Privacy and competitiveness in the age of big data

Preliminary Opinion of the European Data Protection Supervisor Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy March 2014

Summary

EU approaches to data protection, competition and consumer protection share common goals, including the promotion of growth, innovation and the welfare of individual consumers. In practice, however, collaboration between policy-makers in these respective fields is limited.

Online services are driving the huge growth in the digital economy. Many of those services are marketed as ‘free’ but in effect require payment in the form of personal information from customers. An investigation into the costs and benefits of these exchanges for both consumers and businesses is now overdue.

Closer dialogue between regulators and experts across policy boundaries can not only aid enforcement of rules on competition and consumer protection, but also stimulate the market for privacy-enhancing services.

Preliminary Opinion of the European Data Protection Supervisor Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy

1. Introduction

1. The digital economy holds many advantages for consumers and citizens. Online services offer unprecedented scope for social connections, innovation and efficient problem-solving. At the same time, users of these services disclose masses of information about themselves. The volume and variety of data generated cannot be handled by traditional data mining and analysis technologies, but control of this information is now increasingly possible thanks to the development known as ‘big data’. Extracting value from big data has become a significant source of power for the biggest players in internet markets. Not all big data is personal, but for many online offerings which are presented or perceived as being ‘free’, personal information operates as a sort of indispensable currency used to pay for those services. As well as benefits, therefore, these growing markets pose specific risks to consumer welfare and to the rights to privacy and data protection.

2. EU principles and rules on data protection, competition and consumer protection have been designed to promote a thriving internal market and to protect the individual. Greater convergence in the application of these policies could help meet the challenges posed by the big data economy. However, to date, policies have tended to develop in parallel with little interaction on subjects of common concern. Moreover, EU policy makers and regulators have until now typically focused on markets for products and services traded in exchange for money. As consumers and businesses both adapt to and propel constant changes in technology, there is an onus on policymakers and regulators to keep pace, as reflected in the recent political commitment to the ‘completion’ of the ‘Digital Single Market’.

3. The EDPS promotes a ‘data protection culture’ in EU institutions and bodies where data protection principles find expression in all relevant areas of policy and law. As a contribution to that aim, this preliminary Opinion seeks to stimulate a dialogue between experts and practitioners, including EU institutions and national regulatory authorities from the competition, consumer protection and data protection fields. The EDPS will then reflect on the views and ideas arising from this exercise in a followup Opinion and include recommendations for action.

4. Chapter 2 of this Opinion begins by outlining trends in the digital economy and the role of personal data in the age of big data. Chapter 3 addresses the relevant aspects of EU rules on data protection, competition and consumer protection. Chapter 4 presents an analysis of the interrelations between the three policy areas:  how the control of personal information contributes to market power in the digital economy and the implications for data protection;  the risks to the consumer posed by concentrations and the abuse of market dominance where firms process massive amounts of personal data; and  how the growth of a vibrant market for privacy–enhancing services can be encouraged by strengthening informed consumer choice. The importance of joined-up thinking, enforcement and cooperation between supervisory authorities at international, EU and national level is also emphasised.

5. In conclusion, Chapter 5 looks ahead to possible policy responses, and invites the Commission, national supervisory authorities, advocacy groups and legal practitioners to engage in a broader and deeper discussion on this matter. At the start of each section, bullet points and cross references aim to guide the reader through the key arguments and intersections between the three areas of EU law. A summary of these interfaces is presented in the Annex to this document.

2. Big data, personal data: the fuel of the digital economy  Companies across all sectors of the economy rely on enormous volumes of personal data for developing services, but unlike other intangible assets, this is rarely accounted for  ‘Free’ online services are ‘paid for’ using personal data which have been valued in total at over EUR 300 billion and have been forecast to treble by 2020  Despite the risks to the personal data of individuals using these services, the market for privacy-enhancing services remains comparatively weak 2.1. Big personal data as an asset

6. The digital economy is marked by strong, dynamic growth, a high turnover of new services, market concentration involving a few overwhelmingly dominant players, and an ever greater imbalance between big companies on the one side, and SMEs and 7 individual users on the other side. This growth has been accompanied, in all sectors of the economy, by an exponential rise in the value of data and advances in data mining and analytics and a massive increase in computing power and data storage capacity.

7. According to a recent survey, 57% of businesses analysed consider themselves to be ‘managing big data’, in the sense of ‘very large datasets’ which can include ‘streaming data from machines, sensors, web applications and social media’. In a process which has been branded ‘datafication’, an estimated 2.3 trillion gigabytes of data are collected and combined with other data every day, the data themselves becoming the basis for services such as diverse as fitness trackers and global mapping. Big data is more than personal data: it includes aggregated and anonymous data. Companies may consider most of their data to be non-personal datasets, but in reality it is now rare for data generated by user activity to be completely and irreversibly anonymised. Masses of personal information are generated by over 369m internet users in the EU through their consumption of social media, games, search engines and e-commerce and other services. Information on subscribers to a given online service which is collected includes names, gender, personal preferences, location, email addresses, IP addresses and surfing history. This is used to invest in existing client relations and to acquire new clients.

8. Whereas previously data had been collected as part of the provision of a particular service, ‘the added value of big data,’ says one commentator, ‘resides in the potential to uncover new correlations for new potential uses once the data have been collected … [which] may have nothing to do with the original purposes for which the data were collected.’ Estimates of this added value vary according to context and methodology: revenues or net income per record/user for two global companies whose business models rely on personal data have been calculated at EUR 3-5 per year; while the digital value that EU consumers place on their data has been estimated at EUR 315 billion in 2011, forecast to rise to EUR 1 trillion by 2020.

9. The extent to which companies should be able to leverage and to monetise the personal datasets acquired has been the subject of some debate. Nevertheless, personal information has become a substantial intangible asset used for the purposes of value creation, comparable to copyright, patents, intellectual capital and goodwill. Often it is a company’s most valuable asset, as demonstrated by recent high profile initial public offerings on global stock markets and mergers in the digital economy. However, unlike other intangible assets, the value of the personal information under a company’s control does not seem to be accounted for on its balance sheet. 2.2. A currency for purchasing ‘free’ services

10. With many digital services like email or search engines which are used by almost every internet user, companies foster the perception that they are provided for free; in fact individuals are required to surrender valuable personal information to enjoy them. Consumers provide richly detailed information about their preferences through their online activities which permits individuals, not groups, to be targeted with far greater precision than ever before. For consumers, therefore, personal information operates as a currency, and sometimes the sole currency, in the exchange of online services. 2.3. Business models designed to capture value of big, personal data

11. A four-step ‘personal data value chain’ has been identified, consisting of (1) collection and access, (2) storage and aggregation, (3) analysis and distribution and (4) usage of personal datasets. Across this value chain, a multiplicity of individuals, businesses, public institutions and non-profit organisations might be expected to view and to process these datasets. This includes data brokers, who mediate trade in 19 personal information between one data controller and another, and cloud computing providers (for application and storage services).

