Jusletter IT

In my dissertation, Abuses of Dominant Companies in the Area of Data Protection and Data Security, I am focusing, as stated, among other issues, on dominant companies. I am definitely not interested in the actions of smaller, less significant entities, from the economic and legal point of view.

This paper underlines the reason for this choice. Why is dominance so important? I want to prove, in my dissertation, and here, that the companies selected by me, by the fact they are dominant, have a significant and major impact on legal and factual actions in the wide area of protecting and securing data as well as privacy.

Companies, such as Microsoft, Facebook, Google, etc., are so huge and influential that they are already known for abusing their position in numerous cases. Even more important is the fact that their economic situation, as well as global position allows them to easily pay all the fines against them. So far it seems that the tools countries and organizations all over the world have at their disposal, are not enough to stop dominant companies from their illegal actions.

Nowadays when the European Union is working on new solutions, such as new data protection regulation, it may seem that we should just sit and wait. On the other hand, we can examine the example of Finland which already has developed more efficient and complex legislation shows that even with this, dealing with Facebook or Google is extremely difficult.

I would like to present dominance and super dominance, explain why dominant companies are in a very comfortable position, and why focusing on them is so important in understanding the threats to privacy and data protection and data security.

Where is the competition law in this topic and in my dissertation? Why am I focusing so much on competition law? These are the questions which needed to be answered at the beginning.

Dominant companies and dominant entities, or to be more exact, the whole concept of dominance comes directly from the competition law dictionary. Both in my dissertation and in this paper I focus on dominant companies or entities because the bigger the amount of power on the market, a subject has, the bigger an abuser it can be.

Other than the fact that competition law interests me, it is also one of the oldest branches of law dealing with powerful, often international subjects. Therefore provisions are more complete, lawyers more experienced, and there are more cases to learn from. If lawyers can deal with dominant subjects when it comes to business related cases, abusing market position and copyrights, then maybe in looking for solutions in the area of data protection and data security we could use the experience of competition lawyers.

As my area of interest is at first Data Protection and Data Security I don’t use competition law definitions literally. Especially because competition law is known for lacking precise definitions or definitions at all.¹

I would like to explain how common legal understanding of the term «dominance» or «dominant», coming from competition law, may not be sufficient. There are several criteria which I will present, to explain how different the companies are that I have chosen for my topic from those which are usually called «dominant» or «super dominant». There is definitely the place for new term, like «global dominance» or «absolute dominance».

One thing should be taken under strong consideration. It is not only about «dealing» with companies or with the problems caused by them. It is not only about creating aggressive legislation to have tools to fight them. It is also, and maybe mostly about cooperation. Cooperation may be the only way to convince those companies to «behave».

The dominance is an underrated factor in dealing with abuses in all legal areas, not only security or data protection. It deserves a proper explanation to underline the issue. I want to explain that in the topic of my dissertation «Abuses of Dominant Companies in the Area of Data Protection and Data Security», part «Dominant Companies» may be more important than «Abuses». Of course together, it highlights the whole idea, but when the fact of existence of abuses is well known, the influence and importance of dominance is less considered.

During my short academic experience as a doctoral student I noticed interesting an phenomenon. Whenever I mention the topic of my dissertation, Abuses of Dominant Companies in the Area of Data Protection and Data Security, the reaction is always the same – «You are writing about Google, Facebook etc.» It is on the one hand helpful, as helps me jump right into the core of the discussion. On the other hand it means only one thing. Lawyers have one understanding of the term «dominance». It is the competition law «dominance».

Why do I think it is an issue? Mostly because it somehow simplifies the complexity of the problem in the area of data protection and data security, and at the same time it complicates what should be kept simple.

Naturally whenever we use the terms «dominance» or «dominant position» we should and we do think about competition law. That means that with the topic «Abuses of Dominant Companies in the Area of Data Protection and Data Security» the first thing that comes to mind is the connection between Competition Law and Legal Informatics or IT Law.

It is a right guess, and it is at the same time a wrong one. «Dominance» definitions taken from competition law are not even complete or if we want to look for them in legislation, there are none.

