The Digital Future

by Sukanya Hosmani

Abstract

Introduction

The Personal Data Protection Bill, 2018 was drafted by the Srikrishna Committee subsequent to the Supreme Court declaring right to privacy as a part of right to protection of life and personal liberty in the case of K.S. Puttaswamy v. Union of India.^[1] Both the 2019 and the 2018 drafts lay emphasis on concerns such as- obtaining consent before accessing an individual’s data^[2], penalties for violating the law^[3], setting up a Data Protection Authority (“DPA”)^[4] and storage of data collected within India.

This bill came against the backdrop of the Aadhar Project, the biggest unique identification database of citizen data in the world. It is in this age of datafication where every activity of ours (be it financial transactions or online behaviour) gives away not only our financial records and credit history but also derivative sensitive information pertaining to health, sexual orientation and preferences, religious and political stances, and personality traits. Such a huge database creating a map of maps of information pertaining to individuals raises crucial security questions. In this digital economy, many questions are raised and analysed with regard to technology’s impact on consumers and on the competitive market. A key question that we see coming up, to which there is no clear answer yet, is – how relevant is privacy to the analysis of competitive effects?

Considering privacy in analysing competitive effects

We know competition law encompasses within itself many non-price elements of competition such as innovation, quality, service etc. In the context of personal data protection, the non-price element we consider is privacy. Companies may compete amongst each other to provide better privacy policies to their consumers over their competitors. However, these consumers have very different ideas about how they care about data privacy. Some do not like it when they are on the receiving end of targeted advertising whereas some find value in it as it is more relevant to them. To make matters murkier, there is a phenomenon known as the ‘Privacy Paradox’, which means that while a majority of users claim to care about their privacy and the need for data protection, in reality they do not act like it.^[5] Whenever asked if they value their privacy, the invariable response from people is a resounding ‘yes’. However, they continue to use services that undermine this very beloved privacy of theirs. We do not have to look any further than Facebook for an example. In 2018, Facebook was engulfed in a massive security breach which compromised nearly 50 million Facebook users. A number of hackers acquired the ability to take over accounts. This is considered to be the largest breach of data in the history of Facebook. Despite this, the number of daily active users from around the globe on Facebook is still huge in number, and it continues to grow. The average revenue per user is also only increasing.^[6] So clearly this serious security issue seemed to make absolutely no difference to users’ behaviour whatsoever.

The problem that the privacy paradox gives rise to, that ultimately leads to market failures, is two-fold. Both these outcomes are related to the role of consent.^[7] The first is wilful data negligence, which means caring about data protection but not actively taking measures towards it (like reading the privacy policies carefully or using methods that are more privacy enhancing on their devices). The second problem concerns a lack of transparency with respect to what companies and organisations do with users’ data. Even if users want to actively take steps to protect their data, they cannot due to a simple lack of ability arising out of them not knowing what happens to their data. Some of these platforms are dominant and almost indispensable to consumers, who have little choice and tend to use the same platforms and show an unwillingness to switch. Such platforms are often compared to utilities in the sense that users feel they cannot do without them and so have limited choice but to accept their terms of service.^[8] Most times these interrelated problems conjoin and sometimes despite companies putting out privacy policies, there is little to no difference made to users’ data security.

Companies that make use of users’ data, view data privacy laws as a threat to their business and hence put up a fight against them. There was resistance in the EU against the General Data Protection Regulation 2016/679 (“GDPR”), just as there is resistance against data protection reforms in the USA. It is safe to say that the case is not that users do not care about their data privacy: it is more about the market conditions that do not allow for these legislations to come into place as the competition that is created prevents companies from adopting privacy friendly methods. Data is a crucial component of the business models of digital platforms, and control of data confers market power to such platforms. Furthermore, economies of scale and scope, data – driven network effects and control of data that giants like Facebook and Google possess, create high barriers to entry for new entrants in the market. Establishing a successful platform that can attract sufficient online traffic while abiding by privacy enhancing methods like say, obtaining affirmative consent of end-users, is a significant challenge for companies.^[9]

The EU competition law acknowledges the need to protect competition while at the same time leaving room for allowing situations where it is necessary for the benefit of consumers. This is laid out in Article 101 of the Treaty on the Functioning of the European Union (“TFEU”). While Article 101(1) of the TFEU prohibits agreements and concerted practices between undertakings which may distort competition in the internal market, Article 101(3) permits it on the basis that it promotes consumer welfare by fulfilling four cumulative conditions laid out in it, namely:-

1. increases efficiency gains
2. confers a fair share of gains for consumers
3. ensures the preservation of competition; and lastly,
4. the measures are indispensable to the objective sought to be achieved.^[10]

The Commission issued Guidelines on the applicability of Article 101(3) laying down a set of criteria to determine pro-competitive effects.^[11] For instance, efficiency gains may comprise a range of economic and econometric properties including cost and qualitative efficiencies.^[12]

Two sides of arguments to privacy enhancing data practices

There are two sides of arguments to considering privacy enhancing data practices as increasing qualitative efficiencies and hence promoting consumer welfare^[13].

_* The other side argues that it furthers consumer welfare, as personal data of individuals is considered to represent monetary value and is to be considered a counter performance for the so called “free” digital services. It is argued that the collection and use of personal data is not so much a paid price, but an objective cost imposed on consumers in the process of digital transactions. A recent proposal for an EU Directive on the supply of digital content has acknowledged that personal data in the modern digital economy can be used to pay for digital content.^[21] In the same vein, the Bundeskartellamt established in its Facebook decision that in December 2018, the Average Revenue per User was to be estimated at $10.98 bn in Europe and $17.37 bn worldwide.^[22]

The collection and use of consumers’ personal data has become a vital feature of digital markets and has created significant efficiencies for consumers. It is therefore well accepted that when competition authorities assess the health of competition in these markets, they should consider the benefits consumers receive from digital services- online search, social networks, fast and convenient connections with relevant products, news and entertainment and real-time information on healthier lifestyle choices.^[23] The collection and use of personal data is not so much a paid price, but an objective cost imposed on consumers in the process of digital transactions. We should be more concerned about the consequences of these revelations for consumers, than what the supplier gains from each incremental revelation of consumer data. A critical problem for consumers and for the competitive process is that, currently, these costs are hidden and consumers have almost no power to address them. Concealed data practices create objective costs and detriment for consumers. They undermine the competitive process by chilling competition on privacy quality and increasing inequalities in bargaining power and information asymmetries between suppliers and consumers. It is therefore imperative that competition authorities take into account these costs and detriments in assessing the state of competition.

Conclusion

It needs to be understood that besides being a standard currencies’ substitute in order to pay for digital services, personal data has another underlying value, namely privacy. Disclosure of personal data leads to increased risks of identity theft or fraud, like we have seen in the Facebook case. Indeed, in this post Cambridge Analytica time, citizens report high levels of concerns about the protection of their personal data and sensitive information leakage.^[24] Using privacy enhancing methods for companies operating online creates a positive externality for the whole market, and therefore instead of focusing on the economic losses caused to a few players in the market, it should be understood that consumer welfare is more than simply price. The last decade has seen a global shift away from the purely price-driven understanding of consumer welfare^[25] and there is no reason why data protection needs to be left out of it.

---

References