12. Often companies rely on and exploit big data by operating on a two-sided or multisided platform or business model, cross-financing distinct services provided to two or more distinct user groups, that is, users of ‘free’ services on the one hand, and other businesses and especially advertisers, on the other. Through the supply of paymentfree services, these companies compete for the attention and loyalty of individuals whose use of those services will generate personal data with a high commercial value. They may discriminate between users with offerings scaling from free basic services to premium services which target those businesses which are willing to pay for 20 them.

13. More lucratively, these companies may sell the information collected to advertisers, often via data brokers, or purchase space for placing their ads next to search results. Advertising, consulting and statistical services depend on the information gathered by digital companies to create online user profiles which in turn enable more efficient behavioural targeting. This process is quite distinct from marketing approaches in the past, where adverts would for example be targeted at imperfectly segmented groups of TV viewers. 2.4. An underdeveloped market for privacy-enhancing services

14. Big data promises big benefits for society in sectors ranging from entertainment and transport to health and energy conservation; but where it involves personal data it also implies big risks for the individual to whom the information relates. Despite this heightened risk, the market for privacy-enhancing services in the digital economy remains weak. While many consumers may be becoming more and more ‘tech savvy’, most appear unaware of or unconcerned by the degree of intrusiveness into their searches and emails as information on their online activities is logged, analysed and converted into revenue by service providers. Thus far, relatively few companies in the digital economy have detected financial advantage in enhancing the privacy of their offerings.

3. Legal background  Separate rules on data protection, competition and consumer protection all converge around a two-fold purpose – the protection and promotion of the welfare of the individual and the facilitation of the creation of a single European market.  The purpose of competition rules is the efficiency of the internal market and the welfare of consumers, and appraisal of those rules must be placed within the general framework of the EU’s objectives and values  Consumer protection rules aim to prohibit misleading claims about products and services, particularly those marketed as ‘free’

15. The main objectives of the EU include its core values of promoting peace and the well-being of its peoples, and its economic mission, including an area of freedom without internal frontiers and an internal market where competition is free and undistorted. Rules adopted by the EU on data protection, competition and consumer protection, applying to economic operators and Member States, reflect those core values and economic mission in distinct ways and under separate legal bases in the Treaty on the Functioning of the European Union (TFEU). There are separate supervisory authorities at national and EU level, and compliance with one set of rules does not necessarily mean compliance with the other, nor does non-compliance with one set imply infringement of the other. The purposes of the three areas however converge, and that point of convergence is the focus of this section. 3.1. Data protection 3.1.1. The fundamental right to protection of personal data See also: Sections 3.2.1 (aims of EU competition rules) and 3.3.1 (requirement to ensure consumer protection)

16. The right to respect for private and family life, home and communications as laid down in Article 7 of the Charter of Fundamental Rights protects the individual primarily against interference by the state. Article 8 formulates the protection of personal data as a separate right. It goes beyond simply protecting against interference by the state. It is a proactive right which entitles the individual to expect that his or her information will only to be processed, by anyone and not only the state, if certain essential requirements laid down in Article 8 (2) and (3) are fulfilled. This requires that the processing is fair and lawful and for specified purposes, that it is transparent to the individual who is entitled to access and rectification of his/her information, and that the rights must be subject to control by an independent authority.

17. Article 16 TFEU requires rules to be laid down relating to data protection and to the free movement of such data in the internal market. Directive 95/46/EC (the ‘Data Protection Directive’), although adopted on another legal basis, is currently still the central piece of legislation under this article. It requires a balancing of the control of one’s personal information and the free movement of data in the internal market. The European Parliament and the Council are currently discussing the proposals for a new legal framework proposed by the Commission in January 2012. Within this framework, Directive 2002/28/EC, contains specific rules on privacy in relation to digital technologies and electronic communications services, noting in particular that ‘the successful cross-border development of these services is partly dependent on the confidence of users that their privacy will not be at risk’ (Recital 5).

18. Personal data as defined in Article 2(a) of Directive 95/46/EC means 'any information relating to an identified or identifiable natural person'. This includes any information which refers to the identity, characteristics or behaviour of an individual or which is used to determine or to influence the way in which that person is treated or evaluated. Identities may be disguised through various techniques, such as keycoded data, but it is usually possible to trace back such ‘pseudonymised’ information to the individual, and therefore data protection laws will still apply. All individuals as data subjects benefit from this legal protection, whether or not they are deemed to be a consumer of a particular service. In some cases legal persons may also benefit from the protection, for example where the official title of the legal person or other information identifies one or more natural persons.

19. The right to the protection of personal data is not an absolute right but ‘must be considered in relation to its function in society’. Under Article 52(1) of the Charter, limitations may be imposed on the exercise of these and other rights so long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others. 3.1.2. Persons subject to obligations under data protection rules See also: Section 3.2.2 Scope of application of competition rules.

20. In the interests of ensuring a level playing field, EU data protection law applies equally to all data controllers established in the EU or using equipment situated in the EU. Under the Commission’s proposed general data protection regulation, the territorial scope of the EU’s rules would be extended to any data controller ‘offering goods or services’ and ‘monitoring [the] behaviour’ of data subjects residing in the EU. This clarification seems appropriate in the light of the global exchanges of information which characterise the digital economy. A comparison may be made to EU competition rules which apply wherever an undertaking’s conduct could affect the internal market, irrespective of its place of establishment (see paragraph 32).

21. All businesses which are data controllers are subject to obligations to protect personal data, irrespective of their size or even dominant position in a market. However, as has been noted recently by the European Court of Human Rights, ‘The greater the amount and sensitivity of data held and available for disclosure, the more important [is] the content of the safeguards to be applied at the various crucial stages in the subsequent processing of the data.’ Many data protection provisions can therefore be considered scalable in proportion to the volume, complexity and intrusiveness of a company’s personal data processing activities, and are therefore of particular relevance to 35 powerful, big data-managing companies. This is analogous to the concept of the ‘special responsibility’ on the part of dominant undertakings to avoid distortions to competition in the internal market, as will be discussed below (see paragraph 33). 3.1.3. Legitimate and compatible purposes for data processing See also: Section 3.2.3 Definition of the relevant market

22. Article 6 (1) (b) of the Data Protection Directive provides that personal data must be ‘collected for specific, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.’ This purpose limitation principle is necessary in order to ensure trust, predictability, legal certainty and transparent use of personal data by data controllers. Further processing for a secondary purpose is not forbidden, but the secondary purpose must not be ‘incompatible’ with the purposes for which the data have been collected. Distinguishing between compatible and incompatible processing of personal data is often a complex and delicate exercise in data protection law. While the directive does not necessarily prohibit processing for different purposes, the Article 29 Working Party recommended that compatibility should be assessed in the light of the context in which the data were collected, of reasonable expectations of the data subjects, of the nature of the personal data in question, of the impact of further processing, and of safeguards to protect the data subject.

