Challenges enforcing public policies on data protection and competition in digital markets: an Argentinian perspective

Back to Technology Law Committee publications

Nadine Bengtsson
Bomchil, Buenos Aires
Nadine.bengtsson@bomchil.com

Introduction

The development of worldwide technological markets has given rise to new standards and discussions regarding competition policies and regulatory agencies’ enforcement of data protection. In a context where data is constantly used by technological markets, to create innovative technologies and gain competitive advantage, regulatory authorities must decide on proper strategies to monitor digital markets from both privacy and competitive standpoints. Personal data in particular is being increasingly traded between businesses and consumers, either as a raw material or aggregated and analysed, and has become a valuable asset in these markets. Currently, users and data-driven companies are interacting to produce apps such as Wibson which connects data buyers with data sellers. However, not everyone is willing to sell their data, which has been proven by the increasing number of users who have chosen DuckDuckGo as a ‘privacy-friendly’ search engine over Google, which has been known to use personal data for profiling. In turn, consumers are looking for an optimal amount of privacy in online services, some even considering their choice is limited, namely accepting the collection of a comprehensive combination of data or refraining from using a digital product/service. Some companies, conscious of this, are even competing to offer consumers greater levels of privacy than their competitors.

Considering that data is the price consumers pay for accessing various online offerings, how that personal information is treated by businesses is becoming a competition issue where rivalry is focused on non-price effects. In fact, competition in digital markets have been analysed in depth by competition authorities, affirming that this rivalry is based on these effects.^[1] These non-price effects differ from traditional price effects in a competitive analysis. An acquisition which competes not on price but on product quality and variety, research and development (R&D), zero-price (such as collection of data) and network effects to generate efficiencies are becoming a source of horizontal differentiation between companies in the market.^[2] In this regard, data-driven companies such as Google, Facebook and Microsoft (to name a few), are under the competition authorities’ close watch.^[3] This article seeks to examine the interaction between privacy and competition policies for digital markets in Latin America, mainly in Argentina, following well-versed discussions and international case law on the most appropriate way to address ‘zero-price’ effects.

Enforcement of public policies on data protection and competition in technological markets

In light of the above, both antitrust and privacy laws are powerful tools aimed at defending consumer welfare and possibility of choice. At a first glance, competition and privacy laws seek different objectives, although ultimately, they protect the overall general economic interest and control power irregularities between companies and consumers. As summarised by Newman: ‘More specifically, information-related privacy violations occur where individuals involuntarily share information. Antitrust law is perfectly inverse: it is concerned only with voluntary exchanges.’^[4] On one hand, privacy regulation protects individuals’ right to access and protect their personal data from misuse or unauthorised exposure. From a privacy perspective and since the renowned Cambridge Analytica case, big data^[5] intrinsically implies a privacy menace for the authorities, raising concerns with the vulnerability of users’ personal data to potential breaches, loss of control over their digital identities and profiling.^[6]

On the other hand, competition regulation aims at safeguarding consumer welfare by ensuring fair and free competition in the markets guided by economic principles which aim to evaluate a firm’s market power from a price-related analysis, for example, the application of the small but significant and non-transitory increase in price (SSNIP) test or the Herfindahl-Hirschamn Index (HHI). From an economic perspective, competition authorities usually analyse traditional trading practices which entail an exchange between a business selling goods or services and a consumer who is willing to purchase the said goods or services for a certain price, which is commonly determined by calculating marginal costs, economies of scale and pricing strategies of other players in the market offering the same goods or services in a market. Whereas, in a study of zero-pricing models, as pricing is reduced to zero businesses and consumers trade goods or services in exchange for personal data, attention or other information. As established by Newman, ‘to profitably offer products at a price of $0 in the long term, a rational firm must intend to turn a profit in some manner not involving those products’.^[7] In this fashion, companies could profit from their traded good or service by using the exchanged data to offer a complementary good or service, to implement a ‘freemium’ strategy (ie, offering a basic version of a good or service for nothing), while offering a higher premium version at a price, to provide feedback for their multisided platforms or for promotional purposes such as online advertising. As a result, a transaction that is initially seen as ‘free’ has indirect costs to the user which are not necessarily reflected in the price, such as users’ privacy and conventional methods of analysis used by competition authorities to determine economic factors impacting price strategies have become insufficient when evaluating companies offering goods or services under a zero-price model. In Newman’s opinion, ‘abandoning oversight of zero-price markets to privacy law simply because information (instead of money) is the relevant currency would be a grave error’.^[8]

