download in pdf

 

Gábor Polyák* – Gábor Pataki**

 

The Value of Personal Data from a Competition Law Perspective[1]

 

Introduction: The New Digital Services Act

In June 2020 the Commission launched a public consultation on the Digital Services Act. The consultation seeks to gather views, evidence and data from the general public, businesses, online platforms, academics, civil society and all stakeholders to draw on their help in shaping the future rulebook for digital services.[2] As the Digital Services Act webpage notes, the new Digital Services Act package aims to modernise the current legal framework for digital services based on two main pillars:

First, the Commission would propose clear rules framing the responsibilities of digital services to address the risks faced by their users and to protect their rights. (…) Second, the Digital Services Act package would propose ex ante rules covering large online platforms acting as gatekeepers, which now set the rules of the game for their users and their competitors. The initiative should ensure that those platforms behave fairly and can be challenged by new entrants and existing competitors, so that consumers have the widest choice and the Single Market remains competitive and open to innovations.[3]

The consultation closed on 8 September 2020. On 16 September 2020, the European Commission announced in the letter of intent, which accompanied President von der Leyen’s State of the Union speech, to publish an Action plan on how to better use synergies between civil, defence and space industries.[4]

Already in May 2016, the Commission had identified the key areas of interest in its Communication on Online Platforms; the fourth guiding policy principle[5] was to ‘[k]eep markets open and non-discriminatory to foster a data-driven economy’. Although the Commission did propose some valuable considerations (e.g., ‘large parts of the public remain apprehensive about data collection and consider that more transparency is needed’),[6] the road ahead is likely to be long and difficult, and the objective will not be achieved overnight. In our opinion, the competition, data protection and consumer protection laws need to take centre stage in this plan. That is why the European Commission’s approval of the Facebook/WhatsApp merger in 2014 and the EUR 110 million fine in 2017 deserve our attention as milestones in the history of competition law and the data-driven economy.

Facebook was subject to a huge fine – this news created a splash throughout the media in May 2017. The European Commission’s decision to levy a EUR 110 million fine against the company for furnishing the European body with misleading information concerning its acquisition of WhatsApp in 2014 was big news. The story of this ‘mega fine’ reaches back to Commission Decision No M.7217, in which the European Commission had originally approved the aforementioned transaction (i.e. the merger). Looking at the acquisition with the hindsight of six years, it appears that the underlying violation of competition law did not stem solely from the misleading information provided by Facebook but may have also arisen from technical mistakes on the part of the Commission. We were at a ‘crossroads’, as Zingales puts it:[7] it was a case at the intersection of competition, data protection and consumer protection laws and, by looking at it exclusively from a competition law perspective, the Commission may have failed to consider vital issues involving the other areas of law that were implicated in this merger. What are the lessons to be learned from this case about competition law, data protection and data-driven companies?

 

I The Players: Facebook Inc. and WhatsApp Inc.

The notion that Facebook is the most important player in the area of online interpersonal communication is an axiom of sorts:[8] In the barely more than a decade that has gone by since the company was founded in 2004, Facebook has completely conquered and dominated online communication. In a public Facebook post[9] from 27 June 2017,[10] the company’s founder and CEO Mark Zuckerberg announced that the Facebook community had surpassed 2bn users. Zuckerberg put it as follows:

‘As of this morning the Facebook community is now officially 2 billion people!’ Then he went on to add the company’s new slogan which had been unveiled four days earlier: ‘Bring[ing] the world closer together’.

Even if we keep the possibility in mind that the figure of 2 billion users still includes a fair number of fake profiles – despite the massive efforts launched in 2017 to identify and eliminate them – these cannot possibly be large enough in number to make up a significant slice of the 2 billion user profiles overall. And if we consider that, based on current estimates, there are roughly 7.5 billion people in the world today, we can assert that, statistically speaking, every fourth person on earth is part of the Facebook community. Moreover, if we narrow the statistic further and do not look at the population overall but only at the groups that are relevant from an advertising market perspective, as well as those people who live in geographical areas that are relevant especially for marketing, then we can also assert that any person within that group is very likely to be a Facebook user.[11] Broadly speaking, therefore, Facebook has a continuously updated database comprising 2 billion people. The data at the company’s disposal stem in part from information voluntarily shared by users, and in another part from profiling their behaviour. Even the major secret services across the world cannot attain such figures (all the more so since no-one shares personal information with them voluntarily). What’s more, unless some earthshattering crisis were to rock Facebook in the near future, no other company in the social media market can come even close to such figures. And in any case, if any competitor were to approximate the breadth of its data collection, Facebook would buy it, just as it did with WhatsApp.

The application called WhatsApp was created by two former Yahoo employees, Brian Acton and Jan Koum, in 2009. This application, which is designed as a forum for communication between consumers, quickly became popular with the public; from the very start, its operations were based on a ‘no ads policy’[12]. The WhatsApp application was bought by Facebook Inc. in October 2014 for a price of USD 19 billion, thereby turning WhatsApp into a Facebook subsidiary. At the time, WhatsApp boasted 600 million active users and it was adding news users at a rate of 25 million a month. The first figure was announced by Jan Koum on Twitter,[13] stressing that ‘active and registered are very different types of numbers…’[14] In mathematical terms, this means that 10% of the global population were active WhatsApp users at the time, but the share of registered users as a percentage of the earth’s population was even higher.

 

II A Personal Data – Dominant Company

Today, however, this user database is also owned by Facebook – the company now disposes over an amount and quality of data that the human mind cannot fully fathom.[15] In a 2016 publication Orsolya Bánki, who is a partner at the Budapest office of the global law firm Taylor Wessing, referred to companies that are in a position of dominance in terms of data management as ‘data dominant companies’[16]. For the purposes of the present study, however, this category is too broad in its focus; we need to narrow it down. There are several areas – and not only in the online realm – where certain companies wield sufficient data to give them a position of dominance. However, when it comes to the companies at issue in the present discussion, we are not talking about entities that are data-dominant or data-led in a general sense of the term;[17] instead, their dominance stems specifically from their control of personal data, so the right term to describe them is ‘personal data-dominant company’. The data assets of such a company are a relevant factor that shapes its business activities, its market position and, ultimately, also the assessment of its position in terms of competition law. Still, the issue is whether the Facebook-WhatsApp merger qualifies as a competition law case, in which the data wealth is tangentially relevant as one aspect of a classical merger assessment, or whether the fusion of the two companies is in fact a clear-cut case of a data protection legal issue. Some critics of the Commission’s decision have argued that the Commission had – erroneously – decided on a data protection issue in a competition law procedure.[18]