23. The concept of compatibility may be compared with that of substitutability, which is used in the application of competition rules to determine which products may be considered to be competing in the same market. In the context of the digital economy, it is conceivable that a company might collect data for the purpose of providing a certain service in one market, and further process those data in order to compete in the provision of another service in a separate market (see paragraph 58). 3.1.4. Consent and the rights to information, to access to data and to data portability See also: Sections 3.2.4 (Consumer welfare in application of competition rules) and 3.3.2 (Obligation to provide accurate information to customers)

24. Personal data processing requires a legal basis. One such basis is the freely-given, unambiguous and informed consent of the data subject to the specific processing operation. Mere silence or inaction, such as in the case of default settings of online social networks or web browsers, is not valid. Consent should be requested prior to the data processing and only after the data controller has given notice to the data subject of the processing operations in clear and understandable language. It may be withdrawn, in which case any personal data pertaining to the data subject should be 39 erased unless there is another legal basis that justifies continued storage of the data.

25. Individuals are entitled to be told about the processing of their personal information, including the identity of the controller, the purpose(s) of the processing, the recipients of the data, as well as their rights as data subjects. Under Article 12 of the Data Protection Directive, they have the right to access the data relating to them and to obtain rectification, erasure or blocking of the data where it is incomplete or inaccurate. The proposed reform envisages (Article 18) extending this right to enable the data subject to obtain a copy of data being processed electronically, including for example social network profiles, purchase and search histories, and to transmit them to another automated processing system.

26. This right to data portability would allow users to transfer between online services in a similar way that users of telephone services may change providers but keep their telephone numbers. In addition, data portability would allow users to give their data to third parties offering different value-added services. By way of illustration, if applied to smart metering it would enable customers to download data on their energy usage from their existing electricity supplier and then to hire a third party able to advise them whether an alternative supplier could offer a better price, based on their patterns of electricity consumption. Such transparency enables individuals to exercise their other data protection rights and may be seen to mirror the objective of rules on the provision of clear and accurate information to the consumer (see section 3.3.2). 3.1.5. Supervision, enforcement, sanctions and access to remedies for infringements See sections 3.2.5 and 3.3.3 on supervision etc.

27. Article 8(3) of the Charter asserts that the rules laid down ‘shall be subject to control by an independent authority’. Article 16 (2) TFEU provides for the laying down of rules on data protection whose compliance is to be ‘subject to the control of independent authorities’. Article 28(1) of Data Protection Directive duly requires EU Member States to provide for one or more public authorities to act with complete independence in the monitoring of the application of the directive. Data protection authorities’ tasks include dealing with complaints and conducting investigations. They may order the blocking, erasure or destruction of data and temporary or definitive bans on processing.

28. Every person has the right to a judicial remedy for any violation of the rights guaranteed under the directive (Article 22) and to receive compensation for any damage suffered as a result of unlawful data processing (Article 23). The sizes of potential sanctions for breaches vary widely between Member States: the lower limit in Croatia is HRK 10 000 (EUR 1 131), while the UK authority may require penalties of up to GBP 500 000 (EUR 597 000). In practice victims of unlawful processing are prevented from obtaining redress through the length and expense of proceedings and lack of unawareness of data protection rules and rights, although there have been some encouraging developments. The Regulation proposed by the Commission also envisages administrative sanctions as a proportion of a company’s annual turnover which would be applicable in the case of breaches of data protection obligations, such as unlawful disclosure to another organisation. This appears to follow the approach to sanctions applicable in the case of anti-competitive agreements (see paragraph 45 below).

29. Unlike for merger cases under competition rules (see paragraph 52 below), where a data protection problem arises affecting individuals in more than one Member State, the company in question may currently be subject to investigation by several national authorities with often diverging outcomes. National authorities convene as an independent advisory body known as the Article 29 Data Protection Working Party, whose tasks include promoting a uniform application of the general principles of the Data Protection Directive, but which has no formal role in enforcement. Measures for ensuring consistency have therefore been envisaged in the proposed General Data 45 Protection Regulation whereby only one authority would be responsible for taking legally binding decisions against a company, authorities would be obliged to cooperate and a new European Data Protection Board would consider matters with an EU-wide impact. 3.2. Competition 3.2.1. Aims of EU rules on competition See Sections 3.1.1 (Fundamental right to data protection) and 3.3.1 (Requirement to ensure consumer protection)

30. Competition law concerns the behaviour of companies and abuse of market power. It has long been of central importance to the EU and has evolved through several phases: it initially functioned as a means of preventing public obstacles to interstate trade, and now it seeks to ensure necessary controls of corporate mergers and liberalisation of sectors of the public economy. Its principal aims are to enhance the efficiency of the internal market and the welfare of and choice available to consumers. It has even been argued that the ultimate purpose of competition law is to ensure that the internal market will satisfy all reasonable wishes of consumers for competition, including not only the wish for competitive prices but also the wish for variety, innovation, quality and other non-price benefits, including privacy protection.

31. To these ends, Articles 101-106 TFEU prohibit agreements between companies which would prevent or distort competition, seek to prevent abuse of a dominant position, and require the Commission to investigate cases of suspected infringement of the principles of competition. Articles 107-109 TFEU also aim to ensure a level playing field across the internal market by preventing preferential treatment by Member States to certain companies. The EU is able to adopt appropriate regulations or directives in the application of these principles and rules (Articles 103, 106 and 109), of which the most significant are Council Regulation (EC) No 1/2003 (the ‘Modernisation Regulation’), which decentralised application of competition rules to national authorities, and Council Regulation (EC) No 139/2004 (the ‘Merger Regulation) along with Implementing Regulation (EU) No 1269/2013 which contain the main rules and procedures for the assessment of concentrations. 3.2.2. Scope of competition rules and market power See also: 3.1.2 Persons subject to data protection obligations

32. EU competition rules apply wherever any ‘economic activity’ may ‘affect trade between Member States’; its scope is not bounded by the place of establishment of a 50 given company. Enforcement of these rules often involves an assessment of the market power of a given undertaking and of whether the undertaking occupies a dominant position. The Commission evaluates market power and market structure through an assessment of market share, that is, the relative importance of the various undertakings active on the market. The usual determinant in the assessment of market share is company turnover, or volume or value of total sales of the relevant product in the relevant area. Market share is then interpreted in the light of the specific conditions of the market: for measuring market share in one specific sector relevant to the digital economy, Commission guidelines recommend the selection of whichever criteria are most appropriate in the light of the characteristics of the market.

