Data protection and competition law: friends or foes regarding data sharing?

Abstract

Data plays a prominent role in the digital economy, as being able to use data to develop or improve innovative products or services is a key competitive parameter. Consequently, an increasing call for more data sharing is being made in the EU. However, this might create tensions with the policy objectives of the GDPR, as data sharing will often cover both personal and non-personal data mixed in the same dataset. Unsurprisingly, large data holders have started to use data protection considerations to justify refusals to share data with third parties. This could create some serious competition issues, and some authors thus argue that the GDPR strengthens large data holders’ position by increasing concentration in data markets and by reinforcing barriers to data sharing. This finding seems to rely on the double premise that: i) the GDPR is more lenient towards personal data re-use within the ecosystem of these large data holders than it is towards the sharing of this personal data with third parties; and that ii) the way in which these large data holders re-use personal data within their ecosystem complies with data protection law. In this paper, we show that these two premises can be challenged from a theoretical point of view. Yet, even if these premises are challengeable, large data holders do apply “double standards” in practice. They adopt a very restrictive approach towards data sharing with third parties while massively circulating their users’ data internally. We outline that this is mainly the result of a lack of data protection enforcement, which led, in turn, to a lack of competition enforcement. Therefore, to solve this “double standards” issue, we argue that there is a crucial need for more enforcement of the existing rules by data protection authorities. Data protection, which might presently be somewhat of a foe to competition in light of the “double standers” situation, could become a friend if enforced with more pugnacity against large data holders, as it would not only reinforce the protection of data subjects but would also ensure the existence of a healthier competitive environment.