Analysis: Why the EU’s competition warning shot at Google is good news for privacy


 By Simon Davies

The EU competition commissioner, Joaquín Almunia, has put Google on notice that it risks huge fines if it cannot propose improvements to its search business. His comments – at a press conference in Brussels yesterday – appear to have put the advertising giant into checkmate.

“I concluded that the proposals that Google sent to us months ago are not enough to overcome our concerns,” he said, adding that the company would need to offer a much stronger package of proposals if it wished to avoid a head-on confrontation with EU competition safeguards.

Joaquín Almunia

Joaquín Almunia

While this ultimatum will come as a relief to consumer groups and to Google’s competitors (such as they are) Almunia’s position doesn’t go anywhere near far enough in terms of privacy concerns.

Google’s market dominance has created huge privacy threats. While much of the EU’s competition focus has been on Google’s abuse of its market position by favouring its own advertisers, rights advocates are increasingly concerned that the nature of Google’s domination – and the very nature of the company itself – creates a dampener on privacy protection across the entire market.

There’s a widespread view that Google has created a lowest common denominator of protection toward which other companies – in order to remain competitive – are gravitationally drawn. Some companies resist this pressure and strive to create clear blue water on privacy issues, but – as with other industries with dominant players – the struggle to offer stronger protections can be fatally challenging.

That Google is a bad privacy player is now beyond question. In the space of a month its cloud services have been banned in the Swedish public sector and the company’s privacy policy has been declared unlawful in Spain and France, with several more EU countries actively investigating data protection breaches by the company.

That Google is a bad privacy player is now beyond question.

Only yesterday Der Spiegel revealed that Google’s Android operating system routinely copies WiFi passwords into the company’s servers – completely unencrypted – and raising substantial privacy and security concerns.

It is for these reasons that the EU competition authority should bear in mind that there are equally significant issues at stake in the competition arena – even if they are a little more arcane that ad placement.

Regulators have occasionally considered the intersection between privacy and antitrust law, though until now it has to be said that they’ve not prioritised the connection. Most competition regulators have focused on traditional antitrust issues such as pricing and market entry aspects.

Search is a particularly critical function because that process is a gateway not just to Internet content, but to the products and services that people want to use. In some respects it’s like a supermarket that leverages its physical locations to funnel customers to other activities in the supermarket family such as insurance and banking.

Search is a particularly critical function because that process is a gateway not just to Internet content, but to the products and services that people want to use.

The way privacy as a market differentiator can be paralysed or distorted because of a failure of open competition is something that has yet to fully emerge. Historically there is an endemic connection between consumer protection, consumer safety and the structure and nature of industry sectors.

Where there is a single dominant company in any sector, consumer rights tend to become retarded. This is so regardless of whether the industry in question is chemical production or genetic research.

This translates in privacy terms as follows:

•    Privacy innovation becomes retarded when industry is monolithic
•    Privacy products and services require innovation and competition to become economically viable
•    Privacy thrives in a dynamic environment of ideas and markets
•    For privacy to become a mainstream component of the market, industry must view it as a viable and socially important concept and innovation must thrive so consumers have genuine choices open to them.

Joaquín Almunia seems to resonate with some of these points. He gave a surprisingly frank keynote address last year in Brussels, and told delegates “I believe we are only at the beginning of a proper governance of privacy rights and of the commercial use of personal data”.

As the single dominant player in search, and with search being the entry point for other data products, this was inevitably going to be a competition question that required attention.

The EU competition authority has acknowledged that privacy is a critically important issue for the region, so it must recognise that Google’s dominance perpetuates its ability to amass massive troves of personal data.  Google’s dominance enables it to collect a broad range of personal data – including information about users’ shopping habits, locations and even financial details – from millions of consumers throughout Europe.  And under its new privacy policy – a policy that users effectively have no choice but to accept – Google then can combine the data it collects across its services to build comprehensive profiles of users.  By curbing Google’s dominance, regulators will erode Google’s ability to collect and combine such data.

Where there is a single dominant company in any sector, consumer rights tend to become retarded.

And as outlined earlier, Google’s dominance prevents it from having to compete with others on the basis of privacy.  Google’s dominance means that consumers do not have viable commercial alternatives for services that are critical to the online ecosystem.

Without viable commercial alternatives, consumers believe they have no choice but to use Google’s services, which means that Google need not “compete” on privacy to retain customers.  This enables Google to, at best, be very aggressive in its approach to privacy, and, at worst, disregard consumer privacy concerns entirely.  Google’s dominance also means that smaller, innovative start-ups and other competitors that offer better privacy protections than Google have little chance of succeeding.

It’s clear that existing regulatory mechanisms have not been effective in curbing Google’s privacy-related breaches.  Regulators may have certain tools at their disposal to address privacy infractions, but these have proven ineffective when it comes to Google.  Google ignored the request of European regulators not to roll out its new privacy policy.  And it has been equally non-responsive to recent conclusions by regulators in Spain, the UK and other markets that its privacy policy violates EU law.  Google’s repeated privacy missteps in services such as Buzz, StreetView and Analytics suggests that despite intervention by Member State regulators, Google has no plans to reform its behaviour.  Competition-related remedies would limit Google’s ability to disregard its consumer obligations with impunity.

If regulators do not act now, the problem will only worsen.  As a beneficiary of network effects, Google’s ability to collect data is only growing.  And as the data held by Google grows, it becomes even more privacy-invasive and requires Google to compete even less on privacy protections.  If Google’s dominance is not curbed now with effective competition remedies, it will act with even greater impunity in the future.