European Union – Data and Privacy in Merger Control
Much has been said (and written) about data as a ‘new’ factor in European merger review. This, of course, begs the question: ‘is it really new’? Airline frequent flyer programmes, supermarket loyalty schemes and credit card companies, for example, have been collecting material amounts of data about consumers for many years. The collection and use of data (even large sets of data) is not a new phenomenon. In the words of Commissioner Vestager, data does not ‘need a whole new competition rulebook’.
In a number of cases over the past 20 years, both behavioural and transactional, data has played a central role. In the behavioural context, there are a series of cases that have turned on data (and access to it), from IMS Health,which was essentially about whether rights to a data structure (the 1860 brick-structure) impaired the ability of competitors to collect and manage data in the form required by pharmacies, to the Reuters Instrument Code and CDS – Information market commitments decisions.
The picture is not dissimilar in the merger context. Almost 10 years ago, TomTom/TeleAtlasand then Nokia/Navteq addressed the competitive significant of digital map databases, followed in 2012 by the UK mobile wallet JV, which turned on whether the particular combination of data (personal information, location data, response data, behavioural data and browsing data) that would be accessible to the JV represented a ‘unique’ data set that would become an ‘essential input’ for targeted mobile advertising.
All of that said, a number of things have changed. The volumes of data being collected, analysed and increasingly used in (and to ‘teach’) algorithms by a wide range of companies (not only those active in the digital economy) are increasingly significant and continue to grow. In addition, the results of data analysis and algorithms that may have been trained using data (machine learning) are being used more widely and more frequently. The flip side of this is, of course, that certain types of data are collected by (or are otherwise accessible to) multiple entities. That multiple entities have access to fungible, similar or comparable sets of (particularly consumer) data (for example, location data for smartphone users) brings into focus the importance of the distinction between such data sets, on the one hand, and genuinely unique data sets on the other. It also highlights the fact that whether data is unique or not may turn on the market in which the data is (or will be) used. For example, consumer transaction data from one financial services company may be fungible with a similar data set from another financial services company for online advertising, but information about one type 2 diabetes patient is not fungible with information about another patient if the data is being used for treatment decisions. The first section, below, considers the central importance of these issues in competitive assessments involving data.
Data can clearly be relevant in competition assessments, but it is important that assessments of its competitive significance are rigorous and take place in a robust framework. The acquisition, collection or possession of data is not anticompetitive. Nor are most of the uses made of it. In the merger context, most of the Commission’s recent cases have focused on data that is monetised to fund a multisided platform, and, in that context, whether the acquisition of data that can be used for that purpose has the potential to be anticompetitive. Beyond that, in Microsoft/LinkedInthe analysis also considered the potential use of data to improve an algorithm (for machine learning). In other words, these assessments have largely focused on the use of the data as an input to one or more related markets, looking at the potential vertical effects of the acquisition of control over particular data sets.
That said, there have been a small number of cases that turned on whether the combination of data sets could have anticompetitive horizontal effects. The second section, below, considers these cases, with the following section focusing on the development of the approach to the potential vertical issues.
The penultimate section then briefly addresses certain ongoing jurisdictional debates that are relevant to, and were in part triggered by, mergers centred on data. We then conclude with the ongoing debate over the role that privacy should play in competitive assessments involving data. It is clear that privacy can be a parameter of competition – you need only think about the way that certain messaging services promote the fact that they are ‘end-to-end’ encrypted. The debate, however, is more focused on whether competition rules should be used to compel companies to compete to offer more privacy. Commissioner Vestager has made clear her view that we should not look to competition enforcement to fix privacy problems – instead we should ensure that there are adequate data protection rules in place.The newly created (post-GDPR) European Data Protection Board has, however, recently repeated its predecessor’s position, namely that ‘[i]ncreased market concentration in digital markets has the potential to threaten the level of data protection and freedom . . . [t]he data protection and privacy interests of individuals are relevant to any assessment of . . . mergers of companies, which may accumulate or which have accumulated significant informational power.’
