Introduction

On 4 July 2023, the Court of Justice of the European Union (CJEU) issued a decision regarding the case C-252/21 Meta Platforms and Others (the Judgment). The Judgment brings forward several points that will have a significant impact, not only on the privacy and data protection landscape of the European Union (EU), but also on the scope of the national competition authorities’ powers. Bearing in mind the pivotal relevance of the Judgment for the industry, in this article we will discuss the CJEU’s key conclusions and shed light on their potential implications for the acquis of EU competition law.

Preliminary ruling by the CJEU

The Judgment has come about following a 2019 decision by the German competition authority, the Bundeskartellamt (BKartA), which established a case of abuse of market of power because of a violation of the General Data Protection Regulation (GDPR). As the decision was being contested before the German courts, on 22 April 2021 the Higher Regional Court of Düsseldorf in Germany requested the CJEU for a preliminary ruling with respect to questions on the limitation of a national (competition) authority's power, in this case, the BKartA, and the interpretation of the GDPR. Forward to 4 July 2023, the CJEU passed its judgment on the matter and upheld the decision by BKartA.

Scope of national authorities’ powers

As a relevant point from a competition law perspective, the CJEU established that the BKartA did not exceed its powers when also determining a violation of the GDPR while investigating an abuse of dominant position, as that finding was necessary to establish the existence of abuse of a dominant position on the internal market within the meaning of Article 102 of the Treaty on the Functioning of the EU (TFEU). The CJEU added, however, that to determine such violation, a national competition authority must follow any decisions or investigations conducted by the data protection authority. Following this reasoning of the CJEU, it could be argued that the Dutch competition authority Autoriteit Consument & Markt (ACM), for example, must follow the lead of the Autoriteit Persoonsgegevens (AP) with respect to establishing violations of the GDPR. This is also plausible given the agreed upon rules for mutual cooperation pursuant to the protocol signed between the ACM and the AP on 18 June 2020 (and published on 10 July 2020) (the Protocol), which stipulate, among others, that the AP has jurisdiction in cases involving the processing of personal data (Article 9(4) Protocol) and in case of concurrent powers, the ACM and AP shall consult each other on the possible (joint) handling of the matter (Article 9(1)(2) Protocol).

Potential class actions risks

The Judgment also opens the door for potential litigation, also in class actions. On the one hand, based on Article 1(1) of the Cartel Damages Directive (CDD), anyone who has suffered harm caused by an infringement of competition law by an undertaking can effectively exercise the right to claim full compensation for that harm from that undertaking. In this respect, an infringement of competition law is to be understood as an infringement of Article 101 or 102 TFEU, or of national competition law. A considerable challenge in this respect would of course be to calculate and prove the amount of damages incurred due to a violation of (in this case) the GDPR.

On the other hand, the Judgment may help pave the way for a claim organization to initiate a class action claiming damages based on alleged GDPR violations. In the Netherlands, similar cases based on such grounds have been brought against social media platform TikTok as well as against data brokers Oracle and Salesforce. Since the introduction of a new Dutch class action regime a few years ago (WAMCA), allowing for a collective claim for monetary damages, big tech companies are increasingly being targeted by class actions.

Digital Markets Act

In addition to the Judgment, the developing European competition landscape will further impact digital platforms going into the future. A major development is brought about by the Digital Markets Act (DMA), a significant piece of EU legislation that entered into application on 2 May 2023 and aims to address issues on digital markets related to competition and market dominance. In particular, the DMA concerns regulation that seeks to curb the market power of so-called ‘gatekeepers’ among online platforms and, thus, prevent and eliminate unfair trading practices. As such, the DMA is complementary to (EU and national) competition rules and intervenes ex ante in digital markets using competition law-inspired provisions.

The European Commission (EC) will first have to designate which online platforms qualify as gatekeepers on digital markets. After such designation concrete obligations from the DMA will apply. Enforcement of these obligations is possible from 6 March 2024 onwards. the EC received notifications from the following companies self-assessing as potential gatekeepers by the deadline of 3 July 2023: Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft, and Samsung. By 6 September 2023 at the latest, the EC will have to assess whether these companies meet the relevant thresholds and should indeed be designated as gatekeepers.

Conclusion

All in all, the Judgment has important implications for privacy and competition law. The CJEU upheld the German competition authority's decision and clarified the powers of national competition authorities, affirming their authority to establish GDPR violations but requiring them to collaborate with data protection authorities when investigating such violations. By affirming the link between competition law and data protection law, the CJEU has set the stage for potential cartel damages cases that originate from violations of data protection law. This development adds another litigation opportunity in the legal sphere of cartel damages for potential claimants. The future will tell how digital markets will develop in light of the Judgment and other upcoming legislation. In any case, the EU's judicial and legislative branches seem to value the restraining of market power of large digital platforms and thereby intending to improve the level of competition within the (digital) internal market.