In this direction, while some public policies foster technological companies to expand by granting tax incentives and offering the protection of a robust intellectual property rights system, others regulate companies’ market power to guarantee that no major discrepancies in power are generated between users and companies. On one hand, under a libertarian approach, it could be stated that data-driven markets are self-regulated and, therefore, no regulatory enforcement is required. For some scholars, data has little, if any, competitive significance, since it is ubiquitous, low cost and widely available.^[9] As a result, dominant firms cannot exclude smaller companies.

Following this approach, the current tools of competition analysis can fully address all major data issues and in any event, market forces are solving privacy issues. On the other hand, an interventionist approach would instead require the involvement of the authorities to regulate their competitive behaviour directly when companies are becoming excessively large. Favouring the Chicago School theory,^[10] intervention is only necessary if a transaction negatively impacts (generates a negative externality) or harms consumer welfare, not other competitors. Some scholars are even suggesting the creation of new authorities and legislative amendments to regulate big-tech companies.^[11]

Overview of global trends in enforcement of competition and data protection laws

The optimal market structure for encouraging investment and innovation remains an unsettled issue. Which should be the authorities entitled to enforce compliance of public policies to ensure consumers’ privacy and welfare is also still under discussion at a global level. In cases such as Google/DoubleClick, Microsoft/LinkedIn, Just Eat/Hungry house and Facebook/WhatsApp, to name a few, competition authorities from Europe^[12] and the US^[13] have studied whether privacy is a competition concern and assessed whether competition law can be understood as broad enough to contemplate privacy as a qualitative variable following a traditional price-related analysis, or rather new empirical qualitative methods should be used to consider non-price aspects of competition.

For instance, the case TREB v Canada, which was initially classified as a right to forget case, but turned into a competition investigation due to TREB’s imposition of restrictive conditions to its members’ use of real estate data.^[14] As well, the German Competition Authority has taken a stance against Facebook for allegedly abusing its dominant position to amass users’ data under unfair terms.^[15] On the contrary, in 2016 the European Commission (EC) approved the merger between Microsoft/LinkedIn, stating that:

‘The combination of their respective datasets does not appear to result in raising the barriers to entry/expansion for other players in this space, as there will continue to be a large amount of internet user data that are valuable for advertising purposes and that are not within Microsoft's exclusive control.’^[16]

Meanwhile, the Federal Trade Commission (FTC) expressed its reservations in the Google-DoubleClick merger stating that it lacks ‘legal authority to require conditions to this merger that do not relate to antitrust.’ Likewise the Organisation for Economic Co-operation and Development (OECD), when debating the application of personalised prices based on the processing of personal data in the form of profiling consumers in a discriminatory manner, argued that competition policies are not the only means that may protect consumers from these companies.^[17] However, in the Google-DoubleClick merger, the FTC’s Commissioner Pamela Harbour dissented the majority’s decision objecting to the traditional merger analysis and highlighting that ‘The truth is, we really do not know what Google/DoubleClick can or will do with its trove of information about consumers. The merger creates a firm with vast knowledge of consumer preferences, subject to very little accountability.’^[18]

Similar discussions can be seen in other jurisdictions. Recently, Japan’s Fair Trade Commission has introduced draft guidelines on the abuse of a superior bargaining position in transactions between digital platform operators and consumers that provide personal information.^[19] It proposed an amendment of merger guidelines to further regulate digital markets. Following an in-depth digital platforms inquiry, the Australian Competition and Consumer Commission (ACCC) published a set of recommendations for protecting consumer rights, privacy and competition given that ‘data protection and privacy laws can increase portability and compatibility of data such that consumers are able to readily port their data from one service provider to another, decreasing switching costs for consumers, lowering barriers to entry or expansion for rivals and increasing competition in data-driven markets’.^[20] For the ACCC, collaborating with technological developing companies may act as a catalyst for an ‘industry-driven change’ towards ensuring fair and level competition and user protection laws effectively, assisting the authorities to draft informed policy decisions in the future. These international cases set a clear relationship between effective competition and safeguarding data protection and innovation in digital markets.

