Over recent years there has been a raft of developments at the intersection of competition law and data protection. Both the UK and EU have introduced legislation to regulate the way in which large online platforms compete including a number of requirements around the use, collection and sharing of personal data (namely the DMA in the EU and the UK equivalent which is currently passing through Parliament). These issues have also been before the courts; last year the CJEU found that an infringement of the provisions of the GDPR may constitute the basis for a finding of infringement of competition law by a national competition law authority (in the context of a case concerning the way that Facebook collects data).
Now, in a different case, the Opinion of AG Szpunar handed down last week suggests that it is also permissible for an action of this kind to be brought by a competitor (rather than a competition authority) in private enforcement under the national competition rules. This is the case even though the competitor bringing the action for an injunction is not a beneficiary of the protection provided for by the GDPR which is limited to data subjects. The AG considers that the possibility of private enforcement of this kind reinforces rather than undermines the effectiveness of the GDPR.
Following Brexit, this Opinion (and any decision of the CJEU which is to follow) will not be binding on the UK courts which is itself considering the cross-over of competition law and data protection in a collective action brought against Meta. That action seeks redress for an alleged abuse of dominance in the way in which Facebook has made users' access to its services contingent on the provision of personal data. The litigation is still in the very early stages, having only recently obtained certification to proceed as a collective action following various initial stumbling blocks. If the case does proceed to the substantive issues, it will be interesting to see what approach the UK courts take in this area.
an injunction brought by an undertaking against a competitor in reliance on the infringement by that competitor of the provisions of the GDPR may exist alongside the remedies established in Chapter VIII of the GDPR
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