That there are certain instances when these two legal areas cannot be neatly separated was also manifest in two conferences organised by the OECD. The first, held in 2016, touched on the relationship between the Big Data phenomenon and competition law,[19] while the second conference, which was held in 2017, was about the relationship between algorithms and competition law.[20] Another factor that supports the idea that these issues are closely intertwined is that the Italian competition authority[21] issued a EUR 3 million fine against Facebook on 12 May 2017 because the latter had violated consumer protection rules when it obliged WhatsApp users to share their personal data with WhatsApp’s California-based parent company.[22] In its decision No 2017/C 286/06 of 17 May 2017, the European Commission issued a fine of EUR 55 million for a violation of Article 14 (1) a) of the Merger Regulation,[23] along with another EUR 55 million fine for a violation of the same Regulation’s Article 14 (1) b).[24] Thus, within the span of five days, Facebook was subject to two judgments that it had engaged in legal violations – one concerned consumer protection and the other competition law – with fines totalling EUR 113 million. In both cases, however, one of the crucial factors was data protection. The merger between Facebook and WhatsApp has become one of the most hotly debated merger cases in the case-laws of both the European Commission and the U.S. Federal Trade Commission (FTC),[25] ever since both organisations greenlit the transaction in 2014.[26] The merger definitely marked a milestone in terms of EU competition law, in the sense that it was the first case in which the Commission had to look at the linking of the databases[27] of social media networks as one of the factors in assessing the anticipated market impact of the merger.[28]

 

III The Relevant Markets

The story of this ‘mega fine’ reaches back to Commission Decision No M.7217, in which the European Commission had originally approved the aforementioned transaction. To analyse this case in depth and to better understand the Commission’s logic in making its decision, we draw on the fundamental principles laid out in the Commission’s 2014 approval of the merger[29] with respect to its definition of who the parties are and what services they provide:

– Facebook: social networking platform;

– Facebook Messenger: consumer communications app;

– Instagram: photo and video-sharing platform;

– Operated by: Facebook Inc., which operates in the framework of the subsidiary Facebook Ireland Limited, which is registered in the European Economic Area and is 100% owned by Facebook Inc.;

– WhatsApp: consumer communications services via mobile app;

– Operated by: WhatsApp Inc., which has been a subsidiary of Facebook Inc. since 6 October 2014.

The Commission identified three relevant markets: the market for consumer communications services, the market for social networking services and the market for online advertising services. In the following, we only present the Commission’s own considerations with regard to these services; our own analysis will follow in a later chapter of the present study.

The Commission defined the market of consumer communications services by taking account of the following:

(A) WhatsApp is offered only for smartphones and it does not have any plan to expand its offering to other platforms.[30]

(B) Although the two types of services are used for the same general purpose (communication), the overall experience of the user is richer in terms of functionalities in consumer communications apps.[31]

(C) There is a competitive interaction between Facebook and WhatsApp, but it goes only one way (i.e. consumer communications apps constrain traditional electronic communications services but not the other way around).[32]

Conclusion: The Commission limited its assessment of the impact of the merger to the context of the narrowest relevant product market, namely the market for smartphone-based consumer communications apps.[33]

Since competition concerns do not arise in this case, regardless of the alternative market definition used, the Commission left it open whether the market for social networking services should be segmented further on the basis of the following considerations:

(A) The Commission highlighted a number of important differences between social networking services and consumer communications services.[34]

(B) On a general level, social networking services tend to offer a richer social experience than consumer communications apps.[35]

(C) The Commission concludes that while consumer communications apps such as Facebook Messenger and WhatsApp offer certain services that are typical of social networking services, in particular the possibility of sharing messages and photos, there are important differences between WhatsApp and social networking services.[36]

The Commission’s conclusions were based on a very narrow definition of the market for online advertising services, which left several issues open, while the analysis focused on the following considerations:

(A) The market investigation conducted for the purposes of reviewing the Transaction clearly confirmed the Commission’s earlier findings, in which it distinguished between online and offline advertising services.[37]

(B) The majority of competitors that took part in the market investigation submitted that, from an advertiser’s point of view, search and non-search ads are not substitutable services.[38]

(C) Under a narrower definition of the product market, the Transaction would not give rise to serious doubts as to its compatibility with the internal market.[39]

 

IV A Transaction without a ‘Union dimension’, even though It Was Deemed to Have One

The merger character of the transaction was established beyond doubt because it met the conditions set out in Article 3 (1) of the Regulation, according to which a merger of corporations was being performed with Facebook Inc. acquiring WhatsApp Inc. for a price of USD 19 billion.[40] The transaction qualified as a concentration within the meaning of Article 3(1)(b) of the Merger Regulation.[41]

In the next step, the Commission had to assess whether the merger had a ‘Union dimension’[42], as this qualification determines the scope of the merger procedure.[43] The definition includes two criteria that must be examined to assess whether they apply to the situation at hand. The respective turnovers of Facebook and WhatsApp were not revealed by the Commission;[44] this information is published by the companies. However, although in 2013 Facebook’s worldwide turnover was in excess of EUR 5,000 million,[45] the transaction did not have a Union dimension within the meaning of Article 1(2)[46] or Article 1(3)[47] of the Merger Regulation, since the intra-EU turnover of WhatsApp amounted to only EUR 7.7 million[48] in 2013.

Even so, the transaction was deemed to have a Union dimension:

…the acquisition fulfilled the two conditions set out in Article 4(5) of the Merger Regulation since it was a concentration within the meaning of Article 3 of the Merger Regulation and it is capable of being reviewed under the national competition laws of three Member States.[49] On 19 May 2014, the Notifying Party informed the Commission by means of a reasoned submission that the Transaction should be examined by the Commission pursuant to Article 4(5) of the Merger Regulation. A copy of that submission was transmitted to the Member States on 19 May 2014. As none of the Member States competent to review the Transaction expressed its disagreement as regards the request to refer the case, the Transaction was deemed to have a Union dimension pursuant to Article 4(5) of the Merger Regulation.[50]

 

V The Notification of the Merger, the Review and its Results

The European Commission published the notification of the planned merger between Facebook Inc. and WhatsApp Inc. on 4 September 2014, as part of its procedure in Case No M.7217.[51] Its preliminary examination stated that the ‘Commission finds that the notified transaction could fall within the scope of the Merger Regulation. However, the final decision on this point is reserved’[52].

The Commission began its review on the basis of Article 6, and as part of the procedure it asked Facebook Inc whether

[p]ost-acquisition, [Facebook was] planning to link/match in any way customers’ profiles on WhatsApp with these customers’ profiles on Facebook (e.g. by linking customers’ mobile numbers from WhatsApp to these customers’ Facebook accounts)?[53]

In the meanwhile, another submission was filed by a complainant third party, which essentially reiterated the Commission’s assumption above, namely that Facebook Inc. would be able to link user profiles even without any active behaviour expressing consent by the given user. In its response dated 23 September 2014, Facebook rebutted the complainant’s claims and answered the Commission’s pertinent question in the negative by asserting that, since there was no way of automatically ‘matching’ Facebook User IDs with the mobile phone numbers associated with each WhatsApp user, ‘matching of WhatsApp profiles with Facebook profiles would most likely have to be done manually by users’[54].