Latin America: regional trends in the enforcement of competition and data protection laws

Tech companies have flourished in Latin America: MercadoLibre, Rappi, Nubank and Despegar being a few examples. Nonetheless, the question remains as to the direction to be taken by the Latin American regulatory authorities when deciding on whether to adopt or challenge international standards imposed in the above-mentioned case law using their current legal frameworks or drafting legislation to tackle new theories of harm and incorporate ‘zero-price effects’ in its scope.^[21]

At a regional level, in 2016, the Comisión Económica para América Latina y el Caribe (Economic Commission for Latin America and the Caribbean, abbreviated CEPAL) endorsed the idea of creating a regional digital market for Latin America and the Caribbean^[22] and stressed the importance of taking advantage of economies of scale through the development of regional digital networks and platforms. Although there has not been any specific regional statute to regulate digital markets, it is possible for Latin American countries to cooperate with regional partners and debate these markets following a coordinated approach. As a recent fruitful example of cooperation between regional partners, Argentina’s and Uruguay’s privacy authorities have recently issued joint guidelines on evaluating privacy impact assessments.^[23]

Notwithstanding, some Latin American countries have already begun to assess digital markets applying their own local regulatory frameworks. Regarding Uber, in July 2019 the Colombian privacy authority (Superintendencia de Industria y Comercio, abbreviated SIC) ordered a preventive measure to ensure the company’s compliance with data protection and cybersecurity requirements. In the following month, Uber was fined by the SIC for unfair competition practices, ordering the company to cease activities until it complied with the applicable passenger’s transport regulation framework, which eventually led to the firm fleeing the country.^[24] Similarly, Chile’s competition authority Fiscalía Nacional Económica (FNE) has taken the opportunity to review further the impact of Uber’s acquisition of another digital platform, CornerShop, on innovation in related and adjacent markets. In fact, it has concluded to continue investigating the merger partially due to,

‘the possibility that the notified transaction decreases the intensity of the competition to develop new innovative products or services in the markets. In effect, given that the parties are both digital platforms which participate in highly innovative markets and, specifically, in related segments, the notified transaction eliminates a relevant player, and could reduce the incentives for the resulting merged entity to innovate through the development of new services in related or adjacent markets’ (unofficial translation).^[25]

Moreover, Brazil’s competition council (Conselho Administrativo de Defesa Econômica, abbreviated CADE) has published a report with Brazil, Russia, India, China and South Africa (BRICS) on competition in the digital economy,^[26] where it stated that CADE has been analysing whether data information about consumers was an entry barrier during the analysis of a case in which Brazil's leading banks formed a joint venture for credit scoring. In this decision, CADE emphasised the existing correlation between privacy and competition policies in two-sided financial platforms by stating that ‘exploitation of big data by companies may pose to the protection of other users’ rights, such as the right to privacy. In this sense, CADE understands that the dynamics of digital platforms give rise to a close relationship between data protection, privacy and competition policy.’ Accordingly, CADE has taken the first step towards pursuing an active cooperation between competition and the Senacon (Consumer Protection Secretariat) and the Brazilian Data Protection Authority (Autoridade Nacional de Proteção de dados, abbreviated ANPD) to ‘deal with the multifaceted aspects of data in the digital world’.

Nevertheless, other Latin American countries such as Argentina are still waiting for their first public case where privacy will be examined as a non-price effect or key element in a competition case.

Enforcement challenges in Argentina

In Argentina, the National Constitution protects both the right to privacy as well as the rights of consumers to their economic interests, adequate and truthful information, freedom of choice and fair and dignified treatment (among others) through competition. From a regulatory point of view, the Argentine Data Protection Law (Law No 25,326) empowers users to initiate legal actions before the regulator (Access to Public Information Agency, 'AAIP') against companies using their personal data, and drafted legislation proposing the amendment of this law would further guard them from profiling activities.^[27] The Argentinian Competition Law (Law No 27,442) is broad enough to review competition-related situations subject to other regulatory frameworks, giving the competition authority (ANAC, currently under formation) broad enough tools to perform a dynamic analysis and users also to claim for civil damages stemming from antitrust violations before the courts.