The nature of data itself
There are two interrelated elements of the Commission’s competitive assessments in cases that turn on data that are becoming increasingly important in merger cases (particularly cases where data is used as an input):
- In which potential relevant market(s) might the data be used as an input?
- Given the potential uses of the relevant data, how precisely do potential alternative data sets need to match?
First, it is crucial to identify the market(s) in which the data is (or may be) used as an input, since that frames the nature and scope of the potential alternative data sets (and thereby the uniqueness or replicability of the data). There may well be alternative data sets that are comparably useful in some potentially relevant markets but not in others. For example, in Microsoft/LinkedIn, the Commission considered the use of the data in potential markets for online advertising, CRM software and productivity software solutions. However, it is important to consider not only the potential relevant markets in which data is intended to be used, but also other potential relevant markets in which it could be used. In its Article 14(1) case against Facebook, the Commission found that, when asked to address a third-party submission alleging that Facebook could create a ‘gateway’ between services and could ‘federate’ user profiles to enable cross-platform messaging and the integration of services, it was insufficient for Facebook’s response to address only those potential uses of data, when the Commission had requested that Facebook also ‘provide any other comments [it] consider[ed] relevant’. The Commission took the view that Facebook should also have addressed the potential use of the data for other purposes, including advertising.
Second, it is also important to consider whether alternative data sets must contain the same data or whether it is sufficient that the alternatives be comparable or fungible for the particular use to be made of the data. For example, it is implicit in the Commission’s cases to date about user data collected and used by providers of consumer apps that alternative data that can be used to improve online ad targeting need only be comparable. The data sets do not need to provide the same data about the precise groups of users to represent viable alternatives. Not dissimilarly, responses to the Commission’s market investigation in Microsoft/LinkedIn confirmed that the data sets available to competing CRM solution providers were comparable, in the sense that they had comparable utility in enabling software like CRM to ‘learn’ (in other words, for the purposes of machine learning). There are, however, some potentially relevant markets in which data sets can be used where the data must be precisely the same. While these cases have predominantly been behavioural cases (at least to date), both the Reuters Instrument Codes and CDS – Information market cases are illustrative. In the former, the short alphanumerical codes that identify securities and their trading locations could not be ‘replicated’ by anything else. To be able to use exchange data, it is necessary to be able to associate the data with the relevant listed entity. Similarly, there is no alternative to the ‘final price’ used to value credit default swaps (which are not transparent, because they are traded over the counter not on exchanges) for entities seeking to create indices or other derivative products or services that are based on final prices (see the CDS – Information market case).
Potential horizontal effects
In both TomTom/TeleAtlas and Nokia/Navteq, the Commission considered potential markets for non-navigable and navigable digital map databases. Although this analysis was part of the Commission’s review of the impact of the transactions on a number of vertically related potential relevant markets, the analysis of the ‘top’ layer in the stack (the upstream potential relevant market for digital map databases) was horizontal. This is not surprising, given that it was the combination of the data sets in this upstream market that triggered the vertical foreclosure analysis of the downstream potential markets (in which digital map databases were inputs) for navigation software and end user navigation apps and services. In Nokia/Navteq (which followed TomTom/TeleAtlas), the Commission assessed the horizontal overlap in what it found to be a two-player market for navigable digital map databases. Despite the fact that, following the transaction, both players in the potential upstream market would be vertically integrated (competing with third parties to provide downstream navigation services), the Commission concluded that the merged company would be unlikely to pursue a strategy of foreclosing its downstream competitors, essentially because its ability to deny competitors access to map databases was limited by TeleAtlas. The Commission found that the merged company would lack incentives to foreclose supply of digital map databases to its competitors because its loss of revenue from the sales of maps would not be offset by increased sales of mobile handsets, and other mobile OEMs would be able to compete with Nokia by working with third-party developers of navigation apps or developing other features for their handsets.