The European Commission decided on 3 October 2014 not to oppose the Transaction and declared that it was in compliance with the internal market and with the EEA Agreement.[55] The decision signed by Commission Vice President Joaquín Almunia posits that the Transaction does not give rise to serious doubts as to its compatibility with the internal market with respect to the market for the provision of online advertising services, including its potential sub-segments.[56] The Commission arrived at this assessment based on the following:

(1) The Commission defined the market affected as the narrowest relevant product market for consumer communications services, that is the market for consumer communications apps for smartphones.[57]

(2) The fact that WhatsApp and Facebook are not close substitutes is further evidenced by Facebook’s data showing that a considerable number of users of one service also use the other service. This suggests that the needs fulfilled by each service are different. Therefore, given the considerable differences between the functionalities and focus of WhatsApp and Facebook, the Commission concluded that these providers are not close competitors in the potential market for social networking services.[58]

(3) Since only Facebook, and not WhatsApp, is active in the provision of online advertising services, the Transaction does not give rise to any horizontal overlaps in the market for online advertising or in any sub-segment thereof.[59]

(4) Even if Facebook were to introduce advertising on WhatsApp, the Transaction would only raise competition concerns if post-Transaction there would not be a sufficient number of effective alternatives to Facebook for purchasing online advertising space.[60] Therefore, the Commission notes that regardless of whether the merged entity will introduce advertising on WhatsApp, there will continue to be a sufficient number of other actual and potential competitors who are equally well placed as Facebook to offer targeted advertising.[61]

(5) The Commission declared that it did not find it necessary to review the data protection implications of the merger, and that it had ‘analysed potential data concentration only to the extent that it is likely to strengthen Facebook’s position in the online advertising market or in any sub-segments thereof’. The Commission assessed namely that any ‘privacy-related concerns flowing from the increased concentration of data within the control of Facebook as a result of the Transaction do not fall within the scope of the EU competition law rules but within the scope of the EU data protection rules’[62].

(6) In any event, even if the merged entity were to start collecting and using data from WhatsApp users, the transaction would only raise competition concerns if the concentration of data within Facebook’s control were to allow it to strengthen its position in advertising.[63]

However, as has since became apparent, these claims are open to dispute on several grounds. We will analyse these further below, but only after concluding our comprehensive review of the entire process.

 

VI The Sharing of WhatsApp Data with Facebook

WhatsApp informed users of the acquisition and the planned changes in a blogpost:

19 February 2014:

Here’s what will change for you, our users: nothing. (blogpost entitled Facebook).[64]

17 March 2014:

If partnering with Facebook meant that we had to change our values, we wouldn’t have done it. Instead, we are forming a partnership that would allow us to continue operating independently and autonomously. (…) Speculation to the contrary isn’t just baseless and unfounded, it’s irresponsible. It has the effect of scaring people into thinking we’re suddenly collecting all kinds of new data. That’s just not true, and it’s important to us that you know that. (Blogpost entitled Setting the record straight)[65]

18 January 2016:

That’s why we’re happy to announce that WhatsApp will no longer charge subscription fees. (Blogpost entitled Making WhatsApp free and more useful)[66]

25 August 2016:

Today, we’re updating WhatsApp’s terms and privacy policy for the first time in four years (…) [B]y coordinating more with Facebook, we’ll be able to do things like track basic metrics about how often people use our services and better fight spam on WhatsApp. And by connecting your phone number with Facebook’s systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them. For example, you might see an ad from a company you already work with, rather than one from someone you’ve never heard of. (Blogpost entitled Looking ahead for WhatsApp)[67]

It took Facebook Inc. and WhatsApp Inc. slightly over two years to get to the point when they transferred the user data of WhatsApp users into the database of ‘Corporations that are part of the Facebook family’. The Terms of Service as well as the Privacy Policy were updated: WhatsApp Inc., which had become a Facebook subsidiary by this time, informed its users of this in a blogpost as well as in the form of a so-called FAQ (frequently asked questions) page, in which the company addressed typical issues that users tend to raise in such a context.[68] At the same time, WhatsApp Inc. shared user data not only with Facebook but also with other companies that are part of the Facebook corporate group[69] in order to ‘coordinate more and improve experiences across our services and those of Facebook and the Facebook family’[70]. It needs to be stressed, however, that when the terms and policies in question were updated, WhatsApp users had the option of withholding their data from Facebook, but they had to make a distinct statement to this effect. In consenting to the updated terms, users were informed that ‘[i]f you do not want your account information shared with Facebook to improve your Facebook ads and products experiences, you can uncheck the box’[71]. In fact, users even had the option of changing their mind for a period of 30 days after their statement – this was the timeframe provided for retracting[72] the previously given consent.[73]

Thus, it was only as late as August 2016 that users had the chance to learn that, despite all previous information to this effect, Facebook did in fact have access to their personal data. In other words, despite previous assurances to the contrary, the user profiles created in the two apps could be linked. However, the European Commission had found out about this already a month before – it was informed by Facebook Inc. itself.

 

VII Providing Incorrect or Misleading Information

On 30 June 2016 Facebook Inc. filed a submission with the Commission in which it referred to product improvements involving ‘a form of user matching between Facebook and WhatsApp that was not widely available in 2014’[74]. Practically, therefore, Facebook reported itself to the Commission, thereby pre-empting the Commission from launching its own investigation, which would likely have occurred if the Commission had found out about the changes from the internet as users had done. It is worth emphasising, however, that although Facebook did cooperate with the Commission in this context, the actual data integration had been implemented already before the Commission had had the opportunity to arrive at its own assessment.

On 28 July, the Commission asked Facebook whether the method of identification that would be used to identify the mutual users of Facebook and WhatsApp, on which the planned product update was based, had already been available when the merger was approved and whether this development had already been planned by that time. Facebook Inc. submitted that the so-called telephone identification/matching solution (‘Phone ID Matching Solution’) had been available already in 2014, but its actual form varied depending on the operation system of the given smartphone (Android, iOS, Windows OS or other OS used by Blackberry, Nokia S40 and Nokia Symbian S60).[75] Facebook Inc. further explained that at the time of the merger it had not been clear whether the Phone ID Matching Solution would be sufficient to support such functions, because it had not been designed with the goal of sending cross-platform messages.[76]

In its Statement of Objection dated 20 December 2016, the Commission explained its preliminary view. It posited that, in the M.7217 Facebook/WhatsApp case, Facebook Inc. had ‘intentionally, or negligently, submitted incorrect or misleading information’ in the notification filed in compliance with Article 4 of the Merger Regulation, as well as in its response to the Commission’s request for information (RFI) dated 18 September 2014, which Facebook was obliged to provide pursuant to the Merger Regulation’s Article 11 (2).[77]

The preliminary view expressed in the Statement of Objection already foreshadowed that the case could mark a milestone in the history of European competition law. If the Commission were to make a binding decision that a violation had occurred then that would be a first since the adoption of the Merger Regulation in 2004.[78] Since 2004, the Commission had never before ruled against any company for a violation of having provided ‘incorrect or misleading information’ – as the Commission mentions in the press release.[79]

Facebook Inc. also acknowledged the Commission’s preliminary assessment and confirmed that it had provided incorrect or misleading information in the context of case M.7217 and had engaged in negligent behaviour. In its written comments, Facebook also indicated that it did not request that oral hearings be held and it did not request to review the Commission’s files on the case.[80]

 

VIII The Commission’s Decision, the Amount of the Monetary Fine

In determining the amount of the fine, the Commission assessed that Facebook Inc.’s cooperative attitude was a mitigating circumstance. According to Article 14 (1) of the Merger Regulation, the Commission is entitled to issue a fine up to the amount of 1% of the total turnover of the company. In its determination of the amount, the Commission considered whether a fine would be an appropriate penalty and whether it would also have sufficient deterrent effect.[81] These were the considerations that informed its decision to issue a fine of EUR 55 million for a violation of Article 14 (1) a) of the Merger Regulation, that is the provision of incorrect or misleading information by Facebook in its prior notification of the merger, and another EUR 55 million fine for the violation specified in Article 14 (1) b), that is for the incorrect or misleading information provided by Facebook in response to the Commission’s request for information.

