Antitrust, Big Data, and Privacy in Europe

Photo: Shutterstock
Beginning in 1995 with the creation of the Data Protection Directive, the European Union has charted an audacious, innovative path in its regulation of data, privacy, and, tech monopoly. Here, in preparation for our 6/29/2016 event - America's Monopoly Problem - we've compiled a timeline of some of the EU policies and decisions that most shaped technology, data, privacy, and competition policy in Europe and across the world. 

October 1995 - European Union representatives adopt the Data Protection Directive, laying out rules and protections for personal data, including the requirement that non-EU countries handling personal data must abide by EU data rules. 

July 2000 - EU authorities rule that the US has satisfactorily instituted “Safe Harbor" principles under which the US can handle European data while abiding by EU data rules. 

December, 2000 - Representatives of the EU proclaim the Charter of Fundamental Rights, which consolidates and codifies human rights for the EU in a variety of categories. It achieves full force of law in 2009 with the Lisbon Treaty. The charter includes a right to the protection of personal data. It states:

            1. Everyone has the right to the protection of personal data concerning him or her.

            2.  Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 

March 2004 - EU antitrust authorities levy record fine on Microsoft for anti-competitive practices related to the structure and bundling of its operating system and software products.

December 2004 - EU antitrust authorities order Microsoft to modify its Windows Operating System to give third party software developers a better opportunity to create and sell programs for Windows computers, and they require Microsoft to license certain pieces of code. The EU decision comes three years after the U.S. settled an antitrust case against Microsoft regarding the company’s bundling of its programs.

February 2008 - EU antitrust authorities levy record fine on Microsoft for failing to comply with 2004 antitrust decision.

February 2009 - Google joins EU antitrust complaint against Microsoft, arguing that Microsoft’s bundling of Internet Explorer is anti-competitive. Google’s joining of the case comes soon after Google introduced its own Google Chrome browser 

November 2010 - The European Commission launches antitrust investigation into Google following complaints from web businesses that Google gave preferential treatment to its own services while discriminating against rivals. Notably, the EC did not file formal complaints. (Here is a useful timeline of the lengthy Google-EU case)

March 2011 - Microsoft joins EU antitrust complaint against Google, banding together with other web companies that argue that Google downgrades rival sites and promotes its own services.

January 2012 - The European Commission proposes a comprehensive reform of the EU’s data protection rules, including a proposal providing for a “right to be forgotten,” requirements that EU provisions be followed if data is handled abroad, and rules establishing “responsibility and accountability for those processing personal data.

March 2013 - EU antitrust authorities fine Microsoft for failing to respect an antitrust commitment reached in 2009.

April 2013 - EU antitrust authorities publish Google’s proposals to address antitrust concerns. Google proposes to label promoted links to its own service so that users can distinguish between Google’s and other services.

June 2013 - The Guardian publishes information from Edward Snowden saying that Verizon provided massive amounts of user metadata to the US government under order from the FISA Court. This is the first of the Snowden disclosures, which will continue for the next two years.

December 2013 - EU antitrust authorities reject Google’s proposals to address antitrust concerns.

February 2014 - EU antitrust authorities accept Google’s new proposals to address concerns. Under the agreement, Google would ensure that non-Google sellers’ services would appear along with Google’s promoted services. However, EU authorities do not officially close the case against Google.

May 2014 - European high court rules that Google must abide by EU’s right to be forgotten provisions and remove "inadequate, irrelevant or no longer relevant” information when requested by a member of the public. (Here is a fact sheet on the decision from the European Commission)

September 2014 - News Corp. executive writes to EU competition commissioner calling for action on Google’s dominance, saying Google is a “platform for piracy. 

November 2014 - European Parliament members approve non-binding resolution urging EU antitrust authorities to consider breaking up companies (meaning Google) that use search engines to dominate markets.

April 2015 - EU antitrust authorities file formal antitrust complaint charges against Google over the companies’ promotion of its own shopping services. EU antitrust chief Margrethe Vestager said she will continue to look into other domains of Google service, such as travel and local services. The authorities also open a separate probe into Google’s Android Operating System, targeting Google for forcing smartphone makers to install Google products if they use the Android OS.