In Microsoft/LinkedIn, the Commission considered the impact on the potential relevant market for online non-search advertising of the creation of a combined data set of information about individuals’ jobs, career history and professional connections on the one hand; and email, other contacts and search behaviour on the other.The Commission considered two ways in which the combination of the two data sets could raise horizontal effects:
- The creation of a single data set could increase market power in a hypothetical market for the supply of data (essentially consisting of personal information, such as information about individuals’ jobs, career history and professional connections, their email or other contacts, and search behaviour) or could increase barriers to entry and expansion in that market for actual or potential competitors that need the data to operate on that data market.
- Even if the parties had no intention or technical ability to combine the two data sets (taking into account the constraints imposed by data protection rules, among other things), they could have competed prior to the transaction using the data that they each controlled (such that the concentration would eliminate that competition). This approach mirrors the Commission’s approach to horizontal issues more broadly (in the context of the analysis of intellectual property and otherwise).
In that case, the Commission found that the transaction did not raise horizontal concerns because the parties did not (prior to the concentration) make data available to third parties for online non-search advertising, and that the concentration did not constrain the data available to third parties for that purpose. It also found that there would remain large amounts of user data valuable for online non-search advertising purposes that would not be under the exclusive control of Microsoft. The Commission also noted that the parties were small players in the relevant market and only competed with each other to a very limited extent in the supply of online non-search advertising inventory.
Potential vertical effects
As noted above, the majority of the Commission’s more recent data-related merger cases have focused on potential vertical effects from the use of the data as an input in related markets. The Commission has considered whether the data concerned could be replicated by rivals, or whether without access to this data set rivals could not compete in the related market. While the cases have focused on the potential use in online advertising markets, the Commission has also considered the potential use of data to facilitate service integration and cross-platform communications (Microsoft/Skypeand Facebook/WhatsApp ) and machine learning (Microsoft/LinkedIn).
In its 2012 UK Mobile wallet case, the Commission considered the impact of the transaction on the market for data analytics services.It analysed data that would be collected or used by the joint venture to provide data analytics services in the following way: customer data collected by the mobile network operators (the parents of the joint venture) that would be provided to the joint venture once anonymised; data collected through the mobile wallet itself; and data collected from merchants under contract (for example, through loyalty schemes and transactions). Having identified the types of data and the market in which it would be an input, the Commission assessed whether the particular combination of data (personal information, location data, response data, behavioural data and browsing data) would be a unique data set that would be an essential input for targeted mobile advertising, so that other providers of mobile advertising intermediation services would either be dependent on the joint venture for this essential input or would be unable to compete if the joint venture would not provide access. It concluded that the data available would, to a large extent, also be available to a number of other entities, including Google, Apple, Facebook, card issuers, credit reference agencies and retailers because customers give personal data of this type to (or consent to its use by) many different entities. The Commission went so far as to describe this particular type of data as being generally considered to be a ‘commodity.’ While the Commission concluded that the broad range of data collected by the joint venture would be very valuable for its mobile data analytics and advertising services, it found that many other strong players offered comparable data sets, such that competing providers of advertising services would not be foreclosed from an essential input if they could not access this data set.
In short, the Commission considered whether the parties to a concentration would enjoy a competitive advantage in a potential relevant market through a data set augmented as a result of the concentration that would enable it to improve or target its products or services, in this case the intermediation of mobile advertising services, enabling foreclosure of the related market to third parties.
In 2016, Commissioner Vestager set out exactly that analytical approach when she noted that the Commission would consider ‘whether companies control unique data, which no one else can get hold of, and can use it to shut their rivals out of the market’.
Breaking that down into its elements, the Commission applies the following analytical framework to assess whether having the ability (and the incentive) to control (input) data impedes effective competition in a related market:
- Is the data that is the input indispensable or ‘unique’ (in other words, there is no actual or potential substitute)?