What is the «dominance» taken under discussion in almost every publication concerning antitrust law or competition law? Without defining this term, or without quoting relevant provisions it is pointless to discuss. Of course it may seem that at this point everything has been already said and defined. Yet, there are still plenty of problems and issues. Even though I am not exactly interested in competition law, this way of understanding «dominance» is what I need to include in this paper.

The prohibition on abuse from article 102 TFEU² only applies to the conduct of companies with a dominant position – assessment of dominance is an essential requirement for its application. The first problem is that the article, or the whole Treaty on the Functioning of the European Union does not explain what «dominance» is. Single company dominance, the one I mostly interested in, was defined early by the European Court of Justice (ECJ) in United Brands³ and Hoffmann-La Roche⁴ cases as «a position of economic strength enjoyed by an undertaking which enables it to prevent effective competition being maintained on the relevant market by affording it the power to behave to an appreciable extent independently of its competitors, customers and ultimately of its consumers.»⁵ Even this definition, widely accepted and used, raises serious uncertainties: the concepts of economic strength or independence have no economic meaning, it ignores the fact that in most markets, no company is truly independent and there is no indication of which degree of economic strength or independence must be achieved.

Additionally in competition law, it is required to look for a relevant market. It can be a product market or a geographical market and it is important to assess the time of dominance. In case of super dominant companies it is also a part of discussion, yet in my opinion competition law simplifies the problem.

Competition law is, even if with some understatements, focusing on the economic point of view. Where and when the company is dominant, what is the market share, is the company independent, has the consumer alternative and so on.

The dominance I am interested in is different. Of course the company has to be dominant presently. It has to be a global and multinational position. Obviously the company has to have strong market position in relation to data processing.

From time to time the term «super dominance» or «super dominant position» has appeared in case law. It was popularized in Microsoft case and referred to Microsoft’s share of more than 90% on the operating systems’ market. First it was presented in the Tetra Pak⁶ case and confirmed later in the Compagnie Maritime Belge case in the opinion of Advocate General Fennelly. He described it as a «position of such overwhelming dominance verging on monopoly» that it would give rise to «particular onerous special obligations».⁷

The term «super dominance» may seem to very accurately and rightly describe position and situation of the companies I have chosen for this paper. Unfortunately, in fact it is only a clever way of saying that a company has a massive advantage on the particular market. What is more, this concept has not yet been specifically referred to by the Commission or the European Courts – with one exception of Microsoft case.⁸

I like this term very much. Unfortunately because of its nature it is not really useful to me. I am not seeking for a definition focused on market position per se.

Yet, I am mentioning it. The first reason is because I want to emphasise how, for competition law, dominance has become a way of describing economic position. The second reason is because I hoped to find a term, to name the situation in the area of data protection and data security. It is not super dominance, but the appearance of such terms in case law shows that sometimes there is a need to create unusual, I would even say «flashy» names.

Facebook, Google and Microsoft. These are the companies I am choosing as the brightest examples. Examples of abuses, dominance, strong position on several markets and finally because they are extremely well known names in the world. Simply, everyone knows them and something about their actions.

The first question is, are these companies really dominant, or can they be called super dominant? It is easy to make this kind of assumption, but equally easy is the realization that when it comes to legal definitions, nothing is that obvious.

Google and Microsoft have already been accused of abusing their dominant positions.⁹ The European Commission stated that these companies are dominant on respective markets. Microsoft was even called super dominant on the market of operating systems.¹⁰ Case closed, these companies are dominant.

What with Facebook, my third example? So far Facebook has never been an object of a competition law investigation, nor has it been accused of abusing its position. In my opinion, according to competition law, Facebook is not a dominant company on any specific market. Why? Because the dominance of the company is investigated only if the company is accused of conducting abuses. Could I then just say «case closed, Facebook is not dominant on any market»? No. The fact is that Facebook is dominant on the market of social media. To what extent, this is not exactly established.

