

14. For any questions or comments, please
contact: o.Lynskey@lse.ac.uk
The journal International Data Privacy
Law (OUP) will publish a symposium
edition on data privacy and
competition in August 2018:
https://academic.oup.com/idpl/