Restrictions on Privacy and Exploitation in the Digital Economy: a Competition Law Perspective Nick Economides and Ioannis Lianos Centre for Law, Economics and Society CLES Faculty of Laws, UCL Director: Dr. Deni Mantzari Founding Director: Professor Ioannis Lianos CLES Research Paper Series 5/2019 Restrictions on Privacy and Exploitation in the Digital Economy: A Competition Law Perspective Nick Economides and Ioannis Lianos August 2019 Centre for Law, Economics and Society (CLES) Faculty of Laws, UCL London, WC1H 0EG The CLES Research Paper Series can be found at https://www.ucl.ac.uk/cles/research- papers Pre-published version of Nick Economides & Ioannis Lianos, Restrictions on Privacy and Exploitation in the Digital Economy: A Competition Law Perspective, in I.Lianos & A. Ivanov (ed.), BRICS Digital Competition Law Report (BRICS Competition Law and Policy Centre, 2019). Also available as a BRICS Competition Law and Policy Centre research paper. All rights reserved. No part of this paper may be reproduced in any form without permission of the authors. ISBN 978-1-910801-29-1 © Nick Economides and Ioannis Lianos 2019 Centre for Law, Economics and Society Faculty of Laws, UCL London, WC1H 0EG United Kingdom Restrictions on Privacy and Exploitation in the Digital Economy: A Competition Law Perspective Nicholas Economides & Ioannis Lianos* Abstract: The recent controversy on the intersection of competition law with the protection of privacy, following the emergence of big data and social media is a major challenge for competition authorities worldwide. Recent technological progress in data analytics may greatly facilitate the prediction of personality traits and attributes from even a few digital records of human behaviour. There are different perspectives globally as to the level of personal data protection and the role competition law may play in this context, hence the discussion of integrating such concerns in competition law enforcement may be premature for some jurisdictions. However, a market failure approach may provide common intellectual foundations for the assessment of harms associated to the exploitation of personal data, even when the specific legal system does not formally recognize a fundamental right to privacy. The paper presents a model of market failure based on a requirement provision in the acquisition of personal information from users of other products/services. We establish the economic harm from the market failure and the requirement using the traditional competition law toolbox and focusing more on situations in which the restriction on privacy may be analysed as a form of exploitation. This emphasis on exploitation does not mean that restrictions on privacy may not result from exclusionary practices. However, we analyse these in a separate study. Eliminating the requirement and the market failure by creating a functioning market for the sale of personal information is imperative. Besides the traditional analysis of the requirement and market failure, we note that there are typically informational asymmetries between the data controller and the data subject. The latter may not be aware that his data was harvested, in the first place, or that the data will be processed by the data controller for a different purpose, or shared and sold to third parties. The exploitation of personal data may also result from economic coercion, on the basis of resource-dependence or lock-in of the user, the latter having no other choice, in order to enjoy the consumption of a specific service provided by the data controller or its ecosystem, than to consent to the harvesting and use of his data. A behavioural approach would also emphasise the possible internalities (demand-side market failures) coming out of the bounded rationality, * Nick Economides is professor of economics at NYU Stern Business School and executive director of the Networks Institute. Ioannis Lianos is professor of Global competition law and policy at UCL Faculty of Laws, Director of the Centre for Law, Economics and Society at UCL and Academic Director of the BRICS Competition Law and Policy Institute at the Higher School of Economics – National Research University. The authors would like to thank Tobias Kleinschmitt, Gautam Natarajan and Matthew J. Strader for their valuable research assistance. Any errors or omissions are the authors’ alone. The paper expresses personal opinions and does not represent the views of the Hellenic Competition Commission. 4 or the fact that people do not internalise all consequences of their actions and face limits in their cognitive capacities. The paper also addresses the way competition law could engage with exploitative conduct leading to privacy harm, both for ex ante and ex post enforcement. With regard to ex ante enforcement, the paper explores how privacy concerns may be integrated in merger control as part of the definition of product quality, the harm in question being merely exploitative (the possibility the data aggregation provides to the merged entity to exploit (personal) data in ways that harm directly consumers), rather than exclusionary (harming consumers by enabling the merged entity to marginalise a rival with better privacy policies), which is examined in a separate paper. With regard to ex post enforcement, the paper explores different theories of harm that may give rise to competition law concerns and suggest specific tests for their assessment. In particular, we analyse old and new exploitative theories of harm relating to excessive data extraction, personalised pricing, unfair commercial practices and trading conditions, exploitative requirement contracts, behavioural manipulation. We are in favour of collective action to restore the conditions of a well-functioning data market and the report makes a number of policy recommendations. Keywords: digital, privacy, restrictions of competition, exploitation, market failure, hold up, merger, abuse of a dominant position, unfair commercial practices, excessive data extraction, self-determination, behavioural manipulation, remedies, portability, opt out. JEL: K21, L12, L4, L41 5 Restrictions on Privacy and Exploitation in the Digital Economy: A Competition Law Perspective Nicholas Economides & Ioannis Lianos* 1. Introduction ....................................................................................................................................... 6 2. Privacy and Market Failures ......................................................................................................... 13 2.1. Market failures through exclusionary and exploitative requirement contracts bundling digital services with personal data ............................................................................................................... 14 2.2. Natural monopoly or natural oligopoly and market failure in privacy ...................................... 24 2.3. Lock in and Hold up .................................................................................................................. 27 2.4. Information asymmetries and information related failures ........................................................ 28 2.5. Missing markets ......................................................................................................................... 29 3. Exploitative and exclusionary conduct involving privacy-related theories of harm: ex ante and ex post enforcement ..................................................................................................................... 30 3.1. Ex ante enforcement: data mergers and privacy ........................................................................ 30 3.2. Ex post enforcement: abuse of a dominant position or economic dependence .......................... 35 3.2.1. Excessive data extraction .................................................................................................... 36 3.2.2. Personalised pricing ............................................................................................................ 46 3.2.3. Unfair commercial practices and trading conditions .......................................................... 50 3.2.4. Exploitative requirement contracts ..................................................................................... 65 3.2.5. Behavioural manipulation ................................................................................................... 66 3.3. Remedies .................................................................................................................................... 72 4. Conclusion ....................................................................................................................................... 76 1. Introduction The recent controversy on the intersection of competition law with the protection of privacy, following the emergence of big data and social media is a major challenge for competition authorities worldwide. The concept of ‘big data’ is usually employed to refer to gigantic digital datasets, which are often held by corporations, governments and other large * Nick Economides is professor of economics at NYU Stern Business School and executive director of the Networks Institute. Ioannis Lianos is professor of global competition law and policy at UCL Faculty of Laws, Director of the Centre for Law, Economics and Society at UCL and Academic Director of the BRICS Competition Law and Policy Institute at the Higher School of Economics – National Research University. The authors would