The way and the moment competition law decides that a particular company is dominant, causes some problems and forces me to avoid typical legal understanding of the term «dominance». In my dissertation I need to refer to Facebook as to the dominant company without using any additional qualification, such as «in fact» or «as the numbers indicate».

I support the idea that when it comes to global dominant companies, or companies considered to be super dominant it is very rarely that they abuse the position they own. They became victims of their success. Google and Microsoft are the brightest examples. In the case of Google this is a rather widely accepted opinion¹¹. Microsoft is more known for being just an abuser. I prefer to include Microsoft as victim, as a kind of «elephant in porcelain shop» – the company already that big and influential that it sometimes acts against competition law rules without really having an intention of doing so. The European Commission and The General Court would not agree with me, but this is my opinion which was a base for my Master Thesis «The Prohibition of Abuse of a Dominant Position in the Light of the Microsoft Case».

On the other hand, what needs to be underlined, when it comes to abuses in the area of data protection and data security, is that it does not matter why the company is dominant or whether it is a victim or an abuser. The situation is different. Abusing the dominant position in competition law understanding is about the market power and has an economic basis. The difference in US Antitrust Law and EU Competition Law shows us that it is not obvious what the reaction should be. Should we try to eliminate monopolies, but at the same time allow smaller companies to defend themselves and focus on protecting consumers (US Antitrust Law)¹², or should we protect consumers indirectly by protecting smaller companies (EU Competition Law)¹³? I don’t think it is far from the truth to say that with widely understood data protection it is easier. It is about privacy and data that needs to be protected and it does not matter if the company is abusing its position on purpose, accidentally or as a victim of its extremely strong market position.

The problem of an insufficient definition of dominance, for the purpose of my dissertation, can to be partially solved by naming requirements for companies’ dominance in the area of data protection and data security. These requirements must be based on competition law as I do not want to isolate my work and ideas from the existing legal solutions and concepts.

In my dissertation I would like to use companies dominant in very specific ways. The exact market share is not what I am interested in. Facebook is an example of very influential and powerful entity that doesn’t have established market share, yet I do not think there are any doubts whatsoever that is has dominant position. Especially considering that there are way to establish monopoly of Facebook on the Social Media market.¹⁴

Having that in mind I would like to propose the following requirements for deciding whether the company holds a dominant position or not, without starting an investigation under competition law:

• the company has to have global and multinational presence,
• strong overall market position,
• strong economic position,
• possible legal influence.

Of course the companies to meet my requirements and be useful in course of my work, must deal on the daily basis with large amount of data, possibly collected in connection with their profile.

As can be easily recognized these requirements have origins in competition law. This way it simplifies their application and understanding.

What does it mean that the company must be global and multinational? The role of this requirement is to exclude all the entities which are considered to be dominant on the market of just one country or even just one continent. Therefore there is no place for Yandex¹⁵ which is the biggest search engine on the Russian market or Baidu¹⁶, having the same position on the Chinese market.

Global and multinational, these give me only companies having their presence and interests all over the world, reaching everyone, whether willingly or not. Some companies, may have headquarters in one, specific place, but in fact act like several smaller and often independent entities. For example Facebook is after all everywhere, but this is an American company established under US law having the headquarter in the United States. At the same time having a European headquarter in Ireland, in the European Union.

The custom in competition law decides when the company holds a dominant position and on what market etc. As I have written already, Facebook, for example, has a very specific situation in which assessing by numbers its position is rather difficult. Microsoft is, according to competition law, definitely not a dominant company on the search engine market. Google on the other hand holds strong position on all markets they are involved.

«Strong Overall Market Position» requires something different. For a company to be considered as dominant for my purposes, in the area of data protection and data security, it must hold a position that allows it to collect and process large amounts of data. Microsoft may not be the owner of the most popular search engines (Bing, Yahoo!) but together with all the Windows operating systems (including PC and mobile solutions), Skype, Internet Explorer, Xbox Live and Windows Live, it has access to one of the biggest databases in the world. Almost the same applies to Google. Facebook gained access to one of the biggest databases in a different way, but the result is the same.