- Are there technical, legal or economic obstacles to obtaining substitutable data from elsewhere?
- Does exclusive access to the data set(s) reserve to the entity controlling the data (through the ability to exclude others) the related market?
There are, of course, strong parallels between this approach and the approach taken to assessing the potential for the assertion of intellectual property (particularly patents) to foreclose. The framework set out above echoes that in Magill.As a result, the threshold at which a lack of access to data can have the ability foreclose is also set quite high (even before the Commission characterised the data as needing to be ‘unique’).
The Commission has applied this framework in a number of cases, elaborating further on certain of its elements. In 2014’s Facebook/WhatsApp decision, the Commission considered whether Facebook would acquire data that was likely to strengthen Facebook’s position on the online advertising market (or any segments of it).Specifically, it looked at whether the acquisition would give Facebook access to additional data (generated through WhatsApp use) that would enable it to integrate services, enable cross-platform communications or better target ads shown to Facebook and Instagram users who were also WhatsApp users. In relation to advertising, the Commission found that, because WhatsApp did not collect user data that was valuable for advertising purposes (it essentially collected user names or nicknames, mobile phone numbers, and a certain amount of metadata), the concentration would not increase the data potentially available to Facebook for targeted advertising.
However, reflecting the caution warranted by the pace of evolution and innovation in these online markets, the Commission went on to consider whether, even if Facebook were to collect and use data from WhatsApp for advertising purposes, that might create the potential for an anticompetitive effect. It found that large amounts of valuable user data that was not within Facebook’s exclusive control would remain available to Facebook’s competitors and that there would be a sufficient number of alternative providers of online advertising services because there were a significant number of third parties also collecting user data.Given this, the Commission concluded that the combination of the data sets would not provide Facebook with a non-replicable advantage, because competitors could obtain fungible data sets in other ways (for example, from data brokers or data analytics services providers).
The Commission also followed this approach in Verizon/Yahoo!, looking at the data generated by users of Verizon and Yahoo!’s websites, apps and services that could be used by Verizon and Yahoo! to better target advertising on their websites and apps.It concluded that the combined data sets would not raise barriers to entry, not least because the parties were relatively small market participants. It went on to note that the parties’ data sets were not unique. Indeed, the market test in Verizon/Yahoo! suggested that the improved data capability resulting from the acquisition might actually enable the combined entity to better compete against its materially stronger rivals (as the Commission had also noted in its earlier Microsoft/Yahoo! review). In both Verizon/Yahoo! and Microsoft/Yahoo!, the Commission’s competitive assessment concluded that the concentration would be pro-competitive – far from creating either an ability or incentive to exclude, the increased scale of data collected had the potential to create a more effective competitor. These two cases highlight the importance of the assessment of market power in any input foreclosure analysis – if the entity acquiring the data lacks market power in the related markets in which the input could be used, it lacks both the ability and incentive to foreclose.
More recently, in Microsoft/LinkedIn, the Commission considered for the first time the potential issues that might be raised when data is used as an input to improve a service, specifically through developing and offering improved functionality (or machine learning). It considered whether Microsoft would be able to adopt an input foreclosure strategy by using ‘LinkedIn full data’to improve its customer relationship management (CRM) software while denying access to that LinkedIn full data to competing CRM providers. In other words, it considered whether data could be used for machine learning to improve the merged entity’s product while foreclosing access to the data by competitors who might be able to make making comparable improvements to competing products by denying those competitors access to the data.
The Commission initially noted that it was not clear that LinkedIn full data would be an ‘important input’ (within the meaning of the Non-Horizontal Guidelines) in the near future.Prior to the concentration, LinkedIn had not made the LinkedIn full data available to third parties (for machine learning or other purposes), and it was unclear whether it would have started licensing the LinkedIn full data (absent the concentration). The Commission also noted the potential pro-competitive effects of Microsoft using LinkedIn full data to improve its CRM software solutions (noting the possibility of new products or improvements to existing products).