The Commission pointed out in its decision that it had determined the maximum amount of the fine that it could potentially levy based on Facebook’s annual report,[82] which said that the company’s total turnover in 2016 was EUR 24,968,83 million.[83] According to Article 5 of the Merger Regulation, the fine could have totalled EUR 249.7 million[84] per violation. Nevertheless, the Commission set the actual amount of the fine at only 22% of the maximum possible amount.[85]

In the Commission’s press release on the subject, Competition Commissioner Margrethe Vestager said that the Commission had imposed a ‘proportionate and deterrent’[86] fine on Facebook. The authors of the present study assess that it is difficult to take an unequivocal position on the amount of the fine because there is no precedent. This was the first case of its kind, which means there is no basis for comparison. Nevertheless, the amount does raise whether, in the case of a company with such an annual turnover as well as in light of the value of the underlying acquisition deal, the figure decided upon by the Commission will have an actual deterrent effect.

As we wrote above, Facebook Inc. acquired WhatsApp Inc. for USD 19 billion and the Commission had already been fully apprised of this when they approved the transaction.[87] Even the maximum amount of the fine that could have been levied per violation (USD 276.38 million) would have amounted to a mere 1.45% of the total acquisition price, but the fine that actually ended up being levied was just 0.32% of the total merger value. (True enough, it was issued twice, once for each of the violations, but it still amounted to less than 1% of the price Facebook had paid for WhatsApp).

It would have also made sense for the Commission to review how Facebook’s business performance and market position were influenced by fusing the user databases in question.

Moreover, in addition to the monetary fine, the Commission had the additional option of retracting its previous decision based on the Merger Regulation’s Article 6. According to the Regulation, this option is expressly available in cases when the approval was granted based on incorrect information and the responsibility for this information can be clearly attributed to one of the companies involved. Ultimately, in its decision No M.8228 the Commission decided to forgo this option, presumably on two grounds. First, three years after the implementation of the decision, restoring the status quo ante was a theoretical possibility at best. Second, in approving the merger the Commission itself had been responsible for what appear with hindsight to be very obvious mistakes.

 

IX Criticisms of the Commission’s Decision

The Commission made its first mistake in the identification of the relevant market. For one, Facebook rolled out its own messaging service, Messenger, in 2011 for the iOS and Android platforms. Messenger provides for the possibility of direct communication between two users, which is why it clearly seems like a WhatsApp substitute product. The Commission saw this differently, however.

In its decision No M.7217, the Commission declared that it had examined the merger with respect to its impact on the “narrowest relevant product market for consumer communications services, that is the market for consumer communications apps for smartphones,[88] also noting that it had relied on the previously used definition in the Microsoft/Skype case.[89] As Yasar points out,[90] several authors have criticised this approach.[91] In its decision-making process, the Commission essentially treated Facebook and its Messenger service as two distinct units. It viewed the first as a social media service, while it classified Messenger as a consumer communications service.[92] Despite this, it even chose not to classify Facebook Messenger as a close competitor of WhatsApp.[93] It based this assessment on the observation that the parties’ offerings differ from one another in numerous respects,[94] although, in our assessment, these differences are far less significant than they would seem based on the Commission’s opinion. First of all, in the Commission’s view, the most obvious difference is the user ID that is used to access the service, which is a username in the case of Messenger while for WhatsApp it is a phone number. Today we know this was not a real impediment to linking the distinct user accounts across the two services. At the same time, all the other distinctions they draw are also debatable. They posit,[95] for instance, that the source of the interaction between users is different: while in Messenger it is based on Facebook user accounts, WhatsApp relies on the address list in the user’s mobile phone. At the same time, however, in situations when Facebook has the user’s phone number there is once again an area where the contacts immediately overlap. Indeed, while the Commission could not have known this back in 2014, on 24 June 2015 Facebook announced that it was launching a new service: From that day on Messenger was also available without a Facebook account. For using the service without a Facebook account, all the user had to do was to provide a phone number.[96] This took place slightly more than eight months after the Commission submitted its decision No M.7217. In hindsight, this casts the Commission’s interpretation in a different light – this is true regardless of whether Facebook was already aware at the time that it would soon launch such a service or whether it decided to do so subsequently, in the awareness of and as a result of the Commission’s decision.

The third difference that the Commission saw was the user experience. It argued that it is richer in Messenger. However, the question that arises with respect to this assessment is whether any given relative levels of user experience can shift in the future by WhatsApp improving its services. The Commission also pointed to the two services’ respective data protection policies: While Messenger allowed for the collection of user activity data on behalf of Facebook to support corporate advertising sales, that was not the case with WhatsApp. In light of the steps taken after the acquisition, it is readily apparent that data protection policies are not immutable.

The Commission further pointed out[97] that, in practice, WhatsApp and Messenger are complementary products, as is also evidenced by the fact that the majority of EEA users installed both services on their devices and used them in parallel. That is why in reality the two applications are more complementary than rival products in the narrowest sense – the Commission’s assessment was that, in a narrower sense, WhatsApp’s competitor is Viber, while Messenger is in close competition with Google Hangouts or Twitter.[98] The Commission was definitely right in its assessment that the logic underlying Google Hangouts and Messenger is the same: they are services that allow for exchanging direct messages and keeping in touch with those persons in a user’s network of contacts who use the given social media service (to whit, Google+ and Facebook). At the same time, it is a mystery why the Commission saw an intense competition between Messenger and Twitter, even though the latter provides a service that is completely different from the former.

The Commission’s conclusions concerning the differences in the data protection regulations are very controversial. In their analysis of the case, Clemens and Özcan looked specifically at consumer habits with respect to messaging services. The researchers divided potential users into two groups: one group does not care that data is being collected about them while the other will forgo the connection if it involves data being collected about them. This is why they concluded that if the provider does not collect data about its users from the very outset, it can continuously increase the number of users who thus become committed – and then, if there is a change in the data collection policy, users may be outraged but only a small percentage will actually quit the community.[99] There is no information available as to whether Facebook had such research insights at its disposal at the time when it acquired WhatsApp, which would have informed its decision going forward; what is certain, however, is that a knowledge of these insights renders the Commission’s observation in 2014, that there are major differences between the respective data protection policies of the two platforms, irrelevant.