Microsoft, Google, Facebook, similar and different at the same time, found their ways to collect incredibly large amount of data. How many more companies in the world can say that they have access to information about people from every corner of the world?

Strong economic position in this case means that the selected companies are able to pay any given financial fines put on them without actually feeling this.

Microsoft is a great example. Losing the Microsoft case cost the company together around 1.2 billion Euro. It is still the highest fine ever paid in the history of European Union. The European Commission called it a huge success.

But was it a big loss for Microsoft? Microsoft is the first company to be a subject to such a high penalty. This is a record, but keep in mind that, for example, Microsoft’s revenue in 2005 was 39.78 billion US-$ and net profit 12.25 billion US-.$. The fine of 1.2 billion is the sum of all fines that Microsoft had to pay during the 10 years of the process against the European Commission. It is not hard to imagine that in this perspective 1.2 billion Euro no longer looks that big.¹⁷

Strong economic position means that a company does not have to fear any possible fine that can be given under existing laws. That the fine may just become the cost of running the company.

During the KnowRight 2012 conference in Helsinki, the Finnish Data Ombudsman Rejio Aarnio spoke about 25 years of Data Protection in Finland and asked the question, «Are we ready?» He listed a number of solutions which are planned to be implemented into European Union law. Most of these solutions already exist in Finnish law. Regardless of that, even Finland is having troubles dealing with Facebook.¹⁸

Actions of companies I am interested in, may result in law becoming outdated or at least insufficient long before it is even enactment. It may be the biggest issue with new data protection regulation or with data protection laws in countries which are only now working on legislation in this area (e.g.. China, Russia, India).

There is also possible way of influencing law. Every time Google or Facebook works on a revised version of, for example, their Privacy Policies they may present innovative ideas and solutions.¹⁹

Competition law does not define the term «dominance» in legislation. Dominance, in a rather unclear fashion, was explained in EU case law, leaving a lot to discuss. Being not really defined, dominance on the other hand is in competition law quite specific and leaves usually no doubt which company is dominant and on what market. Yet, it causes some uncertainties in some cases. Specifically when I want to talk about dominant companies in the area of data protection and data security. Saying only that selected companies hold given numbers on some markets, or that they are not dominant only in very few places in the world is not enough.

When it comes to processing data and dealing with privacy issues, there are several companies which are different compared to others. They are everywhere, but at the same time nowhere. They hold a strong position on many markets, together having the possibility to create enormous data bases. They conduct or are able to conduct abuses in connection with the data they process. Existing law is insufficient to stop them. Finally, unlike in competition law there is as of yet no way of cooperating with the abuser.

It is all fine, but why in fact do I believe we need a different dominance? Marking a company as a monopolist, dominant or super dominant means that the company has special responsibilities. Mainly because the special position may cause more harm. It is more or less the victim of the size or position. Using competition law requirements to asses if a company is in a dominant position is not enough. Microsoft does not have a monopoly on any market that alone could cause danger to privacy or data protection. Facebook is not even a monopolist, at least officially, although it is treated as such by europe-v-facebook.org.²⁰ Finally Google is an exception, but this exception shows how strong, on the single product market the company has to be, to be seen and recognized as a threat.

Seeing a company as a subject on multiple markets, not always connected with each other, by any means, may help in recognizing the problem earlier. If in competition law a recognized monopolist is treated as a potential abuser, in the area of data protection and data security we should look for companies being able to collect data without any limitation thanks to the position they hold on several markets. Competition law is focused on economy, my point of view is focused on privacy and security. In both cases we cannot stop the companies from being dominant, but we can start asking questions about necessity of their actions. And if we recognize them early enough as potential abusers, we may have more chances to avoid situation similar to the one with Facebook, Google and Microsoft.

For discussion is whether we should treat these companies aggressively, or simply look for a compromise. A different discussion.

---

 

Aleksander Wiatrowski, Doctoral Student, University of Lapland, Institute for Law and Informatics, http://www.ulapland.fi/

 

---