Beyond the fact that the current Argentinian antitrust watchdog – the National Commission for the Defence of Competition (CNDC) – and the AAIP apply different statutes, they are both national administrative agencies in nature, which should allow for some level of interaction between them. In this sense, although the CNDC has been known to issue recommendations to other regulatory agencies in inter alia the banking, energy, ports and telecom sectors, it has still not established any dialogue in big data cases with the privacy regulator and its case law shows a relatively small number of cases that have dealt with non-price effects in the context of merger analysis.^[28] Regardless, neither privacy nor competition authorities have issued guidelines or recommendations studying digital markets that could anticipate technological companies how these authorities would interact nor how they would assess zero-price effects when evaluating mergers and anti-competitive practices. Such lack of case law could explain why the local authorities are not focusing on the preparation of guidelines that could assist in the interpretation of zero-price effects.

Argentinian authorities generally shadow European decisions, the CNDC would have no impediment to examine digital markets with a rather responsive, qualitative and dynamic approach by considering zero-price effects in their assessments and coordinating with the AAIP to evaluate if the consequence of both agencies’ decisions on a given data protection/antitrust case would enable disruptive innovation in the short term without losing a vigorous competitor in the long term or killing nascent markets.^[29] In this regard, enforcement authorities must balance the risks of intervening when there are no competition problems and not intervening when there is a one, risks that are boosted in dynamic markets with permanent technological changes.^[30]

Historically, the CNDC has approached technological cases according to a mostly static standard, where innovation deliberations are considered at the side-lines or within the larger analysis of the conditions of competition, as seen in the CNDC’s report on the Prisma case (banking card sector) and the merger between Cablevision/Telecom (internet, telecoms and media).^[31] The CNDC took a first step in this regard when establishing that: ‘several cases recognised dynamic efficiencies as key factors to determine the impact of a merger on the general economic interest, and those efficiencies were generally derived from non-price effects. These effects have to do with product quality and variety, research and development and with the entry of new competitors and the strengthening of existing ones.’ The recognition made by the CNDC in the Note to the OECD report^[32] and legal scholars shows the need to transform current statistic ways to analyse a merger to a more dynamic approach, representing a potential shift in the CNDC’s assessment of digital markets in future competition cases.

However, if these authorities were to interact with each other, a further challenge could arise if they were not to be aligned when deciding on a case. For example, in a theoretical case where each authority, within their respective scope, were to be reviewing a merger case involving zero-price effects, given that privacy is a delicate subject for individuals, which is generally considered best protected rather than potentially risking any exposure, privacy authorities could be more inclined to recommend preventive measures to ensure privacy risks are avoided,^[33] than competition authorities who could be leaning towards imposing remedies to promote data mobility/portability, interoperability and data openness to facilitate or grant access to new competitors in digital markets.^[34] Other regulatory agencies, such as the local telecoms regulatory authority, are also in charge of maintaining and ensuring the proper functioning of the different players in targeted sectors of the economy. Along this line, such other regulatory authorities, as consumer protection and fair trade agencies, could aid to set general standards for a specific sector subject to digital transformation.