33. Market dominance becomes likely, though not inevitable, where an undertaking’s market share equals or exceeds 40%. The Commission also considers barriers to expansion or entry into the relevant market, listing as examples economies of scale, privileged access to essential inputs, and costs or other impediments to customers switching to new suppliers. Case law has established that a dominant undertaking has a ‘special responsibility’ not to conduct itself in such a way that harms competition: it may seek to protect its own interests under attack from competitors but not to strengthen its dominant position. 3.2.3. Definition of the relevant market See 3.1.3 Legitimate and compatible purposes for data processing

34. The definition of the relevant market is the first stage in the legal analysis of cases of anti-competitive agreements, mergers and abuse of dominant market position. This allows competition regulators to identify the market operators, that is, suppliers, customers and consumers, and to calculate the total market size and the market share of each supplier with reference to the relevant product or service in the relevant area. This exercise in general considers three variables: a. the product market, including products and services which are considered by consumers to be interchangeable or substitutable; this consideration includes supply side substitutability, that is, the possibility of switching on the production side; b. the geographic market, the area where generally similar competition conditions prevail which are distinct from neighbouring areas; and c. a time horizon, reflecting the changes in consumer habits and technological developments.

35. The Commission, in determining substitutability, has some flexibility in this area. It considers not only product characteristics and intended use but also other factors, including the views of customers and competitors, evidence of customer preferences and the existence of different categories of customers for the product. 3.2.4. The notion of consumer welfare in the application of competition rules See sections 3.1.4 (Consent and rights to information etc.) and 3.3.2 Obligations of fairness and accurate information)

36. Consumer welfare has not been defined in EU law and its relationship with market 59 efficiency is not commonly understood. The European Court of Justice has rarely referred to consumer welfare in its judgments on competition cases. That said, as the Commission recognises in its guidelines on enforcement of rules on abuse of 61 dominance, welfare is determined not only by price, but also by other factors, such as quality and consumer choice, which is also a relevant concern for data protection. In addition, concern for the interests of the consumer recurs, at least at a conceptual level, in each major branch of competition law, namely: a. the prohibition of anticompetitive agreements; b. combating abuse of a dominant market position, through exclusionary conduct (such as refusal to supply a product or service which is necessary to compete) or exploitation; c. control of mergers; and d. control of state aid. a) Anticompetitive agreements

37. Article 101 TFEU prohibits agreements between undertakings, which affect trade between Member States and whose object or effect is the prevention, restriction or distortion of competition. Certain agreements are permitted where they contribute ‘to improving the production or distribution of goods or to promoting technical or economic progress, while allowing consumers a fair share of the resulting benefit’ in line with the conditions of Article 101(3) TFEU. b) Abuse of market dominance: exclusionary conduct, refusal to supply, essential facilities and exploitation

38. Dominance in competition terms involves the ability to determine prices and to control production in a given market. Dominance in a relevant market does not in itself constitute an infringement of competition rules. However, the abuse of a dominant market position which affects trade between Member States is prohibited under Article 102 TFEU. Such abuse has tended to be understood as taking one of two forms: i. exclusionary conduct, where a dominant undertaking excludes actual or potential competitors by means other than competing on the merits of the products or services they provide; and ii. exploitation, or action which ‘directly’ harms consumers through, for example, charging excessively high price. The Commission has issued enforcement guidance in relation to exclusionary conduct by dominant undertakings.

39. Exclusionary conduct is abusive where it results in ‘foreclosing [the dominant undertaking’s] competitors in an anti-competitive way’ and therefore potentially damages the competitive market structure. The Commission’s guidance identifies specific forms of exclusionary conduct, namely, exclusive dealing, tying and bundling, predation and refusal to supply and market squeeze. Examples may involve selling at such a low price to customers that other firms are deterred from entering the market (bundling), or obliging the customers of one popular service to purchase another of the seller’s services which the customer has not requested (tying). Such actions are deemed to be ‘most harmful to consumers’ and to have ‘adverse impact on consumer welfare’, although there is no explanation of how or why this might occur.

40. One form of exclusionary conduct, refusal to supply, contains the concept of an ‘essential facility’. An essential facility is ‘a product or service that is objectively necessary to be able to compete effectively’ and for which there is no alternative product or service and where technical, legal or economic obstacles make it impossible or unreasonably difficult to develop an alternative. ‘Refusal to supply such a facility is likely to lead to elimination of effective competition’ or to consumer harm. Consumer harm is likely to arise, ‘for instance… where the competitors that the dominant undertaking forecloses are, as a result of the refusal, prevented from bringing innovative goods or services to the market, and/or where follow-on innovation is likely to be stifled,’ particularly where the competitor ‘intends to produce new or improved goods or services for which there is a potential consumer demand or is likely to contribute to technical development.’

41. Abusive exploitation which most obviously could harm the consumer, such as the application of excessive prices or unfair discrimination, has not been addressed by means of Commission guidance. It has rarely been confronted by competition authorities and in most cases of exploitation the ‘victims’ have been companies, not end consumers. Case law however has established that excessive pricing would be charging a price which has no reasonable relation to the economic value of the product supplied. The CJEU also set out a two-stage test in accordance with which the Commission is required to determine whether: (a) the amount of the profit margin is excessive by comparing the disputed price with production costs and, if so, whether (b) the price is either (i) unfair in itself or (ii) unfair when compared to competing products. c) Merger control

42. Council Regulation (EC) No 139/2004 (‘the Merger Regulation’) applies to mergers with a ‘Community dimension’, which bring about ‘significant structural changes, the impact of which on the market goes beyond the national borders of any one Member State’. A merger with a Community dimension falls within the scope of the Regulation and is accordingly appraised by the Commission if the aggregate turnover of the combined undertakings exceeds specified thresholds. The EU merger control regime has the aim of controlling corporate concentrations (more commonly referred to as ‘mergers’ or ‘mergers and acquisitions’) and their effect on competition, also taking into account other factors including the ‘interests of intermediate and ultimate customers’. In the Google/DoubleClick case, the Commission affirmed that it had referred ‘exclusively’ to the likelihood that the merger would impede effective competition in the common market, although it also noted that its decision was without prejudice to the merged entity’s obligations under the Data Protection Directive. d) Exemptions to state aid

43. Under Article 107 TFEU, state aid is defined as any transfer of Member State resources which creates a selective advantage for one or more business undertakings, has the potential to distort trade between in the relevant business market and affects trade between the Member States. Such practice is unlawful, but a number of exemptions apply, for example in the case of environmental protection where undertakings may lack incentives to reduce their pollution due to the cost of doing so. A conceivable case could be advanced for state aid to support the nascent industry for privacy-enhancing technologies and services in the EU. 3.2.5. Supervision, enforcement, sanctions and access to remedies for infringements See sections 3.1.5 and 3.3.3 on supervision etc.

