Meta loses as top EU court backs antitrust regulators over privacy breach checks

Meta Platforms on Tuesday lost its fight against a German data curb order that strikes at the heart of its business model as Europe’s top court backed the German antitrust watchdog’s power to also investigate privacy breaches.

The ruling from the Luxembourg-based Court of Justice of the European Union (CJEU) potentially hand antitrust authorities more leeway in Big Tech probes.

The case centered on a challenge by Meta after the German cartel office in 2019 ordered the social media giant to stop collecting users’ data without their consent, calling the practice an abuse of market power.

At issue was whether the German antitrust agency overstepped its authority by using its antitrust power to address data protection concerns, which are the remit of national data protection authorities.

Meta harvests user data for behavioral advertising, a business model common to Big Tech.

Meta, owner of Facebook, Instagram and WhatsApp, challenged the finding, prompting a German court to seek advice from the CJEU.

In response to the ruling a Meta spokesperson said: “We are evaluating the Court’s decision and will have more to say in due course.”

The CJEU judges said regarding antitrust investigations that “it may be necessary for the competition authority of the member state concerned also to examine whether that undertaking’s conduct complies with rules other than those relating to competition law.

The CJEU, however, said antitrust regulators must “take into consideration any decision or investigation by the competent supervisory authority pursuant to that regulation.”

The German cartel office welcomed the ruling.

“Data is a decisive factor in establishing market power. The use of the very personal data of consumers by the large internet companies can also be abusive under antitrust law,” its head, Andreas Mundt, said.

His counterpart at the French competition agency, Benoit Coeure, in a tweet called the ruling a landmark decision on data protection as a competition parameter.

Thomas Graf, a partner at law firm Cleary Gottlieb, was more cautious on whether antitrust authorities would want to go into the details of privacy law.

“You still need to explain why it is relevant for antitrust law and demonstrate restrictive effects and abuse, and they will need to coordinate with the GDPR authorities,” he said.

The EU’s General Data Protection Regulation (GDPR) is a privacy and security law that imposes obligations on organizations anywhere which target or collect data related to people in the EU.

“Are antitrust authorities going to become GDPR regulators? I don’t think so,” Graf said.

Privacy activist Max Schrems, who has filed complaints about Meta, said the judgment will have a positive impact on his pending litigation with the company.