It is worth highlighting that competition authorities might also be keen to use data mining, screening methods, artificial intelligence, or similar strategies to detect collusive conducts and/or to monitor the fulfilment of remedies/commitments. In fact, in cases where technologies are used as a system to form a digital cartel or using algorithms to collude, authorities could start to need to implement technological skills to find relevant evidence. Actually, as stems from the BRICS’ report, authorities such as CADE have already started to use an interface called Cérebro (‘brain’ in Portuguese) that provides data mining tools and automates analytics formerly conducted by investigators and case handlers to identify bid-rigging cartels.^[35] Data collected through mobile devices with geo-localisation technologies can also become extremely valuable in the context of judicial and administrative investigations. In such cases, the issue lies in determining the balance between shielding user’s privacy and giving the authorities their mobile data, and the reasonable legitimate justifications for authorities to demand access.^[36] Applied to competition cases, if according to a hearing, presumptions or evidence, competitors would have allegedly met at a certain time and place to coordinate prices of a certain product or service, access to this data could be a key factor to confirm and detect the effective location of individuals participating in cartels and/or collusive agreements. Without prejudice, privacy regulatory authorities may be more inclined to deny authorities access to this data if they deem the authority’s request is unjustifiable. In this regard, there has been some degree of interaction between the AAIP and the CNDC in relation to accessing public data, protected by the habeas data regime in Argentina. Recent cases,^[37] involve requests by private litigators to access information on mergers filings. Even if these cases do not strictly entail violations to the ‘right of privacy’, they are still interesting precedents in which two areas of the law intertwine (also enforced by the AAIP and the CNDC).

Another challenge faced by the authorities and the claimants in competition cases is the legal standing, evidence and quantification of damages caused by zero-price effects. As stems from the background notes of the Secretariat of the OECD: ‘Privacy can be quantified in some cases, although the degree to which it is quantifiable is limited by the lack of meaningful measures from a consumer and competition perspective.’^[38] As in abusive pricing cases, the authority will have to determine the reasonable criteria used to determine zero-price effects are harmful for its users, before imposing any penalties or remedies to contrast the consequences of the anticompetitive practice under analysis, and escape any contrary judicial decision revoking the Secretariat of Domestic Trade’s resolution in the case.

To elude the need of finding evidence and quantify damages, both authorities could prevent competition and privacy risks before there is any actual harm to users using soft law mechanisms such as drafting guidelines or investing in well-known preventive measures. Additionally, if the Argentinian competition regime finally transitions to a functional pre-merger control regime, as established in section 9 of the Competition Law, the competition authority could additionally constrain zero-price effects and collaborate to avert privacy authorities of prospective underlying privacy risks. Relatedly, the local privacy authority is increasingly drafting preventive guidelines to avoid any future privacy impact due to the deployment of current technologies by designing and testing privacy risks when developing artificial intelligence and before implementing this technology.^[39]

Even though these local authorities will have to decide according to the particulars of each case, authorities could start addressing these concerns in general terms by endorsing traditional soft law mechanisms (ie, by issuing guidelines and recommendations for digital markets) or by incorporating new soft law mechanisms that could prove useful to develop more adaptive policies by setting up policy labs, creating regulatory sandboxes,^[40] crowdsourcing policy making and implementing risk-based regulations.^[41] The use of sandboxes by local finance regulatory authorities to aid Fintech developments set an example for other local regulatory authorities to follow.

Nevertheless, any policy or standard adopted through a legislative process, jurisprudence or soft law would inevitably have to maintain institutional coherence with other regimes promoting technological development, something which will take time due to recurrent changes in the economic and political context of the country that generally prompt the authorities to shift their enforcement strategies. Furthermore, considering that the striving tech sector has the potential to place Argentina among the most innovative countries and boost its overall economic and social progress, incorporating such a standard is a challenge for local authorities.

Conclusion

In light of the above, despite the differences in privacy and competition policies and the background of these authorities enforcement history, they both ultimately seek consumers’ welfare. At an international level, competition authorities have been discussing existing and potential overlaps between these two legal regimes that have led to debated decisions which are quickly becoming leading cases. Anticipating how challenges in the interface between competition and data protection regimes can affect other jurisdictions, Latin American countries have opened the possibility of local enforcement authorities to fashion new standards and methods of analysis. Brazil and Colombia have already started imposing fines and remedies to slow down the negative zero-price effects of companies’ anti-competitive practices in digital markets. As for Argentina, we will probably see further discussions on how enforcement authorities should anticipate, brainstorm and arrive at a consensus on their stance towards international case law, following or challenging it to ensure that both data protection and competition interests are aligned with each other and with other consumer protection regulatory frameworks. Hopefully, competition and privacy authorities will continue to cooperate with regional partners, collaborate with digital platforms, elaborate new standards and set new policy-making mechanisms to define further their approach towards the most appropriate ways in which companies active in technological markets should be regulated.