44. Competition rules are enforced either by national competition authorities or by the Commission. For mergers, this depends on whether there is a Community dimension. For anticompetitive agreements or abuse cases, the authority which is ‘well–placed’ will deal with the case in question. Competition authorities may take broader policy considerations into account. In this connection, the Commission is required under the Treaties (Article 2 TEU and Article 2 TFEU) to ‘place its appraisal within the general framework’ of the EU’s objectives and values, which includes of course the rights to privacy and to data protection. Competition authorities have appeared to favour a narrow interpretation focusing on objective economic efficiencies in a competitive internal market, though consumer welfare considerations may be ‘in the ascendancy’.

45. The rules are backed up by a robust sanctions regime. For example, an undertaking found to have infringed rules on anti-competitive agreements may be liable to a fine 82 of up to 10% of its total group turnover in the preceding business year. However, there is currently no harmonisation of rights for consumers either collectively or individually to seek before a court an end to an infringement of competition rules or compensation following such an infringement, though such claims may be brought 83 before national courts.

46. The European Competition Network acts as a forum for discussion and cooperation between regulatory authorities in cases where Articles 101 and 102 TFEU are applied. It aims to ensure an efficient division of work and an effective and consistent application of EC competition rules. The network includes groups of experts in specific sectors including IT, information and communication. 3.3. Consumer protection 3.3.1. The requirement to ensure a high level of consumer protection See sections 3.1.1 (fundamental right to data protection) and 3.2.1 (aims of EU competition rules)

47. EU consumer protection law aims to remove barriers to the internal market by building trust in products and services throughout the internal market, on the basis of transparency and good faith. Article 38 of the Charter requires EU policies to ensure a high level of consumer protection. Article 12 TFEU requires consumer protection to be taken into account in defining and implementing EU policies and activities generally. Article 169 TFEU states that the EU should contribute to the protection of the health, safety and economic interests of consumers and to the promotion of their right to information, to education and to organise themselves to safeguard their interests.

48. The EU has duly adopted various measures for the protection of users of products and services wherever in the internal market they are supplied or consumed. Each measure has been justified on the grounds that diversity of standards and consumer confidence has a deleterious effect on the smooth functioning of the internal market and distorts competition, whereas common standards, choice and fairness are beneficial. The most recent multi-annual programme of action highlights the need for accurate information and market transparency, the promotion of consumers’ welfare in relation to price, choice, quality, diversity, affordability and safety and the protection of consumers from potential risks. 3.3.2. Obligations of fairness and provision of accurate information See sections 3.1.4 (consent and right to information etc.) and 3.2.4 (consumer welfare in competition rules)

49. In consumer contracts, suppliers have the advantage in defining terms which are not negotiated with individual customers. The Directive on Unfair Contract Terms therefore introduced the notion of ‘good faith’ and required contract terms to be drafted in plain and intelligible language, with any doubt about the meaning of a term to be interpreted in favour of the consumer. Under the Price Indication Directive traders are required to provide the selling price in a way that is easily identifiable and clearly legible. The Consumer Rights Directive goes further in its aim to eliminate hidden charges and costs in ‘off-premises’ transactions, particularly those over the internet, such as where individuals are deceived into paying for services presented as ’free’. It requires traders to inform customers in a ‘clear and comprehensible manner’ of the ‘total price of the goods or services… or where the nature of the goods or services is such that the price cannot reasonably be calculated in advance, the manner in which the price is to be calculated….’ (Article 6 (e)). More specifically traders are 90 required to provide information on the content of digital services such as their compatibility with hardware and software.

50. The Unfair Commercial Practices Directive defines misleading commercial practice as that which omits information (including price) that the average consumer needs to take an informed transactional decision and which thereby causes, or is likely to cause, the average consumer to take a transactional decision that he would not have taken otherwise. Such a misleading omission would include instances where a trader ‘hides or provides in an unclear, unintelligible, ambiguous or untimely manner such material information … or fails to identify the commercial intent of the commercial practice if not already apparent from the context’ (Article 7). It is misleading for example to describe a product as ‘free’ or ‘without charge’ when the consumer has to pay anything other than the unavoidable cost of responding to the commercial practice and collecting or paying for delivery of the item, or falsely to create the impression that the trader is not acting for purposes relating to his trade, business, craft or profession (Annex I). This is complemented by the Misleading and Comparative Advertising Directive, which requires Member States to take steps to combat misleading advertising and permits comparative advertising on condition that it is objective and does not create confusion between traders and competitors.

51. Finally, the EU has put in place general and sector-specific safeguards against risks to consumer health and safety. The General Product Safety Directive defines as ‘safe’ any product which ‘under normal or reasonably foreseeable conditions of use… does not present any risk or only the minimum risks compatible with the product's use, considered to be acceptable and consistent with a high level of protection for the safety and health of persons, taking into account … in particular: (i) the characteristics of the product… (iii) the presentation of the product… (iv) the categories of consumers at risk when using the product, in particular children and the elderly’.

52. The provision of clear information about the cost and value of a service to the customer is thus consistently emphasised in the various instruments. This mirrors the right of the individual under the Data Protection Directive to obtain information on data processing ‘in an intelligible form’. The concern for product safety, meanwhile, complements both the concept of the exploitation in competition law and the stress in the proposed General Data Protection Regulation on impact assessment, and subsequent discussions on a progressive risk-based approach and on the principle of accountability. 3.3.3. Supervision, enforcement, sanctions and access to remedies for infringements See sections 3.1.5 and 3.2.5 on supervision etc.

53. National authorities are responsible for enforcement of consumer protection rules in the EU. Few authorities have the power to obtain monetary compensation for customers.

