Under new German orders, Facebook will need to obtain consent before combining user data from across its platforms.

The order applies to data gathered from Facebook, WhatsApp and Instagram as well as data from third-party sources Facebook uses to build its data resources.

The order was handed down by the Bundeskartellamt, or Federal Cartel Office (FCO), after an investigation which began in March 2016.

The FCO has given Facebook one month to appeal the decision.

In a Facebook blog post, Yvonne Cunnane, head of data protection at Facebook Ireland and Nikhil Shanbhag, director and associate general counsel dispute the ruling, saying the rules fall outside the FCO’s remit and cry unfair treatment that the ruling would be inconsistent with the laws that apply to any other company..

“The Bundeskartellamt’s decision misapplies German competition law to set different rules that apply to only one company,” says the ‘Why We Disagree With the Bundeskartellamt’ blog post.

The post reinforces Facebook’s commitment to complying to GDPR laws, and makes more than one mention of the “fierce competition” faced by Facebook in the German market.

“The GDPR specifically empowers data protection regulators – not competition authorities – to determine whether companies are living up to their responsibilities. And data protection regulators certainly have the expertise to make those conclusions. The GDPR also harmonises data protection laws across Europe, so everyone lives by the same rules of the road and regulators can consistently apply the law from country to country. In our case, that’s the Irish Data Protection Commission. The Bundeskartellamt’s order threatens to undermine this, providing different rights to people based on the size of the companies they do business with,” says the post.

“As a dominant company Facebook is subject to special obligations under competition law,” FCO president Andreas Mundt in a press statement.

“The company must take into account that Facebook users practically cannot switch to other social networks… The only choice the user has is either to accept the comprehensive combination of data or to refrain from using the social network. In such a difficult situation the user’s choice cannot be referred to as voluntary consent,” says Mundt.

If Facebook’s appeal fails, it will have four months to ensure data sources are not combined without consent.

Further reading

• Tech triumph or tone-deaf? Facebook’s home Portal »
• Google slapped with €50 million fine over GDPR breach »

Image credit: David Tran © 123RF