Despite this, and consistent with the approach that the Commission takes in these innovation-focused technology markets, the Commission conducted an ‘even if’ analysis. It concluded that, even if the LinkedIn full data was used by Microsoft for machine learning to improve its CRM, the concentration would not foreclose competing CRM providers. It found that the merged entity would not have the ability to implement a foreclosing strategy for a number of reasons:
- LinkedIn did not have sufficient market power in the hypothetical market for the provision of data for use in ‘teaching’ or training CRM software solutions.
- European data protection rules limit Microsoft’s ability to process LinkedIn full data.
- LinkedIn full data was not (and would not become in the relevant time frame) an essential input for machine learning-enabled CRM functionality. At the time of the concentration, all major CRM vendors either had already started adding machine learning-based functionalities to their CRM services or were planning on doing so in the near future. Despite this, none of these CRM vendors were planning on to use LinkedIn full data for this purpose.
- Fourth, LinkedIn full data would only be one of the many types of data available for this purpose, such that there were many other possible source of data that could also be used for machine learning in connection with CRM services.
Not surprisingly, given these conclusions, the Commission concluded that it was unlikely that the exclusive use of LinkedIn full data for machine learning in Microsoft’s CRM software would have a competitively significant effect on a ‘sufficiently important’ proportion of Microsoft’s CRM competitors (such that there would be either a significant price increase or reduction in incentives in the market to innovate).
Most recently, in Apple/Shazam the Commission once again applied the framework set out above to conclude that the Shazam data set, while commercially valuable, was not unique and could be replicated. Further, it found that Apple’s rivals would continue to have access to a large amount of similar data through access to, and use of, similar databases. In considering the importance of the Shazam data to the ability of participants in the downstream and related market, the Commission concluded that Shazam was of limited importance as an entry point to the provision of music streaming services.
The impact of data-driven cases on jurisdictional debates
In 2017, both the German and Austrian merger control thresholds were revised to include a new test triggered by the value of the transaction (€400 million in Germany and €200 million in Austria) and whether the target is ‘active in Germany/Austria to a significant extent’ (despite not generating turnover in the relevant jurisdiction above the existing threshold). These new thresholds were driven by the desire to have the jurisdiction to review transactions in the digital sector (and early stage pharmaceutical sector transactions). Digital sector transactions are often driven by data and user numbers (as the cases considered above make clear). For example, a free consumer app might generate no revenue in Germany (if advertising is not sold on the app), but millions of German (or Austrian) consumers may use the app and, as a result provide data to the app developer. The German and Austrian authorities have produced joint guidance addressing the circumstances in which the requisite ‘local nexus’ is present.
While the EU Merger Regulation has not yet been modified in the same manner, the consultation run by the European Commission in the last quarter of 2016 addressed whether the current turnover-based thresholds are effective. The Commission explicitly referred to the debate that subsequently triggered the German and Austrian amendments, and noted that a purely turnover-based threshold might not capture all transactions with the potential to affect the internal market, particularly in the digital and pharmaceutical industries. The Commission noted that, in those sectors, a target may have generated little turnover, but may play a competitive role, hold commercially valuable data or have considerable market potential for other reasons. To date, the Commission has not taken further steps towards amending the EU Merger Regulation to introduce new thresholds. This may in part reflect one of the broad themes in many of the responses to the consultation, namely that the existing system for referrals of concentrations from the Member States to the Commission has meant that no material concentrations in these sectors has failed to be appropriately reviewed. For example, Facebook/WhatsApp was referred to the Commission through the Form RS referral procedure, and Apple/Shazam was referred at the request of the Austrian and other competition authorities.
The Commission has developed a framework for assessing the competitive effects of mergers focused on the acquisition of data, whether horizontal (through the combination of data sets) or vertical (through the combination of data that can be used as an input with activity in potentially relevant ‘downstream’ markets). That framework appears to be robust enough to assess use of data in machine learning to improve and enhance algorithms, in addition to the use of data to identify consumers and record their behaviour (whether for targeting online advertisements or for other purposes).