54. There is no common EU approach to investigation of breaches of consumer law, except in the case of ‘intra-Community infringements’, that is, any act or omission that ‘harms, or is likely to harm, the collective interests of consumers residing in a Member State or Member States other than the Member State where the act or omission originated or took place’. For that purpose Member States are required to designate competent authorities with a duty to cooperate with each other to ensure compliance with those rules, the smooth functioning of the internal market and the protection of consumers' economic interests. These authorities have the right to investigate suspected intra-Community infringements, to request that the seller or supplier concerned cease the infringement and to require a ‘payment’ from ‘the losing defendant’ in the event of failure to comply with a court decision.

55. National authorities in the European Economic Area form the Competition Protection Cooperation (or ‘CPC’) Network which each year identifies common enforcement priorities and carries out concerted enforcement activities including simultaneous checks on compliance with consumer rules, including joint projects on specific sectors. This framework for cooperation is currently under review.

4. Interfaces between competition law, consumer protection and data protection  The market for free services in an increasing number of sectors of the digital economy has yet to be analysed but clearly power is achieved through control over massive volumes of data on service users  The scope for abuse of market dominance and harm to the consumer through refusal of access to personal information and opaque or misleading privacy policies may justify a new concept of consumer harm for competition enforcement in digital economy.  Application of competition rules to digital markets has potential to promote privacy-enhancing services and greater consumer control over their own data

56. The previous section has outlined the main features of data protection, competition and consumer protection rules where common concerns emerge. The present section brings a sharper focus to four aspects of this policy convergence against the background of these markets for services relying on personal information. It is argued that in these areas privacy and the protection of personal data should be considered not as peripheral concerns but rather as central factors in the appraisal of companies’ activities and their impact on competiveness, market efficiency and consumer welfare. 4.1. Relevant markets and market power in the digital economy See sections 3.1.3 (legitimate and compatible purposes for data processing) and 3.2.3 (definition of the relevant market) 4.1.1. Markets for services paid for by personal information

57. A full market analysis for any of the ‘free’ digital services has yet to be carried out. In the Commission’s analysis of the Google/ DoubleClick merger, only paid-for services, that is, direct sale of online advertising space, intermediary services in online advertising and provision of display ad serving technology, were identified as relevant. Since that case was closed, the evolution of the digital economy has been marked by an explosion of data collection. An equivalent, relevant market analysis today would examine new business models and assess the value of personal information as an intangible asset. It could be expected to reveal the need for undertakings to collect huge amounts of data to be able to monetise the service provided, mainly through advertising, and at the same time to compete with other paid-for service providers.

58. A competition analysis might also consider the substitutability of products and services, taking into account the views of customers and competitors and evidence of customer preferences, in line with existing Commission guidelines. Powerful suppliers of various digital services may initially collect personal data on a massive scale in one market to provide a certain service in that market. One of these suppliers could then process these data, which in competition terms could be defined as input, to supply another service and/or sell the data for processing by another firm which provides services in another distinct market. If, according to the analysis, the 'second' type of service using the data as an input belongs to a separate market, then this service would be deemed non-substitutable with the service for which the data were originally collected. Thus, competition analysis could support the conclusion, from a data protection perspective, that data are being processed for separate and possibly incompatible purposes unbeknown to the individuals who have supplied the data. Such a conclusion could be more evident in cases where the two types of services are perceived by customers to be very different. The application of competition rules could therefore help highlight instances of breaches of data protection law.

59. The analysis would need to take account of the speed of evolution in technology markets. Company expansion and broadening of their range of services can blur the borders between markets. Technological convergence has turned hitherto complementary products into substitutes: hand-held devices for example now compete directly with laptop and desktop computers, which was not the case 10 years ago. Furthermore, geographic markets in the digital economy can be elusive as certain services, such as search, email and file sharing, are not confined to a particular area or state but rather homogeneously available throughout the global online environment. 4.1.2. Measuring digital market power

60. Having defined relevant markets for these services, the next stage would be the assessment of market power. Power in the digital economy is partly driven by the degree to which a given undertaking can actually, potentially or hypothetically collect and diffuse personal information. Measuring control of personal information would be a challenging exercise. A relevant market share held by a provider of a free online service cannot easily be calculated by reference to data on traditional sales or volume. These difficulties could be surmounted if competition, consumer protection and data protection authorities were to collaborate in identifying scenarios and in developing a standard for measurement of market power in this area. This standard could then be used to assess suspected infringements in the three areas.

61. Whether or not breaches of both competition and data protection rules were to be established, a deeper appreciation of these markets and of the purposes for which personal information is processed would benefit enforcement. Better informed regulators would be better able to detect practices by dominant market players which are anti-competitive, unfair or which fail to provide accurate information to the consumer. The implications for consumer welfare should therefore become clearer. If regulators fail to acknowledge the increasing importance of personal information as an intangible asset, more and more services reliant on mass personal data processing could in effect be ‘ring-fenced’ outside the scope of enforcement of consumer protection and competition rules. 4.2. Digital market power and consumer welfare considerations 4.2.1. Appraisal of mergers See section 3.2.4 (c) (merger control)

62. Under the Merger Regulation, authorities verify whether the concentration would trigger dynamics which could cause a ‘significant impediment to effective competition’. If market power in the digital economy can be measured according to control of commercialisable personal information (see above 4.1.3), then merger decisions could in turn take account of the market effects of combining these capabilities.

63. So far the most significant Commission decision on a merger among undertakings in the digital economy concerned Google and DoubleClick. The Commission, applying the threshold calculation criteria, determined that the merger lacked a Community dimension. The case was nevertheless examined by the Commission upon referral by parties to the concentration, it being capable of being reviewed under the national laws of several Member States. Google was at the time reported to command a near monopoly of search in Europe, and described the nature of its 106 business as the provision of web search, as well as advertising. The Commission however disregarded the search market, and rather considered Google’s product market to be ‘active mainly in the provision of online advertising space’. Analysing the extent to which the combination of the two undertakings’ databases on customer search and web-browsing behaviour would affect competition in the relevant market, the Commission concluded that the combination would not create ‘a competitive advantage in the advertisement business that could not be replicated by other players that have access to similar web-usage data.’

64. With such a purely economic approach to the case, the Commission did not consider how the merger could have affected the users whose data would be further processed by merging the two companies’ datasets, conceivably to provide services, perhaps bundled or even tied to the simple search service, that were not envisaged when the data were originally submitted. The decision did not refer to consumer welfare nor to the users of Google’s search engines, even though this potentially implicated every internet user in the EU. It therefore neglected the longer term impact on the welfare of millions of users in the event that the combined undertaking’s information generated by search (Google) and browsing (DoubleClick) were later processed for incompatible purposes.