Clemens and Özcan also conclude that the problem of data integration is not a competition law issue, and the authors are staunchly opposed to the notion of assessing data management issues in the framework of competition law.[100] On this point, however, we disagree with them – although data integration in and of itself is indeed a data protection rather than a competition law issue, the unification, augmentation and linking of databases can serve as a competitive advantage that benefits certain service providers, and they can affect the business activities of enterprises so massively that their impact must be considered in competition law procedures as well.[101] And although the Commission did weigh this aspect, ultimately it did not take it sufficiently into consideration.[102]

 

X The Competition Law Assessment of the Databases

As we already mentioned, at the end of 2013, WhatsApp had recorded an annual revenue of USD 10.2 million – along with a net loss of USD 138 million: ten times more loss than revenue. Is it a good investment to buy an unprofitable company? Or maybe we should ask why this was good investment. WhatsApp was Facebook’s largest acquisition by far, 20 times larger than Facebook’s acquisition of Instagram in 2012. Why did Facebook break the bank to buy WhatsApp?[103] As economic analyses have shown, the answer is user growth.[104] Overall, Facebook broke down the money it spent on WhatsApp as USD 2.026 billion for the user base.[105]

In 2014, over 500 million people used WhatsApp monthly and the service added more than 1 million users per day. 70% of WhatsApp users were active daily, compared to Facebook’s 62%. Additionally, WhatsApp users sent 500 million pictures back and forth per day, about 150 million more than Facebook users. The app launched in 2009 and as of 2020 it has 1.5 billion users. As of 2019, Facebook has 2.59 billion monthly active users. With a shared mission of enhancing global connectivity via internet services, the merging of forces will likely accelerate growth for both companies. For Facebook, user growth comes first and monetization later. WhatsApp has helped fuel Facebook’s growth in developing markets where internet connectivity is sparse but where WhatsApp is widely used. Facebook then gains access to these mobile user bases.[106]

It is no exaggeration to say that once the two databases have been linked, the data in them become significantly more valuable than they would be if the same data were kept in separate databases with two distinct providers. If we divide the users that Facebook Inc. won by its acquisition of WhatsApp into two groups, then we find that Facebook could have generated a surplus value from both groups in the database. With respect to the WhatsApp users who are at the same time also Facebook users, the parent corporation received additional information concerning their user behaviour, which will allow it to sell its advertising spaces to advertisers by arguing that they offer even more accurate and individually customised user profiles. But the database of users who are only WhatsApp users or who declined to have their user data linked is by no means worthless for the company, either: their personal data can be used to yield a surplus either by using them as a control group or by using them to render the general user profiles more accurate.

Although the Commission tangentially touched on this aspect of the underlying issue, it still concluded that the size of the database would not be a cause for concern, even in the event that Facebook would ultimately find a way to match and link the WhatsApp and Facebook user accounts since ‘the Transaction would only raise competition concerns if the concentration of data within Facebook’s control were to allow it to strengthen its position in advertising’[107]. In the market identified by the Commission, however, this could not actually happen because it includes a ‘sufficient number of alternative providers’ other than Facebook that also collect personal data (e.g. Google, Yahoo, AOL, Microsoft, Yelp or even Adobe), which means that even after this transaction there would be a sufficient number of online advertising service providers left in the market.[108] At the same time several commentaries criticised[109] the Commission’s failure to take into account that the databases at the disposal of these various corporations are not the same, and that they shield these from one another as confidential business information. For our part, we would like to add that, in our opinion – because the actual underlying market at issue in this case has been inadequately defined – Facebook’s database should not have been compared to the those of Yahoo, AOL, Microsoft, Yelp or Adobe, since they are the fruits of services that operate completely differently from Facebook.

It is further worth noting that in 2014 the Commission – despite the fact that a third party also filed a complaint – only submitted a request for information to Facebook Inc. Based on the information at our disposal, it did not substantially – from an IT perspective – examine whether Facebook Inc. might have had the technology – or might have at least had the capacity to attain it – that it could use to match and link the users in the databases of the two platforms. It is of course a question whether the scope of its authority to review such transactions, as it is defined in Article 13 of the Merger Regulation, can be interpreted expansively enough to extend to an information technology issue that is impacted by the merger in question. Still, one may legitimately ask why the Commission failed to obtain an IT assessment by independent experts and instead chose to decide a technical IT issue with a crucial impact on the merger exclusively based on the relevant statement by the organisation that was the subject of the review.

This is also relevant with respect to the process whereby the sanctions applied in this case were determined. As we previously noted, pursuant to Article 6 (3) of the Merger Regulation, the Commission may retract is decision approving the merger if said decision was rendered based on incorrect information and the corporation in question is deemed to be responsible for providing misinformation. Terminating the merger and restoring the status quo ante would presumably have been impossible three years after the merger. Based on the publicly available documents, the Commission did not even seriously entertain the possibility. Moreover, this was the first time since the entry into effect of the Merger Regulation in 2004 that the Commission had levied a fine in connection with the provision of incorrect or misleading information, which meant that this was the first time that Article 14 (1) a) of the Regulation had been applied in practice. An important element of that provision is that the corporation in question provided the incorrect information deliberately or negligently. That is why, in its decision concerning the fine, the Commission consistently referred to ‘at least negligently’ when writing about the provision of incorrect information by Facebook Inc.

From a competition law angle, the Commission found that it was sufficient to show, based on three criteria, that Facebook had acted ‘at least negligently’[110]. In determining the fine, the Commission only investigated whether Facebook Inc. had cooperated during the 2017 investigation. The Merger Regulation does not in fact provide that the Commission has to ascertain in its investigation whether it was intentional or negligent behaviour on the part of the company that resulted in the dissemination of incorrect or misleading information. In its assessment of the underlying behaviour, the Commission ultimately chose a sanction that did not affect the approval of the merger and was thus milder than a withdrawal of its previously issued approval. Nor did the Commission discuss in its decision on the fine how it would have adjudicated the merger application in 2014 if Facebook had not listed, among its promises at the time, that it had no intention of linking the two databases either at then or at any time in the future.

The Commission noted that, ‘albeit relevant, the incorrect or misleading information provided by Facebook, Inc. did not have any impact on the outcome of the Article 6(1)(b) Decision’.[111] In our opinion, this statement is a wrong decision: As we already noted, once the two databases have been linked, the data in them hold a significantly greater value than they would if the same data were kept in separate databases with two distinct providers. The formula works: more data, more information, more accuracy, greater impact on the users (or consumers or data subjects).

And as of 2020 we have learned – despite the difficulties in precisely estimating WhatsApp’s revenues, since Facebook does not release separate financial revenue information for its various business segments and subsidiaries – that the WhatsApp business model has never yielded high returns.[112] However, Facebook’s annual revenue was USD 70,697 million in 2019 – compared to USD 12,466 million in 2014 (the year of the acquisition).[113]

We do not claim that WhatsApp is the only reason behind the surge in Facebook’s revenue, but let us take a look at the most recent statistics (updated June 23, 2020) about WhatsApp:

– 1.5 billion users in 180 countries make WhatsApp the most-popular messaging app in the world (0.2 billion more than its peer in the market, Facebook Messenger);

– 1 billion daily active WhatsApp users;

– 3 million users of WhatsApp Business;

– 65 billion WhatsApp messages sent per day, or 29 million per minute;

– 3 million users of WhatsApp Business;

– 55 million WhatsApp video calls made per day, lasting 340 million minutes in total.[114]

In our opinion, the incorrect or misleading information provided by Facebook, Inc., had an impact on the outcome of the Article 6(1)(b) Decision.