May 2015 - European Commission authorities unveil the Digital Single Market Strategy, a set of proposals to unify and ease e-commerce and internet activities across the EU, so that citizens can more easily use the internet across borders and boundaries.

June 2015 – European antitrust authorities launch investigation into Amazon’s e-books business. They sought to examine whether Amazon abused its dominant position through the use of clauses with European publishers, clauses which required publishers to inform Amazon if they offer more favorable terms to other digital retails.

October 2015  - European high court rules against Safe Harbor, striking down the data-transfer agreement after finding that European data is not sufficiently protected in line with EU data privacy rules. The decision is the result of allegations filed by Max Schrems, an Austrian data privacy activist, in which he said that Facebook was inadequately protecting his data according to EU privacy standards. Schrems said he based his allegations off disclosures from Edward Snowden which said that Facebook cooperated with the NSA to share user data.

December 2015 - The European Commission unveils the General Data Protection Regulationnew data protection rules that represent the completion of the 2012 proposal. The European Parliament adopts it in April of 2016. The new rules include provisions requiring access to information about how one’s data is used, rules requiring data breach notifications, data portability, and a clarified right to be forgotten regulation. The new rules also include provisions meant to limit data mining and user profiling.

February 2016 - EU and US authorities announce Privacy Shield, a data transfer pact between the two powers meant to address the data protection and privacy issues that led to the dissolution of Safe Harbor.

February 2016 - French data protection authorities order Facebook to stop tracking the data of people without Facebook accounts. They also order the company the halt the transfer of some personal data between the U.S. and the EU, the first significant action against a company for transferring data since the breakdown of Safe Harbor. 

March 2016 - German antitrust authorities open competition probe into Facebook, saying that Facebook may be using data in a way that abuses its dominant position in the market. 

March 2016 - German court rules against online shopping site for integrating Facebook’s ‘Like’ button into its site, saying the site failed to get consumers’ consent before transmitting their data to Facebook.

April 2016 - European data privacy authorities release opinion harshly criticizing Privacy Shield for including insufficient protections against American spying on European citizens and their data.  

April 2016 - News Corp. files formal complaint with the EU, accusing Google of “scraping” content from publishers to display the results of news articles.

April 2016 - EU files formal antitrust charges against Google over its Android platform, accusing the company of pressuring phone makers and telcos to favor Google services.

April 2016 - Getty files complaint against Google for scraping content from content providers and facilitating piracy.

May 2016 - French and German antitrust authorities release a report exploring the relationship between big data and competition / antitrust policy. In it, they write that:

-    It might be worthwhile, in some cases, to use antitrust efforts/ tools to fight data dominance.

-    Most cases heretofore have been premised on firms ability to derive market power from an ability to hold way more data than competitors.

-    Data may appear very widespread, something that everyone can collect, but some data may be non-substitute-able, and collecting some types of data is dependent on building big enough market power to begin with.

May 2016 - European Commission releases report on online platforms as they relate to the Digital Single Market. In the report, they write that:

-    Platforms have a responsibility for the public good and they must be encourage to voluntarily    fight hate speech, incitement, child abuse images.

-    Europeans will use sector specific regulation to ensure that revenue is fairly distributed between distributors (often platforms) and rights-holders, and to help stop children from accessing inappropriate content.

-    Platforms must effectively inform users about when data is collected and how it is used.

-    More information is needed to conclude whether there are problems with business-to-business relationships in relation to platforms, especially as to how this may hurt innovation.

May 2016 - Irish Data Protection Commissioner says she will refer to the European High Court a case challenging Facebook’s ability to continue transferring data, given the demise of Safe Harbor, and because Facebook is still subject to surveillance. The US government, the Business Software Alliance, the U.S. Chamber of Commerce, and others request to be included in the case.

May 2016 - French authorities launch competition inquiry into the digital ad sector, specifically looking into Google and Facebook.

May 2016 - European Parliament adopts non-binding resolution urging the European Commission to re-negotiate Privacy Shield, citing concerns about insufficient redress capabilities and saying the deal does not adequately guard against US surveillance.

May 2016 - EU data privacy regulator releases opinion saying Privacy Shield isn’t robust enough and that it does not adequately defend against surveillance of European data.

June 2016 – Antitrust authorities reportedly take steps that could lead to a third antitrust complaint against Google, this time regarding the company’s behavior in the digital ad business.