65. The Commission did analyse the effect on consumers, however, in two subsequent decisions concerning companies in the digital economy. Assessing the proposed acquisition of Tele Atlas (supplier of digital map databases) by TomTom (producer of portable navigation devices and supplier of GPS software), the Commission considered a theory of competitive harm and protection of client ‘confidentiality’, concluding that the merged entity would likely have incentives to mitigate any 107 concerns which could lead to losing customers to competitors. In the case of Microsoft’s proposed purchase of Yahoo!’s internet search and search advertising businesses, the Commission considered Microsoft’s increased ability, postacquisition, to leverage its market power when negotiating distribution agreements, through for example bundling of products. It concluded that potential for significant harm to users of Yahoo!’s internet search services was unlikely. 4.2.2. Access to markets and input by competitors See sections 3.1.3 (Legitimate and compatible purposes for data processing), 3.1.4 (consent and rights to information etc.), 3.2.4 (b) (abuse of market dominance) and 4.1.3 (measuring market power)

66. In digital two-sided markets, such as the provision of multiple ‘free’ services in order to collect data coupled with the provision of online behavioural advertising space, marginal costs of supplying online services in a new market are low, and there is a distinct tendency towards tying of services (see paragraph 39). Powerful or dominant undertakings are able to exploit ‘economies of aggregation’ and create barriers to entry through their control of huge personal datasets alongside proprietary software which organises the data. The information could in theory be considered an essential facility in a particular digital market (paragraph 40): the dominant undertaking has exclusive control of the information, while competitors lack the technical means to recreate the structure or system upon which the service relies. This effectively prevents entry to the market and restricts consumer choice for the ‘free’ services in question. At the same time, costs for the advertising market increase due to lack of competing offers.

67. Access to personal information could legally be granted to competitors on the basis of consent or other legitimate grounds, but this is a substantial hurdle under data protection law (see section 3.1.4). A dominant undertaking could thus seek to justify its refusal to supply competitors with datasets, including through exclusivity agreements, by claiming to adhere to data protection rules.

68. Such refusal to supply, it has been argued, may have an anti-competitive effect: if there are limits on disclosure of datasets to competitors, the dominant undertaking could prevent the development of competing products from competitors. The undertaking could, therefore, try to 'shield' itself from remedies potentially imposed by competition authorities by claiming compliance with data protection rules. However, the dominant undertaking might still opportunistically infringe the data protection rules by using the dataset including personal data for a purpose incompatible with the one for which the data were originally collected in order to offer other services which competitors could never develop. In this context, there is clearly scope for cooperation between competition and data protection authorities in order to ensure that the respective rules are effectively enforced. 4.2.3. Data protection as a factor in consumer welfare See sections 3.2.4 (consumer welfare in competition law) and 3.3.2 (obligations of fairness and accurate information)

69. According to a recent study, consumers in the digital economy suffer discrimination partly due to lack of attention in the application of competition law. This neglect, according to the study, consists in the absence of uniform measures for reporting discriminatory practices and the lack of a harmonised approach to collective redress. While it is possible for consumer organisations to file a complaint before competition authorities, such claims are rare due to legal fees and low awareness of 112 consumer rights.

70. It should be borne in mind that consumers are also data subjects, whose welfare may be at risk where freedom of choice and control over one’s own personal information is restricted by a dominant undertaking in the sorts of cases outlined above. Presenting offers to consumers as ‘free’, according to some psychological and behavioural economic research, is deceptive, blinds consumers to the actual costs which they will experience ‘downstream’ and distorts decision making, thereby harming both consumers and competition.

71. Given the reach and dynamic growth in online services, it may therefore be necessary to develop a concept of consumer harm, particularly through violation of rights to data protection, for competition enforcement in digital sectors of the economy. 4.2.4. Remedies in competition decisions See sections 3.1.5, 3.2.5 and 3.1.3 (supervision etc.)

72. Decisions on individual antitrust and merger cases typically impose remedies, including in one case a requirement for a company to sell a copy of a database which 114 included personal information to one or several of its rivals. Future remedies of this nature should be subject to strict conditions and safeguards in line with the principle of data minimisation (whereby only the personal information which is strictly 115 necessary to perform a desired functionality should be collected). In competition cases involving firms in the digital economy other remedial options could also be considered which address the harm to individuals’ privacy. Options might include:  offering users a paid service which minimised collection and retention of personal information;  applying a proportionate limit to the retention of customer data, for example along the lines of the ‘compare and forget’ method recommended by the Dutch data protection authority;  implementing data portability by giving the user options to withdraw their personal information and to port it to another service provider (see section 4.3.3); this would potentially empower individuals while also promoting competitive market structures; and  placing strict controls on information processing across different parts of the business for incompatible purposes. 4.3. Joined up enforcement to facilitate a ‘race to the top’ on privacy standards See sections 3.1.4 (consent and right to information etc.), 3.2.4 (consumer welfare and competition law) and 3.3.2 (obligations of fairness and accurate information) 4.3.1. Fostering privacy as a competitive advantage

73. In certain markets, consumers may consider a more privacy-friendly service to be of better quality than a service which has an unclear or opaque privacy policy. In the provision of legal and medical services, private banking, security services, and exclusive luxury resorts, businesses typically compete on protecting privacy. It is reasonable to assume that, in such competitive markets, a failure by one company to 118 respect data protection would damage their market power. To a much more limited extent, some internet search services aim to differentiate on privacy.

74. Consumers who are used to enjoying free online services, however, may be willing to provide personal information in exchange for a free, quick and easy service, whether or not they are also aware of the accompanying risks. For such markets, more privacyfriendly terms may not automatically generate a consumer perception of superior 119 quality. Early research suggests that consumers could be willing to pay a premium for stronger privacy protection. Firms operating in the digital economy do not yet consider privacy as opportunity for competitive advantage. On the contrary, there is the danger of a ‘race to the bottom’ of privacy protection, where failure to comply with data protection rules and the acquisition of data through anti-competitive means may have become symptomatic of market power, with externality costs borne by users.

75. A useful comparison may be drawn with the spread in the 1960s and 1970s of the notion of corporate social and environmental responsibility. Companies began to realise the importance of the socio-economic impact of their business and how it was perceived by their customers. They now typically benchmark their own policies against those of competitors, and there is a genuine market for product safety and green technologies. A more joined-up approach to data protection and competition could help stimulate a similar level of competition in online services. 4.3.2. Consumer choice, consent and transparency

76. Choice depends on the availability of competing services and the consumer’s ability 122 to understand the information provided about those services. Confronted by multiservice companies in the digital economy, there are several significant obstacles to genuine choice. If personal information is collected as a condition for using one particular service, and then processed by the same company for the purposes of another service, it is already difficult for users to predict what will be done with their data.

