Rage Against Data Dominance: A New Hope

Interim report findings

Fast forward to December 2019. The UK Competition Authority published their interim report where they explain what they found so far and how they propose to move forward. While their 283-page report contains a handful of findings and proposals, we'll focus on the most important ones.
Facebook and Google have become way too big and this is also due to the amount of data they have on us
This might not come as a surprise to most of us (also, it is not the first time these tech giants are facing similar charges). However, the fact that the UK competiton authority did a whole economic analysis of the relevant markets to reach this conclusion is quite fascinating. What we find even more important, is that the personal data these companies have on their users was also considered by the regulator, as we will show right below.
The CMA report identifies two different markets either Facebook or Google might have demonstrated dominant practices: the search engine market and social media market. After all, deep inside you knew that there was something weird going on when Facebook was bombing you with friend suggestions of colleagues you were always trying to avoid or when Google could finish your search engine queries in milliseconds.

"Google has significant market power in the general search sector [and] search adverting"
It is not rocket science. The more data a search engine has, the better able it is to improve its algorithms and thus become more effective. For example, between a search engine with 1,000 users and another one with 1,000,000, one would be able to get a better understanding of what the majority of users wants when they search for "Privacy International" and show first the articles most people would probably be interested in.

Google has generated around 90% or more of UK search traffic each year over the last ten years and generated over 90% of UK search advertising revenues in 2018.

CMA Interim Report, §16
According to the findings of the report, Google's access to vast query data is among the three things its dominance comes from. Don't let the term confuse you; query data is what we type in our search engines hundreds of times per day and as every techie friend will confirm they provide Google also with our location, IP address and other personal data.
Combined with the fact that Google has established deals to be the default search engine across most desktop and mobile devices (yes, Android is also Google) this triggers a vicious cycle where personal data of millions of users' are constantly being fed back to the company.

"Facebook has significant market power in social media"

None of the platforms currently active in the UK’s social media sector appear to impose a strong competitive constraint on Facebook.com. No existing social media platform offers a comparable range of consumer services, has access to as extensive a consumer network or has a similarly well-developed social graph.

CMA Interim Report, §3.165
In other words, Facebook has so many users (and accordingly personal data) that they can monopolistically attract advertisers by being able to reach all kinds of audiences. This is because the more we interact with the Facebook services, the more data we generate that can directly or indirectly provide insights about our life or let others draw inferences and assumptions about our habits, behaviour and characteristics. This is what we call profiling. And, in 2018, we showed how this could still be done even if you don't have a Facebook account.

There's also another aspect of Facebook's dominance that's worth mentioning; network effects. Due to the vast numbers of users that are on the platform, most of us would find it hard to switch to another service because most of our friends -if not all- are on Facebook, or platforms owned by Facebook like Instagram, for example, and we wouldn't be able to have the same number of connections on a new platform. This is something that might prevent competitors from entering the market, by "locking" users in.
As the report (and competition law) say, being big/dominant is problematic when it creates obstacles for other companies to enter the market. For us, this also underlines how our personal data can be used by Facebook and Google to strategically use their market dominance and attract advertisers' attention.
This is bad for both consumers and innovation
Why's that important? We're glad you asked.
Personal data is valuable tool for these companies as it helps them profile and analyse audiences, and attract advertisers. And, of course, the more personal data they have, the larger their profits, regardless of whether their exploitation practices are lawful or not.

But here's the spin. If these dominant actors are left unregulated, they will throw out competitors, kill innovation and engage in a race to the bottom to collect ever more data. And if they are able to monopolise users and services, then they can take advantage of us by forcing us to agree to abusive terms (that could, for example, lead to us handing over disproportionate amounts of data in return for services). As the report puts it:

limited choice and competition also means that people will be less able to control how their personal data is used and may effectively be faced with a ‘take it or leave it’ offer when it comes to signing up to a platform’s terms and conditions. For some, this will mean they have to provide more personal data to platforms than they would like.

