German regulator restricts Facebook data sharing

On 07.02.2019, Bundeskartellamt, the German competition regulator, issued a decision against Facebook restricting its processing of user data. 

The Bundeskartellamt points out that Facebook is in a dominant position with a market share of 95%. The closure of Google+, one of the competitors of Facebook, has intensified its dominance. Other companies, such as Twitter or Linkedin are considered to only operate in part of Facebook's market.

The decision states that the way Facebook collects, merges and uses data between its subsidiaries ammounts to abuse of dominant position, under competition law. One of the most troubling practices employed by Facebook is that it collects third-party data on users in an almost unlimited way and attaches all of these data to the users' facebook accounts. Data is being collected not only by other Facebook owned services, but by any website that has an embedded facebook button. It is worth noting that the data of the users was collected even if they would not interact with the facebook buttons (even if they  didnt 'like' a page).

What is even more concerning is that data is collected even if there is no kind of facebook sign on the page, when the website is using facebook analytics. This widespread collection of data allows facebook to form very detailed profiles of its users. 

With its decision, the Bundeskartellamt forbids this practice. Facebook, Instagram and Whatsapp will still be able to collect data on their users. However, Facebook will be prevented from assigning this data to a single facebook account, unless they have the voluntary consent of the users. However, the consent of the users is already required for third-party websites. The decision requires Facebook to make changes to its terms of service and data processing. The processing of data from third parties without the consent of users needs to be substantially limited. Facebook will have to come up with proposals on how to achieve that.

This decision comes after the publication of the first reports on the Code of practice against disinformation, signed by Facebook and other large online companies such as Google, Twitter and Mozilla. Facebook has to strengthen its commitments to empower consumers and boost cooperation with fact-checkers. However, if Facebook is serious about making their platform a fertile ground for those who seek to spread disinformation, it should first and foremost protect its users and their data from those who want to abuse them.

The decision is not yet final, as Facebook will have one month to appeal in German courts. It remains to be seen whether Facebook will challenge the decision. This decision serves to point out the increasing intersections between consumer law, data protection law and competition law. The Bundeskartellamt points out that their investigation required close cooperation with data protection authorities.

This is the dawn of a new age where the traditional compartmentalisations of law may not serve us as well  as in the past. Consumer law will also have to adapt in order to address challenges arising from novel business models, and especially in relation to data protection.

German BGH "limits and expands" consumer withdrawal rights with a view to mortgages

Late in 2013 the CJEU issued a judgment (Case C‑209/12) following upon a request for a preliminary ruling under Article 267 TFEU from the Bundesgerichtshof (Germany) in which it held that a national provision, under which a right of withdrawal lapses one year at the latest after payment of the first premium, where the policy-holder has not been informed about the right of cancellation, was contrary to EU law. Before 2008 it was standard procedure in Germany that an insuree would  receive the general conditions of assurance and consumer information only upon receipt of the policy document - hence after conclusion of the contract. Upon receipt of the policy documents consumers were granted a 2 weeks (later 1 month) withdrawal period. If the consumer never received the documents, the right of withdrawal was assumed to having lapsed after a year with the contract hence being valid. This judgment was to have effect for insurance contracts for the time period from 1994 to 2007 giving consumers that had not been correctly informed about their rights basically an "eternal right of withdrawal" that is financially far more favourable than a classical cancellation of such a contract. It puts the consumer in the position as if the contract had never been concluded.

Taking into consideration the CJEU judgment the BGH held that such damage payments may be limited given that the insuree has been profiting from the insurance coverage - thereby limiting the effect of the CJEU judgment to some extent. 

The Allianz, one large German insurance company, at the time did not expect a big impact of the judgment as it claimed to be able to prove that it had sent out the policy documents in time to all its customers. Few cases of consumers trying to withdraw their contracts upon the basis of not having received the policy document were, consequently, expected.

It has, however, generally become popular to withdraw insurance contracts due to formal errors of different kinds (German legislation on the formal requirements kept changing). In a recent judgment the BGH has, in line with the previous judgment, once more confirmed the possibility to limit damage payments because the consumer has benefitted from the insurance protection. At the same time the BGH, however, states explicitely that the consumer upon a successful withdrawal can claim back all the acquisition costs - typically a multiple of Euro 1000 - from the insurer. These may not be subtracted.