In 2017, the EU Commissioner Margrethe Vestager, who is in charge of competition policy, announced that the European Commission has fined Facebook:

Today’s decision sends a clear signal to companies that they must comply with all aspects of EU merger rules, including the obligation to provide correct information. And it imposes a proportionate and deterrent fine on Facebook. The Commission must be able to take decisions about mergers’ effects on competition in full knowledge of accurate facts.[115]

We should note again in this context that Facebook had acquired WhatsApp for USD 19 billion in 2014. The European Commission imposed a fine on Facebook in the amount of EUR 0.11 billion. The Commission declared that it did not find it necessary to review the data protection implications of the merger, and that it had ‘analysed potential data concentration only to the extent that it is likely to strengthen Facebook’s position in the online advertising market or in any sub-segments thereof’. The Commission assessed specifically that any ‘privacy-related concerns flowing from the increased concentration of data within the control of Facebook as a result of the Transaction do not fall within the scope of the EU competition law rules but within the scope of the EU data protection rules’[116].

 

Conclusion

The Facebook/WhatsApp case has demonstrated that, in the event that data protection and competition law intersect, it does not appear sufficient to look at the merger solely from the angle of competition. The reason is that if we look at a merger only and exclusively as a transaction aimed at reducing competitive pressure in the market by buying up a competitor, the Commission’s decision can only be subject to potential criticism with respect to its definition of the market in question. However, if we also look at the competitive advantaged gained by linking the databases then the Commission’s decision can be disputed on the merits, too. The reason is that although the Commission declared that, from a data protection perspective, it did not see grounds for reviewing the transaction, the controversial question at issue in the context of the merger does not concern data protection but data assets. And the Commission should definitely have incorporated the issue of data asset management among the competition law considerations reviewed in the decision, because the question of how Facebook handles the personal data it accumulates in the performance of its service is indeed a data protection law issue; nevertheless, the question of what type of competitive market advantage the linked databases generate – personal information as a data asset and a non-material good – could have been examined from a competition law angle.

The big question is whether the new Digital Services Act package will make the issue of data asset management subject to the scope of competition law.


* Gábor Polyák is an associate professor at the University of Pécs’s (PTE) Faculty of Humanities as well as a researcher in the Big Data research group of the PTE’s Szentágothai János Research Centre (PTE SZKK).

** Gábor Pataki is a researcher in the Big Data research group of the PTE’s Szentágothai János Research Centre (PTE SZKK).

[1] The present study was written as part of the Hungarian Scientific Research Fund (OTKA) research project No 116551 entitled ‘Regulatory issues involving internet traffic control services’ (Az internetes forgalomirányító szolgáltatások szabályozási kérdései in Hungarian), and it is based on the results of this project. Furthermore, the authors also dedicate this study to the commemoration of the 650th anniversary of the founding of the University of Pécs.

[2] Commission launches consultation to seek views on Digital Services Act package – press release, Brussels, 2 June 2020.

[3] See <https://ec.europa.eu/digital-single-market/en/digital-services-act-package> accessed 6 June 2020.

[4] See <https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-synergies-between-civil-defence-and-space-industries> accessed 26 October 2020.

[5] First: A level playing field for comparable digital services; Second: Ensure responsible behaviour of online platforms to protect core values; third: Foster trust, transparency and ensure fairness on online platforms.

[6] COM(2016) 288 final, Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, Online Platforms And The Digital Single Market, Opportunities And Challenges For Europe {SWD(2016) 172 final}, 25.5.2016.

[7] Nicolo Zingales, ‘Between a Rock and Two Hard Places: WhatsApp at the Crossroad of Competition, Data Protection and Consumer Law’ (2017) 33 (4) Computer Law & Security Review 553–558.

[8] See Polyák Gábor, A frekvenciaszűkösségtől a szűrőbuborékig in Tóth András (ed), Technológia jog. Új globális technológiák jogi kihívásai (Károli Gáspár Református Egyetem Állam- és Jogtudományi Kar 2016, Budapest) 116–141.

[9] See <https://www.facebook.com/zuck/posts/10103831654565331> accessed 6 July 2020.

[10] On precisely the same day when the Commission issued its ruling against Google.

[11] According to USA Today, Zuckerberg has set the goal of reaching 5 billion Facebook users by 2030. Source: <https://www.usatoday.com/story/tech/news/2016/02/04/facebook-2030-5-billion-users-says-zuck/79786688/> accessed 6 July 2020.

[12] See <https://blog.whatsapp.com/245/Why-we-dontsell-ads?> accessed 6 July 2020.

[13] See <https://twitter.com/jankoum/status/503725598414368768> accessed 6 July 2020.

[14] It is worth noting here that over 2 billion people registered indirectly for Google social media service, Google+. The number of active users, however, is only ca. 10% of the total number of registered users – owing to the fact that the majority of Google users relies on the company’s mail and search services rather than its social media service.

[15] Ninety-seven percent of Facebook’s revenues stem from online advertising, while for Google’s parent company, Alphabet, the corresponding figure is 88%. Source: Evans, David S.: Why the Dynamics of Competition for Online Platforms Leads to Sleepless Nights But Not Sleepy Monopolies, 2017, 16 (available on SSRN at https://ssrn.com/abstract=3009438).

We write in greater detail about the potential profits that can be attained by making advertising activity behaviour-based and by profiling individual users in our other Hungarian Scientific Research Fund (OTKA) study entitled ‘Az internetes forgalomirányító szolgáltatások szabályozási kérdései’. See Szőke László Gergely, Pataki Gábor, ‘Az online személyiségprofilok jelentősége – régi és új kihívások’ (2017) (2) Infokommunikáció és Jog.

[16] See <https://www.vg.hu/velemeny/ne-legyen-jolly-joker-a-versenyjog-470216/> accessed 6 July 2020.

[17] Although the so-called DIKW pyramid (data, information, knowledge, wisdom) does not in and of itself allow for a legal interpretation of the concept because the data are just symbols that represent certain characteristics, the information does yield answers to ‘who, what, when, why’-type of questions as well, and in that context we should be talking about ‘information-dominant companies’. [For a more detailed discussion, see: Russell Ackoff, ‘From data to wisdom’ (1989) 16 Journal of Applied Systems Analysis 3–9.]

[18] Georg Clemens, Mutlu Özcan, ‘Obfuscation and Shrouding with Network Effects – The Facebook/WhatsApp Case, 2017, 2.’ (accessible on SSRN https://ssrn.com/abstract=3023467).

[19] See <http://www.oecd.org/competition/big-data-bringing-competition-policy-to-the-digital-era.htm> accessed 6 July 2020.

[20] See <http://www.oecd.org/competition/algorithms-and-collusion.htm> accessed 6 July 2020.

[21] Autorità Garante della Concorrenza e del Mercato, AGCM.

[22] See <http://www.agcm.it/en/newsroom/press-releases/2380-whatsapp-fined-for-3-million-euro-for-having-forced-its-users-to-share-their-personal-data-with-facebook.html> accessed 6 July 2020.