CMA Interim Report, §11
This is NOT your fault
We don't want to sound like your therapist, but we want to assure you one thing: this is not some kind of black-mirror-style punishment for skipping that 7589343520017462-page-long privacy policy or for that day you wanted to look cool in front of that friend over your shoulder and clicked "Accept" without even reading. EU privacy laws are clear and set strict limits when it comes to what these services are allowed to do without our consent.
And, in what can only be seen as an emphatic endorsement of the long-established TL;DR (Too Long; Didn't Read) principle, the CMA also agrees with us:

• At the moment consumers must engage with unreasonably long, complex, terms and conditions and must make several clicks to access their settings. Understandably, consumers rarely engage with these terms and when they do, they spend very little time reading them. It is unreasonable to expect ordinary consumers to read and understand these terms for every platform that they use.

• Consumer engagement with privacy policies and controls is low. And platforms do little by the way of systematic testing to measure this or test what would increase consumers’ engagement with these policies. Instead they rely on the fact that very few consumers alter the default settings in order to increase their ability to use personal data.

CMA Interim Report, §4.156

Potential solutions

Having established why this is a problem (a huge one, if you ask us), the CMA goes on to consider a few regulatory interventions (or remedies) that they could impose on dominant tech players to fix the market asymmetry. Some of them are really good, such as a code of practice (soft-law), enhanced privacy enhancing technologies, increased user control over their data, especially data portability, as well as interoperability of online services.

Third-party access to personal dat... wait, what?
There's a quite awkward moment, where according to the CMA, another potential intervention to deal with Google's dominance in the search engine market is opening up access to search query data that Google has to its competitors:

[S]uch an access remedy could require Google to provide access to a number of data points, potentially some or all of;
• user queries;
• URLs returned;
• user clicks and any click backs; and
• other relevant data, such as location data or previous search, required to interpret the data above.

CMA Interim Report, Appendix J, §41

OK, this is serious.
Privacy and the protection of personal data are fundamental human rights. It is impossible to treat them as any other economic asset. Considering how these companies seem to handle our data, we believe that personal data sharing standards can pose grave risks also for the security and integrity of consumers’ personal data.

What if we anonymise though?
Si, correcto. Personal data can be pseudo anonymised or anonymised. The first means that certain identifiers in a dataset, for example, are replaced by certain values which make it temporarily hard to re-identify (think of the university exams example where names and student numbers are replaced by candidate numbers which the administration can then trace back to students once papers have been graded). Anonymisation, on the other hand, means that once data has been anonymised, they can never identify individuals again. Accordingly, the first is covered by data protection laws while the second is not.
There is a fine line between pseudo anonymous and anonymised data. For example, journalists from the German public broadcaster NDR were able to identify the sexual preference and medical history of judges and politicians, using online identifiers. And, in a recent study, researchers were able to demonstrate that, despite the anonymisation techniques applied, “data can often be reverse engineered using machine learning to re-identify individuals.”
Last September, we looked into menstruation apps, which are not just concerned with menstruation cycles but may also collect information about users’ health, sexual life, mood etc. We examined whether any of these sensitive health data were shared with third parties without users’ consent or even knowledge. We found out that several apps conducted – at the time of the research – what we believe to be extensive sharing of sensitive personal data with third parties, including Facebook. Among the data shared, was whether users were having unprotected sex!

It is time to act!

All these just show how messy the situation is at the moment when it comes to online platforms and digital advertising. This is why we had already asked the CMA, in our first submission, to take further action and use its legal powers to carry out a formal investigation.
While it admits that “given the […] number of consumers affected by them, a market investigation would appear to be a proportionate response”, to our surpise, the CMA does not think it would be a good idea. And although they reckon that some of their cool solutions could only be imposed as a result of a market investigation, they are discouraged by the fact that the government is considering policy changes too and that the issues are of global nature and it might be hard for the UK to do things on its own.
The problem is that if we really want to be pragmatic, we have to take this to the end. The CMA cannot just come up with some recommendations whose implementation will depend on the will of the UK government and the multi-million-dollar lobbying of these companies. The CMA is the independent body that has the capacity and expertise to protect consumers' welfare and send a strong message to its international counterparts by holding these companies to account. It can't just stop here!

What's next

The deadline to respond to the preliminary findings and suggested interventions was February 12, 2020. We submitted our comments, welcoming the findings and some of the interventions, but mainly focusing on the data privacy concerns that the data sharing remedies raise. We also asked the CMA to revisit its position not to make a market investigation. The CMA will have to make a final decision by 2 July 2020. You can find our submission here.