However, recent cases suggest that there are two key elements of the analysis that require particular vigilance, namely whether the data set(s) in issue can be substituted with comparable or fungible alternatives (or whether access to precisely the same data is required), in light of the particular uses that are intended for the data or to which it could be put in the future.
Finally, it appears that the debate as to whether the data protection and privacy interests of individuals should be taken into account in the competitive assessment of concentrations is not yet over. With other potential revisions to the EU Merger Regulations still under discussion, it would be premature to dismiss this pressure out of hand.
 Miranda Cole is a partner at Covington & Burling LLP.
 ‘Competition in a big data world,’ Vestager, DLD 16 Conference, Munich, 17 January 2016.
 Case C-418/01 IMS Health GmbH & Co OHG v. NDC Health GmbH & Co KG  ECR I-05039
 Case AT.39654.
 Case AT.39745.
 Case No COMP/M.4854.
 Case No COMP/M.4942.
 Telefónica UK/Vodafone UK/ Everything Everywhere/JV Case No COMP/M.6314.
 Commission Decision of 6 December 2016 in Case M.8124
 ‘Competition in a big data world,’ Vestager, DLD 16 Conference, Munich, 17 January 2016.
 Statement of the EDPB on the data protection impact of economic concentration, 27 August 2018.
 Commission decision of 17 May 2017 in Case M.8228 – Facebook/WhatsApp at paras, 62, 63, 71, 74 and 86.
 Commission Decision of 6 December 2016 in Case M.8124 – Microsoft/LinkedIn.
 id. at paras. 179-180.
 Commission Decision of 7 October 2011 in Case No COMP/M.6281. See also judgment of the General Court in Case T-79/12 Cisco Systems Inc. and Messagenet SpA v. European Commission.
 Commission Decision of 3 October 2015 in Case COMP/M.7217 Facebook/WhatsApp.
 Commission Decision of 4 September 2012 in Case COMP/M.6314 – Telefónica UK/Vodafone UK/Everything Everywhere/JV.
 id. at para. 543.
 id. at para. 557.
 Data Ethics event on ‘Data as Power,’ Vestager, Copenhagen, September 9, 2016.
 Joined Cases C-241/91 P and C-242-91 P, RTE and ITP v. Commission  ECR I-00743.
 See, for example, Case C-7/97, Oscar Bronner GmbH & Co. KG v. Mediaprint Zeitungs und Zeitschriftenverlag GmbH & Co. KG  ECR I-07791 and Case C-418/01, IMS Health GmbH & Co. OHG v. NDC Health GmbH & Co. KG  ECR I-05039.
 Commission Decision of October 3, 2014 in Case M.7217 – Facebook/WhatsApp.
 id. at para. 166.
 id. at paras. 188-189.
 Commission Decision of December 21, 2016 in Case M.8180 – Verizon/Yahoo!.
 id. at para. 93.
 Commission Decision of February 18, 2010 in Case M.5725 – Microsoft/Yahoo! Search Business.
 id. at para. 184.
 ‘LinkedIn full data’ refers to all the data that LinkedIn collects, or could collect, and store about its users and their activity, such as professional details, connections, interests, posts, endorsements. See, Microsoft/LinkedIn, at para. 58.
 Guidelines on the assessment of non-horizontal mergers under the Council Regulation on the control of concentrations between undertakings, OJ C 265, 18.10.2008, p. 6–25.
 Microsoft/LinkedIn, at paras. 246-250.
 id. at paras. 257-264.
 LinkedIn full data was found to be relevant only for machine learning in the CRM B2B marketing and B2B Sales segments, which accounted for less than 30 per cent of CRM software solutions. Moreover, LinkedIn was only one of many data sources available to competing CRM software providers, and the LinkedIn full data was not available. See, id. at paras. 275-276.