At Privacy International, we’re concerned by the market trend of companies accumulating vast amounts of data for exploitation by buying other companies that already have vast amounts of data primed for exploitation.
This allows these larger firms to further entrench their market dominance, and to dictate future innovation built upon the exploitation of our data. Fortunately, competition regulators are starting to agree with us.
In November 2019, Google announced their plan to acquire Fitbit, a company that produces and sells health tracking technologies and wearables.
The proposed acquisition raised a series of concerns with regard to its implications for consumers’ data privacy rights, considering the vast amounts of sensitive personal data held by Fitbit, which can include details of individuals’ heartbeats, calorie intake, walking distances, sleeping patterns, and health conditions.
…the vast amounts of sensitive personal data held by Fitbit can include details of individuals’ heartbeats, calorie intake, walking distances, sleeping patterns, and health conditions
At the same time, the transaction poses the more general question of whether data should form part of competition regulators’ assessment of acquisitions.
Two regulators, the Australian Competition and Consumers Commission (ACCC) and the European Commission’s Directorate-General for Competition, have indicated in their preliminary findings that they agree there is indeed a strong interplay between data and competition.
How Fitbit data boosts Google’s services – and their power
The exploitable value of personal data increases as more and more data is combined.
This incentivises companies to pursue business strategies aimed at collecting as much data as possible.
The acquisition of vast quantities of data is what allows companies like Google to make billions of dollars each year via targeted advertising. In 2019, for example, Google’s parent company, Alphabet, generated 83% of its $161.86 billion in revenue from targeted advertisements to users of their consumer-facing services, including the Android operating system, Google Search, YouTube, and many others.
A big part of Fitbit’s value is said to lie in the quality of the health data it possesses. The company’s technologies can track individuals’ daily steps, distance walked or travelled, calories burned, sleep patterns and heart rate. In 2018, Fitbit also introduced ‘female health tracking’ to track menstruation cycles and fertility windows.
A big part of Fitbit’s value is said to lie in the quality of the health data it possesses
Recently, Fitbit further increased its health-related database and tracking capabilities by acquiring a number of other actors on the health tracking and wearables market, including FitStar, Pebble, Vector and Twine Health. Some of these acquisitions include partnerships with health insurers.
The importance of such a vast data holding is very well-recognised by tech giants like Google, who consistently seem to regard consumers’ data as a business asset.
This asset is all the more valuable when a digital service provider is able to combine data from multiple sources, including across multiple services or platforms. For example, a 2018 paper by academics at the University of Oxford outlined the prevalence of third-party trackers on almost 1 million apps from the US and UK Google Play stores. The researchers found that most apps contain third party tracking, with Google present on 87.57% of apps tested.
The researchers found that most apps contain third party tracking, with Google present on 87.57%
Taking into consideration both the amount and sensitivity of Fitbit’s data, the proposed acquisition would further entrench Google’s existing significant market power in, among others, the search and digital advertising markets. This could be achieved by potentially merging Fitbit’s customer data and/or datasets with the ones held by Google, allowing the latter to enrich the extensive datasets and detailed consumer profiles it holds with sophisticated real time data about individuals’ health conditions and needs, as well as general information about their daily behaviour and bodily rhythms.
In other words, the Fitbit data would provide Google with an opportunity to, among other things, better map general search queries originating, for instance, from an extremely specific geographic area/location, or be able to offer advertisers ever more valuable insights into specific audiences by allowing the targeting of the latter based on health conditions, activity level, and emotional attributes.
Assessing a company’s data holding is therefore not solely a matter for data protection regulators, it also needs to be considered by competition regulators in their assessment of mergers in the digital economy sector.
The interplay between data and competition
While concentrations of data might traditionally have been seen as falling outside of competition regulators’ remit, we are part of a new emerging consensus that it should belong within the scope of an assessment of an undertaking’s market dominance. As the German competition authority (Bundeskartellamt) noted in the first decision of this nature, in February 2019, against Facebook:
Monitoring the data processing activities of dominant companies is […] an essential task of a competition authority, which cannot be fulfilled by data protection officers.
The German Federal Court of Justice (Bundesgerichtshof), which upheld the Bundeskartellamt‘s findings in its judgment of 23 June 2020, found that Facebook abuses its dominant position by withholding options for users to limit the use of their data for personalisation of both Facebook content and advertisements on third-party websites that use Facebook’s digital advertising tools. As such, privacy is explicitly recognised as a parameter of competition; effective competition in the social media network market would result in privacy safeguards for users, and it is within the remit of a competition authority to act in response to anticompetitive and privacy-infringing conduct.
…effective competition in the social media network market would result in privacy safeguards for users
In the context of its review of the Google/Fitbit merger, in June 2020, the ACCC published its Statement of Issues (SOI) outlining preliminary competition concerns. The SOI suggests that the vast amounts of personal data Google would be getting access to was one of the key factors considered by the regulator. For example, underlining the unique and sensitive nature of the data held by Fitbit, the ACCC notes:
A similar approach, when it comes to the importance of personal data in assessing the implications of the merger, is followed by the European Commission. Following the end of its initial investigation of the proposed acquisition, on August 4, the EU regulator announced the opening of a more extensive, in-depth review of the transaction. Among their primary concerns was the fact that by relying on Fitbit data, Google would be gaining “an important advantage in the online advertising markets”.
The way forward: advancing digital rights through competition law
The announcements by the two competition regulators discussed above should be welcomed as a progressive step to adapt competition law frameworks to digital economies of scale.
More importantly, these decisions could, first, pave the way towards a competition regime that can better encompass people’s rights, by, for example, ensuring that effective competition exists also when it comes to privacy standards offered by companies.
In data-intensive digital markets, companies that occupy dominant positions have very little incentive to adopt business models or practices that enhance consumers’ privacy.
…companies that occupy dominant positions have very little incentive to adopt business models or practices that enhance consumers’ privacy
Google’s acquisition of Fitbit would further reduce any competitive pressure on Google to compete on these non-price (i.e. quality, privacy) aspects, since the acquisition would further entrench Google’s dominance and preclude the possibility of competition from another entity acquiring or partnering with Fitbit to compete with Google in this space. A competition intervention in this case could potentially prevent any data exploitation practices (e.g. through the use of so-called “dark patterns“, namely features meant to trick users into privacy-intrusive settings) that would impose more intrusive terms as regards data collection and have negative connotations for consumers.
Second, the approaches adopted by the ACCC and the European Commission might signal further opportunities for civil society to intervene and support regulators with their digital rights expertise. Such opportunities, arising also in the context of the Google/Fitbit merger, were actively discussed during DFF’s June 2020 virtual event, which focused on competition law and actions involving data.
Civil society involvement is contributing to the outcome of this debate. Privacy International has made submissions before both the ACCC and the European Commission, and has been granted interested third person status by the latter. Similarly, in July 2020, IDEC, the Brazilian Institute of Consumer Protection, officially requested that the Brazilian Antitrust Authority (CADE) formally scrutinize this merger in Brazil.
We welcome the opportunity to assist regulators in their review of a merger. We are hopeful that they will seize the unique opportunity they have to also advance peoples’ rights by sending a strong message against data exploitation practices that seek to harm consumers’ well-being in the digital age.
Google-Fitbit is just another instance of what otherwise will be a growing trend. Both the ACCC and the European Commission are expected to announce their decision by 9 December 2020. We have a lot of work to do between now and then.
Ioannis Kouvakas is a legal officer at Privacy International (PI). He also leads PI’s work on challenging data dominance.