77. This difficulty is compounded by lengthy ‘privacy policies’: a study has calculated that it would take on average each internet user 244 hours per year to read the privacy policy belonging to each website they view, which is more than 50% of the time that average user spends on the internet. These policies typically contain statements about the future use of data which are concealed in legal small print or which require decoding due to vague, elastic terms like ‘improving customer experience’.

78. Moreover, with average smart phone users downloading 37 apps for purposes ranging 126 from gaming to banking, only 61% of most popular apps have a privacy policy. This creates an asymmetry of knowledge which invokes the obligations of traders to provide clear and unambiguous information under EU consumer protection law, and calls into question whether data subjects have sufficient information to give informed consent to data processing. The situation is likely to be compounded by the growth of the Internet of Things, which will include many technical or embedded devices collecting personal data, with the result that their users will be unable to consult the privacy policy on the device itself, but would have to find paper documentation or more likely browse from another device to the relevant web sites.

79. Successful online providers persuade increasing numbers of customers to provide more personal information which increases the value of the service to advertisers, thus generating ‘network effects’ whereby yet more customers are attracted to the 128 service. In the case of ‘free' online services, customers may not be offered an alternative version of a provider’s offering in which personal information are not to be used for marketing purposes. Customers have limited room, if any, to negotiate the terms and conditions of use, representing a ‘significant imbalance’ between provider and user which could also trigger investigation into the legality of data processing. This calls into question the existence of a genuine choice under Article 7(a) of the Data Protection Directive and in turn the validity of consent to processing of personal information. Where there is a limited number of operators or when one operator is dominant, the concept of consent becomes more and more illusory.

80. There have therefore been calls for the responsibility to protect personal information to shift more visibly from the user to the service provider, as with consumer protection rules (see section 3.3.2). One response to these challenges could be to consider standards for transparency and intelligibility of contractual terms in online services. Organisations could be required to reveal more about their decision making in data processing operations. A transaction cost economics approach has also been recommended, which takes into account contextual factors in assessing the value of products and services which are promoted as free but which incur ‘myriad, hidden, non-pecuniary costs,’ so that all parties have a more equal level of understanding of the value of the personal information which is being gathered and processed.

81. The enforcement of competition rules requires an evaluation of whether consumers regard different services as being substitutable. It follows that this analysis should pay regard to transparency and the ultimate cost to consumers of privacy policies, and to whether the choice is genuine, and whether consent to information processing is valid. 4.3.3. Control of one’s own information

82. Better informed consumers should be better able to choose between competing online services. They should be able to withdraw and to transfer data which record their activities and are stored in the cloud, whether in the context of social networks, search engines, online banking, energy consumption, medical or fitness tracking applications. As a Commission competition expert has noted, 'the harder it is for an individual to move [his/her] data, the stronger will be the position of the provider that controls that data, and the more difficult it will be for new entrants to succeed.’

83. Data portability (paragraph 26) could release synergies between competition law and data protection law in at least two ways. First, it could prevent abuse of dominance, whether exclusionary or exploitative, and consumers being locked into certain services through the limitation of production, markets or technical development to the 135 prejudice of consumers. It would emulate the benefits of number portability provided for in telecommunications law. Second, data portability could empower consumers to take advantage of value-added services from third parties while facilitating greater access to the market by competitors, for example through the use of product comparison sites or of companies offering energy advice based on smart metering data. 4.4. Supervision and enforcement See sections 3.1.5, 3.2.5 and 3.1.3 (supervision etc.)

84. Separate consistency arrangements in the EU already exist for the regulation of competition, consumer protection and data protection through, respectively, the European Competition Network, the Consumer Protection Cooperation Network and the Article 29 Working Party. The distinctness and independence of these authorities must continue to be fully respected. However, given the challenges set out in this document, it may be sensible for the Commission and the EDPS at EU level together with national competition, consumer protection and data protection authorities to agree upon a more holistic approach to enforcement. This would be especially timely in the light of the review of consumer protection cooperation and ongoing negotiations on the data protection regulation, which includes provisions on a consistency mechanism. Dialogue between authorities at these two levels – European and national - could become more systematic wherever a specific case arises in which consumer welfare and data protection concerns appear to be at stake.

5. Conclusion: further investigation and discussion required

85. This preliminary Opinion has explored and considered the possible convergences and tensions between three areas of EU law, against the fast evolving backdrop of big data. Although privacy and the protection of personal data are public interests and fundamental rights recognised in the Treaties, the lack of interaction in the development of policies on competition, consumer protection and data protection may have reduced both the effectiveness of competition rules’ enforcement and the incentive for developing services which enhance privacy and minimise potential for harm to the consumer. In the digital economy personal information represents a significant intangible asset in value creation and a currency in the exchange of online services. This has potentially far-reaching implications for the interpretation of key concepts including transparency, market dominance, and consumer welfare and harm.

86. A comprehensive response to these challenges requires more time for investigation, reflection and discussion, but might include any or all of the following:  raised awareness among consumers, service providers and regulators of current and future technological developments in relevant markets in the digital economy and the implications for competitiveness, consumer welfare and choice and innovation around privacy-enhancing services;  effective guidance on the application of privacy, competition and consumer protection rules for online services, in particular those promoted as ‘free’ services, which takes into account the views of customers and competitors and evidence of customer preferences and concerns;  cooperation between authorities in investigation and enforcement, for example in identifying scenarios and possible standards for measuring market power in the digital economy, and consultation on investigations into individual cases; and

87. Personal information has prompted and sustained growth in the digital economy. Individual consumers should be able to enjoy a fairer share of the fruits of that growth. Competition and data protection authorities are increasingly recognising this as a pivotal challenge in building trust and accountability across the digital economy. Data protection presents a unique opportunity to give individuals the tools to protect themselves and to make the enforcement of competition and consumer protection rules more effective.

88. The next step is to explore the scope for closer coordination between regulators to achieve these aims. This coordination should not be restricted to Europe but rather reflect the global reach of companies in the digital economy. The EDPS looks forward to facilitating this discussion. Done in Brussels, 26 March 2014 (signed) Peter HUSTINX European Data Protection Supervisor

Annex: Data protection, competition and consumer protection in the EU: A comparative overview