[23] Council Regulation No 139/2004/EC (20 January 2004) on the control of concentrations between undertakings (the EC Merger Regulation) OJ L 24, 29/1/2004, 1–22.

[24] Article 14(1) The Commission may by decision impose undertakings where, intentionally or negligently:

a) they supply incorrect or misleading information in a submission, certification, notification or supplement thereto, pursuant to Article 4 [Prior notification of concentration]

b) they supply incorrect or misleading information in response to a request made pursuant to Article 11(2) [Requests for information – the Commission may require the persons to provide all necessary information].

[25] The present study does not look at the implications of the merger in the United States. For more details on that subject see: https://www.epic.org/privacy/ftc/whatsapp/EPIC-CDD-FTC-WhatsApp-Complaint-2016.pdf> accessed 6 July 2020.

[26] Clemens, Özcan (n 18) 2.

[27] It is worth pointing out, however, that the linking and integration of online databases [or “datasets, to use the terminology proposed by Pál Belényesi] had been previously examined by the Commission, for example in the Microsoft/Yahoo! case in 2010. What makes the case at hand in this paper special is that those involved are social media service providers.

[28] Belényesi Pál, ‘Digitális platformok és a Big Data’ (2016) (1) Verseny és Szabályozás 147.

[29] Regulation (EC) No 139/2004 Merger Procedure, Case No COMP/M.7217 – Facebook/WhatsApp, paragraphs (2)–(3) [hereinafter: M.7217].

[30] M.7217, Paragraph (21).

[31] M.7217, Paragraph (30).

[32] M.7217, Paragraph (32).

[33] M.7217, Paragraph (34).

[34] M.7217, Paragraph (53).

[35] M.7217, Paragraph (54).

[36] M.7217, Paragraph (61).

[37] M.7217, Paragraph (75).

[38] M.7217, Paragraph (76).

[39] M.7217, Paragraph (79).

[40] Facebook Inc. acquired WhatsApp Inc. for USD 19 billion, of which 12 billion were paid in the form of Facebook shares, a further 3 billion were paid in the form of restricted stock units in Facebook, and a final 4 billion of the purchase price were paid in cash.

[41] M.7217, Paragraph (5).

[42] Article 1(2) While the Commission’s decision referred to a ‘Union dimension’, the text of the underlying Regulation refers to a ‘Community dimension’. For the sake of greater clarity and consistency, we decided to use the term which the Commission had used in its decision, since our study focuses on the latter. Nevertheless, the two are understood to be synonymous here.

[43] Concentration has a Community dimension where: (a) the combined aggregate worldwide turnover of all the undertakings concerned is more than EUR 5000 million; and (b) the aggregate Community-wide turnover of each of at least two of the undertakings concerned is more than EUR 250 million, unless each of the undertakings concerned achieves more than two-thirds of its aggregate Community-wide turnover within one and the same Member State.

(3) A concentration that does not meet the thresholds laid down in paragraph 2 has a Community dimension where: (a) the combined aggregate worldwide turnover of all the undertakings concerned is more than EUR 2500 million; (b) in each of at least three Member States, the combined aggregate turnover of all the undertakings concerned is more than EUR 100 million; (c) in each of at least three Member States included for the purpose of point (b), the aggregate turnover of each of at least two of the undertakings concerned is more than EUR 25 million; and (d) the aggregate Community-wide turnover of each of at least two of the undertakings concerned is more than EUR 100 million, unless each of the undertakings concerned achieves more than two-thirds of its aggregate Community-wide turnover within one and the same Member State.

[44] While the Commission’s decision referred to a ‘Union dimension’, the text of the underlying Regulation refers to a ‘Community dimension’. For the sake of greater clarity and consistency, we decided to use the term which the Commission had used in its decision, since our study focuses on the latter. Nevertheless, the two are understood to be synonymous here: <https://www.statista.com/statistics/412794/euro-to-u-s-dollar-annual-average-exchange-rate/> accessed 6 July 2020.

[45] According to Facebook Reports, the revenue was 7872 million U.S. dollars, which means 5920 million converted to EUR (exchange rate: 1,33 USD = 1 EUR). Facebook Reports Fourth Quarteer and Full Year 2013 Result: https://s21.q4cdn.com/399680738/files/doc_news/2014/FB_News_2014_1_29_Financial_Releases.pdf (6 July 2020); Exchange Rate: See <https://www.statista.com/statistics/412794/euro-to-u-s-dollar-annual-average-exchange-rate/> accesed 6 July 2020

[46] A concentration has a Community dimension where the combined aggregate worldwide turnover of all the undertakings concerned is more than EUR 5000 million and the aggregate Community-wide turnover of each of at least two of the undertakings concerned is more than EUR 250 million, unless each of the undertakings concerned achieves more than two-thirds of its aggregate Community-wide turnover within one and the same Member State.

[47] A concentration also has a Community dimension where the combined aggregate worldwide turnover of all the undertakings concerned is more than EUR 2,500 million; in each of at least three Member States, the combined aggregate turnover of all the undertakings concerned is more than EUR 100 million; in each of at least three Member States included for the purpose of point (b), the aggregate turnover of each of at least two of the undertakings concerned is more than EUR 25 million; and the aggregate Community-wide turnover of each of at least two of the undertakings concerned is more than EUR 100 million, unless each of the undertakings concerned achieves more than two-thirds of its aggregate Community-wide turnover within one and the same Member State.

[48] USD 10.21 million according to Statista.com (https://www.statista.com/statistics/346269/whatsapp-annual-revenue/, 6 July 2020) and techcrunch.com <https://techcrunch.com/2014/10/28/whatsapp-revenue/> accessed 6 July 2020.

[49] The Commission didn’t name the three Member States, see M.7217, Paragraph (10).

[50] M.7217, Paragraph (10)–(12).

[51] See <http://eur-lex.europa.eu/legal-content/HU/TXT/HTML/?uri=CELEX:C2014/297/04&from=HU> accessed 6 July 2020.

[52] Prior notification of a concentration (Case M.7217 – Facebook / WhatsApp) Text with EEA relevance, OJ C 297, 4.9.2014, 13–13.

[53] Question 5 of the questions sent by the Commission on 25 August 2014. (see Regulation (EC) No 139/2004 Merger Procedure, Case No COMP/M.8228 – Facebook/WhatsApp, Paragraph (60) [hereinafter: M.8228]).

[54] M.7217, Paragraph (138).

[55] M.7217, Paragraph (191).

[56] M.7217, Paragraph (190).

[57] M.7217, Paragraph (34).

[58] M.7217, Paragraph (157)–(158).

[59] M.7217, Paragraph (165).

[60] M.7217, Paragraph (170).

[61] M.7217, Paragraph (179).

[62] M.7217, Paragraph (164).

[63] M.7217, Paragraph (187).

[64] See <https://blog.whatsapp.com/499/Facebook> accessed 6 July 2020.

[65] See <https://blog.whatsapp.com/529/A-f%C3%A9lre%C3%A9rt%C3%A9sek-elker%C3%BCl%C3%A9se-v%C3%A9gett> accessed 6 July 2020.

[66] See <https://blog.whatsapp.com/615/A-WhatsApp-ingyeness%C3%A9-%C3%A9s-m%C3%A9g-hasznosabb%C3%A1-v%C3%A1lik> accessed 6 July 2020.

[67] See <https://blog.whatsapp.com/10000627/El%C5%91retekint%C3%A9s-a-WhatsApp-n%C3%A1l> accessed 6 July 2020.

[68] The number of users had reached the one-billion mark on 1 February 2016. <https://blog.whatsapp.com/616/Egy-milli%C3%A1rd> accessed 6 July 2020.

[69] The most widely known among European users is Instagram LLC, but there are also seven other companies in this group (The Facebook Companies <https://www.facebook.com/help/111814505650678> accessed 6 July 2020.

[70] See <https://faq.whatsapp.com/general/28030012?lang=hu> accessed 6 July 2020.

[71] We do not wish to perform a legal analysis of the statement of consent in our competition law study, but it still needs to be stressed that the consent to share one’s data was based on an opt-out rather than an opt-in basis, which was a violation of the European Union’s effective regulations on the subject.

[72] This is also a data protection issue, but European data protection law (which was governed by Directive 95/46/EC at the time) does not feature the institution of imposing a deadline on the possibility of retracting consent. The individual has the right to withdraw his or her consent at any time, and any limitation of this right by imposing a deadline on its exercise constitutes a violation of EU regulations.

[73] See <https://faq.whatsapp.com/hu/general/26000016> accessed 6 July 2020.

[74] M.8228, Paragraph (30).

[75] M.8228, Paragraph (49)–(50).

[76] M.8228, Paragraph (51).

[77] M.8228, Paragraph (38).

[78] Past Commission decisions in this regard were adopted under the 1989 Merger Regulation in accordance with different fine-setting rules. See e.g.: from 1999 Sanofi/Synthélabo, KLM/Martinair, Deutsche Post, from 2002: BP/Erdölchemie (M.2624), from 2004 Tetra Laval/Sidel (M.3255).

[79] See <https://ec.europa.eu/commission/presscorner/detail/en/IP_17_1369> accessed 6 July 2020.

[80] M.8228, Paragraph (41).

[81] M.8228, Paragraph (107).

[82] See <http://d18rn0p25nwr6d.cloudfront.net/CIK-0001326801/80a179c9-2dea-49a7-a710-2f3e0f45663a.pdf> p. 31. accessed 6 July 2020.

[83] USD 27,638 million.

[84] USD 276.38 million.

[85] The text of the regulation says that the maximum fine that can be assessed does not apply cumulatively for all violations but per violation found. Thus the amount was not a single fine of EUR 100 million but two concurrently levied fines of EUR 55 million each.

[86] See <http://europa.eu/rapid/press-release_IP-17-1369_en.htm> accessed 6 July 2020.

[87] M.7217, Footnote 2.

[88] M.7217, Paragraph (34).

[89] M.7217, Paragraph (20).

[90] Ayse Gizem Yasar, ‘Achieving Symbiosis between Disruptive Innovation and Merger Control: Challenges and Remedies’ 2017, 29. (accessible on SSRN: https://ssrn.com/abstract=3015007).

[91] Inge-Wahyuningtyas Graef, Peggy Sih Yuliana-Valcke, ‘How Google and others upset competition analysis: disruptive innovation and European competition law’ 25th European Regional Conference of the International Telecommunications Society (ITS) 2014, 13.; Viktoria Robertson, ‘Delineating Digital Markets under EU Competition Law: Challenging or Futile?’ (2017) 12 (2) The Competition Law Review 14–15.

[92] M.7217, Paragraphs (15), (56), (61), Paragraph (102).

[93] M.7217, Paragraph (107).

[94] M.7217, Paragraph (101).

[95] (102) using the paragraph numbering in Decision No. M.7217.

[96] See <https://newsroom.fb.com/news/2015/06/sign-up-for-messenger-without-a-facebook-account/> accessed 6 July 2020.

[97] M.7217, Paragraph (105).

[98] M.7217, Paragraph (106).

[99] Clemens, Özcan (n 18) 12.

[100] Clemens, Özcan, (n 18) 17.

[101] Several authors support this, see for example: Vicente Bagnoli, The big data relevant market as a tool for a case by case analysis at the digital economy: Could the EU decision at Facebook/WhatsApp merger have been different? Ascola Conference 2017. (accessible on SSRN: https://ssrn.com/abstract=3064795) or Samson Esayas, Competition in dissimilarity: lessons in privacy from the Facebook/WhatsApp merger. University of Oslo Faculty of Law Legal Studies, Research Paper Series, 2017/33.

[102] Giuseppe Colangelo, Mariateresa Maggiolino, ‘Big Data as Misleading Facilities. European Competition Journal, Forthcoming’ (2017) Bocconi Legal Studies Research Paper, 19. Ayse Gizem Yasar, ‘Achieving Symbiosis between Disruptive Innovation and Merger Control: Challenges and Remedies’ 1 June 2017, 29.

[103] The USD 19 billion paid by Facebook was well in excess of the last WhatsApp valuation, which had been made during the 2013 funding round. That appraisal had pegged WhatsApp’s value at USD 1.5 billion. The 2011 funding round had resulted in a WhatsApp valuation of USD 80 million. <https://www.businessofapps.com/data/whatsapp-statistics/#1> accessed 6 July 2020.

[104] Alison Deutsch L., ‘WhatsApp: The Best Facebook Purchase Ever?’ (2020) <https://www.investopedia.com/articles/investing/032515/whatsapp-best-facebook-purchase-ever.asp> accessed 6 July 2020.

[105] John Constine, ‘WhatsApp’s First Half Of 2014 Revenue Was $15M, Net Loss Of $232.5M Was Mostly Issuing Stock’ (2014) <https://techcrunch.com/2014/10/28/whatsapp-revenue/> accessed 6 July 2020.

[106] Deutsch L. (n 104).

[107] M.7217, Paragraph (187).

[108] M.7217, Paragraph (188).

[109] Allen P. Grunes, Maurice E. Stucke, ‘No Mistake about It: The Important Role of Antitrust in the Era of Big Data’ (2015) 14 The Antitrust Source 1; Inge Graef, EU Competition Law, Data Protection and Online Platforms (International Competition Law Series, Wolters Kluwer 2016, Alphen aan den Rijn) 249–279.

[110] M.8228, Paragraphs (86)–(89).

[111] M.8228, Paragraphs (100).

[112] Mansoor Iqbal, ‘WhatsApp Revenue and Usage Statistics (2020)’ <https://www.businessofapps.com/data/whatsapp-statistics/#3> accessed 6 July 2020.

[113] Facebook’s annual revenue from 2009 to 2019 <https://www.statista.com/statistics/268604/annual-revenue-of-facebook/> accessed 6 July 2020.

[114] Iqbal (n 112).

[115] See <https://ec.europa.eu/commission/presscorner/detail/en/IP_17_1369> accessed 6 July 2020.

[116] M.7217, Paragraph (164).